SBOM

A software bill of materials (SBOM) is a formal, machine-readable inventory of the components that make up a piece of software — the packages, libraries, and their versions — along with metadata such as licenses and suppliers. It answers the question “what is actually inside this thing?” without requiring anyone to take the artifact apart.

The practical value shows up when a vulnerability is disclosed. Given an SBOM for every deployed artifact, determining whether you are exposed to a newly published CVE is a query rather than an investigation. Without one, the same question turns into an audit of every running system.

SBOMs became a compliance concern in the United States after Executive Order 14028 (2021) directed federal agencies to require them from software suppliers, and similar expectations now appear in the EU Cyber Resilience Act.

Two formats dominate in practice: CycloneDX and SPDX. They cover overlapping ground, and organizations tend to standardize on one because of the tooling they already run, which is why artifacts are often published with both.

An SBOM for a virtual machine image is broader than one for an application: it describes the entire operating system, not just an application’s dependency tree.