Software Bill of Materials (SBOM)
Software bill of materials (SBOM) is a formal, machine-readable document that provides a list of software components that make up the target software and all its dependencies.
SBOM Formats and Specifications
There are three main delivery formats and specifications for SBOM: CycloneDX, SPDX, and SWID.
CycloneDX is an open-source standard with origins in the OWASP community. The specification's original focus is on security. There's a large growing community and open source tooling that support CycloneDX format.
SPDX is also a product of an open-source community, with the original focus on licensing. SPDX is run and maintained by Linux Foundation. Similarly to CycloneDX, many open-source tools support the SPDX format.
SWID is a standard that originates from NIST. SWID tags aim to help organizations create accurate software inventories. While SWID can serve as an SBOM too, it is not as widely used SBOM format in open source as the two other specifications.
SBOM Usage in Ghaf
Ghaf framework will use SBOMs for:
- Vulnerability identification: automatic correlation of SBOM against known vulnerabilities.
- Vulnerability remediation: automatic process to suggest fixes for identified vulnerabilities.
- Dependency analysis: categorization of open-source and closed source software dependencies.
- Dependency analysis: creation of a directed acyclic graph
- License compliance: know and comply with the license obligations.
- Market signal: publish SBOM together with other release artifacts.
SBOM Tooling in Ghaf
Ghaf is based on Nix, therefore, the selected SBOM tooling needs to support creating SBOMs for nix artifacts. As part of the Ghaf project, we have created the sbomnix tool to support SBOM generation for Ghaf and, more generally, for any Nix-based targets. For more details on the SBOM tooling in Ghaf, see sbomnix and nixgraph. sbomnix supports CycloneDX as well as SPDX SBOM specification.