Sbom
28 items tagged with "sbom"
Standards2
CycloneDX 1.7 (SBOM)
A bill-of-materials standard for software, hardware, services, and machine learning models. 1.7 is published as the second edition of Ecma-424 and broadens attestation and cryptographic inventory support.
SPDX 3.0.1
An ISO-standardised bill-of-materials format for communicating software composition, licences, and provenance. 3.0.1 is a maintenance release of the 3.0 model, which reorganised SPDX into profiles covering security, licensing, build, and AI/data.
Best Practices6
Supply-chain Levels for Software Artifacts (SLSA)
End-to-end integrity guarantees for software supply-chain; defines levels 1-4.
CycloneDX SBOM Specification
Lightweight Bill-of-Materials standard for software components, vulnerabilities, and licenses.
Container Image Hardening Guide
Steps to build minimal, non-root, signed container images with SBOMs.
Sigstore Keyless Signing
An open standard for signing software artifacts using short-lived certificates tied to identity, removing the burden of managing long-lived private keys.
in-toto Supply Chain Attestation
A framework that secures the software supply chain by cryptographically verifying that each step in the build and release process was performed as intended.
Reproducible Builds
A set of practices ensuring a given source plus build environment always produces bit-for-bit identical binaries, so anyone can independently verify what shipped.
Tutorials13
How to generate an SBOM in your CI pipeline
Produce a software bill of materials for every build in CI and attach it as an artifact for compliance and security.
How to Scan Dependencies for Vulnerabilities in CI
Generate an SBOM, scan dependencies against vulnerability databases, gate merges on severity, and automate upgrade pull requests.
Export a CycloneDX SBOM with Vibgrate CLI
Generate a standards-compliant CycloneDX SBOM from your project in one command and write it to a file ready for sharing or archival.
Generate an SBOM in CI with GitHub Actions
Add a GitHub Actions step that produces a fresh CycloneDX SBOM on every build and uploads it as a workflow artifact.
Attach an SBOM to a GitHub Release
Generate a CycloneDX SBOM during your release workflow and publish it as a downloadable asset on the GitHub Release.
Produce an SBOM for Compliance and Audit
Generate an SPDX or CycloneDX SBOM as documented evidence for a compliance audit, with a readable report to accompany it.
Scan a Containerized Project for Supply-Chain Signals
Scan a Dockerized project so the Build & Deploy Scanner detects containerization signals, then export an SBOM of its dependencies.
Export an SBOM per Package in a Monorepo
Generate a separate CycloneDX SBOM for each workspace package in a monorepo by scanning and exporting per package directory.
Push Scan Results and SBOM to Vibgrate Cloud
Authenticate the CLI, push scan results to Vibgrate Cloud for team visibility, and export an SBOM as a local supply-chain artifact.
Review License Findings in Your Dependency Inventory
Export an SBOM and a readable report to review the licenses of your dependencies and flag obligations for legal and compliance review.
Integrate SBOM Generation into a Release Pipeline
Add a release-pipeline stage that scans, exports a CycloneDX SBOM, and publishes it as a versioned artifact for every release.
Combine a Drift Scan and SBOM Export in One CI Job
Run a single CI job that scans for drift with a failing gate and exports a CycloneDX SBOM, covering quality and inventory together.
Verify Supply-Chain Posture Before Shipping
Run a pre-ship checklist with Vibgrate CLI: scan with a gate, review risk and security findings, and export an SBOM before release.
FAQs4
How do I export SBOMs from Vibgrate scans?
Use vg sbom export to emit CycloneDX or SPDX SBOMs from scan artifacts. Example: vg sbom export --format cyclonedx --out sbom.cdx.json. Use vg sbom de...
How do I compare two scan results?
Use vg sbom delta --from old-scan.json --to new-scan.json to see dependencies added, removed, and changed between scans. For drift score comparison, u...
What is an SBOM (software bill of materials)?
An SBOM is a formal, machine-readable inventory of all components, libraries, and dependencies that make up a piece of software, including their versi...
How do I prove an SBOM from Vibgrate is authentic?
In Vibgrate Cloud, the SBOM Hub can export your SBOM wrapped in a signed attestation — an in-toto Statement in a DSSE envelope whose subject is the SB...