SBOM Manager

What SBOM Manager is

SBOM Manager is a free, MIT-licensed command-line tool for managing collections of Software Bills of Materials. It supports SPDX and CycloneDX, keeps component records for software releases or builds, and lets users query whether specific components and versions were used. Search options include finding modules, filtering by project, listing repository contents and viewing update history. The project describes continuous integration and security audits as intended uses.

Inputs include SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV and directory listings. Results can be printed to the console or written to a file, with console or CSV output. Users can export a repository archive and import it to restore a repository. The tool runs on Linux, requires Python 3.7 or later, and is installed with pip install sbom-manager. Vulnerability scanning requires a separately configured external scanner that accepts an SPDX Tag/Value SBOM; the example configuration names cve-bin-tool. SBOM Manager cannot assess whether an SBOM is valid or complete, so input quality needs checking. It also cannot decide whether a reported vulnerability should be fixed.

Who it suits

SBOM Manager suits Linux users who need to manage and query SBOM records in continuous integration or security-audit work. Users needing vulnerability scans must configure a compatible external scanner.

Limits

The free plan is listed as free. Vulnerability scanning depends on a separately configured external scanner, and the tool cannot assess SBOM validity or completeness or decide whether reported vulnerabilities should be fixed.

Getting started

1. Use Linux and install Python 3.7 or later.
2. Install the tool with pip install sbom-manager.
3. Provide SBOM data in a supported input format.
4. Search or filter the repository, then print results or write them to a file.
5. Configure an external scanner that accepts SPDX Tag/Value SBOM files if vulnerability scanning is needed.

Verdict

SBOM Manager provides command-line SBOM collection and query functions, with archive export and restore. Users should check input quality and supply an external scanner if they need vulnerability scanning.