SBOM
also: Bill of Materials, BoM
A Software Bill of Materials (SBOM) is a detailed inventory of all software components, libraries, and dependencies that make up an application or system, including their versions and sources.
An SBOM is a machine-readable document that catalogs every piece of software used in a project, similar to an ingredient list on food packaging. It captures direct dependencies, transitive dependencies (dependencies of dependencies), and metadata about each component.
SBOMs are critical for security and compliance, enabling organizations to quickly identify which systems are affected by vulnerabilities in specific libraries. For example, if a critical vulnerability is discovered in OpenSSL version 1.1.1k, an SBOM lets you instantly see all applications using that exact version.
Common SBOM formats include CycloneDX and SPDX (Software Package Data Exchange). Modern Linux distributions and container tools can generate SBOMs automatically, and regulatory requirements like NIST Secure Software Development Framework increasingly mandate their use in software supply chains.