sbomasm

What sbomasm is

sbomasm is a free, self-hosted toolkit for managing software bills of materials (SBOMs), from combining and editing files to removing sensitive details, enriching license information, and signing or verifying them. It supports SPDX and CycloneDX and can merge multiple SBOMs through hierarchical, flat, or augment workflows. Its edit command adds or updates metadata such as supplier information and licenses; the rm command can remove components or fields before an SBOM is shared. The enrich command can use ClearlyDefined data to fill missing license information. Signing and verification use ShiftLeftCyber's third-party service. The project documents a Dependency-Track workflow for retrieving, assembling, and returning SBOMs, plus automated assembly use in GitLab and GitHub CI. Installation options include Go install, Homebrew, Docker, prebuilt binaries, and building from source. Release archives cover macOS Darwin and Linux on arm64 and x86_64. The repository is published under the Apache-2.0 license, and project contact options include Slack, live chat, email, and GitHub bug reports.

Who it suits

sbomasm suits teams that manage SBOMs in self-hosted workflows and need to assemble, edit, enrich, or verify them. Its documented CI and Dependency-Track workflows may fit teams using those ecosystems.

Getting started

1. Open the sbomasm GitHub repository.
2. Choose an installation route: Go install, Homebrew, Docker, a prebuilt binary, or building from source.
3. Install it on Linux or macOS.
4. Use the commands to assemble or edit SBOMs in SPDX or CycloneDX format.

Verdict

sbomasm provides a free toolkit for SBOM lifecycle tasks, including assembly, metadata editing, and license enrichment. Teams needing signing or verification should note that those functions use ShiftLeftCyber's third-party service.