Free tools Windows power users keep installed
One-click scans. No signup required.
An SBOM is useful when it is a machine-readable, versioned inventory tied to the exact software artifact you ship—not merely a screenshot of a report. Generate it in the release workflow, make its scope and generation context clear, publish it alongside the release, and give users a way to verify its relationship to the artifact. A screenshot can help a person read results; it cannot substitute for an inventory that tools can process or for a checkable link to the released package.
What is an SBOM?
A software bill of materials (SBOM) is a formal, machine-readable inventory of software components and related information. CISA describes it as an “ingredients list” for software in its July 29, 2026 announcement. In practice, useful SBOM data can include component names and versions, identifiers, supplier information, dependency relationships, hashes, licenses, the tool that generated the document, and when and how it was generated.
As an Amazon Associate I earn from qualifying purchases.
Those details help consumers and automated systems understand what a package contains and assess it against their own requirements. A polished PDF or screenshot may be easy to view, but it does not give downstream tools the structured component inventory and relationships they need. Keep any visual report as an optional companion, not as the sole SBOM deliverable.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhy should the SBOM be a release artifact?
A release artifact is the specific package, container image, installer, or other deliverable that users receive. The SBOM should describe that release’s boundary: the components actually represented by the package, rather than an ambiguously broad repository or an unrelated build input. Versioning and publishing the SBOM with the release makes it possible to identify which inventory belongs to which deliverable.
#1 Best Overall
Generation context matters because different methods can describe different things. CISA’s 2025 Minimum Elements guidance distinguishes pre-build or source SBOMs, build-time SBOMs, and analyzed or post-build SBOMs. A source SBOM can describe declared inputs; a build-time SBOM can capture components that contributed to a releasable artifact; post-build analysis describes what a tool detects in the built object. State which approach produced your release SBOM instead of leaving users to infer it.
CISA’s 2026 guidance announcement highlights component hash, license, SBOM tool name, and generation context among refined baseline fields and emphasizes machine-processable formats. It says the guidance applies to all software while noting that AI and SaaS may need additional elements. The appropriate data and scope still depend on the software and the consumers who need to use the SBOM.
How do I generate an SBOM in CI/CD?
Make SBOM generation a repeatable pipeline step associated with each release, rather than a manual afterthought. Choose whether it should describe source inputs, build-time contributors, or an analysis of the finished package, then ensure the selected method matches the artifact consumers will download. The right format and generator depend on the ecosystem, required fields, and what consumers can process; SPDX and CycloneDX are both established options, but do not assume every consumer or requirement treats them as interchangeable. OWASP’s CycloneDX lifecycle guide describes CycloneDX as a general-purpose BOM format covering software, hardware, services, and other inventory.
- Define the release boundary. Identify the exact package or image to be published, including its version and the projects or modules that contribute to it.
- Generate at the appropriate point. Run the generator from source or build data, or analyze the finished artifact, according to the intended generation context. Record that context in the SBOM or release documentation.
- Check the document. Confirm that the package name and version match the release, that the inventory covers the intended boundary, and that relationships and required fields are present. Include hashes, licenses, generator identity, and generation context where applicable.
- Bind it to the artifact. Create an attestation or another independently verifiable association between the SBOM and the exact release artifact. A filename or matching version string alone is not a cryptographic proof of that relationship.
- Publish and retain it. Upload the SBOM with the release, and keep the generation and verification steps in the workflow so the result can be reproduced for later releases.
For example, the CycloneDX Gradle plugin README demonstrates building a JAR and its direct SBOM, attesting SLSA build provenance for the JAR, attesting the CycloneDX SBOM for that same JAR, and publishing the versioned SBOM as a GitHub Release asset. It cautions that an aggregate SBOM is appropriate only when its scope matches the projects contributing to the distribution. This is an implementation example, not a universal workflow for every platform; the README also states that using the plugin alone does not establish a SLSA Build level.
NIST’s DevSecOps functional demonstrations show other operational patterns, including pipeline-generated JSON or XML SBOMs for download and review, SPDX or CycloneDX output, signing, logs, and GitLab CI evidence associated with release artifacts. These are selected demonstrations, not a guarantee that every integration behaves the same way. NIST records that SLSA attestations were deferred in some demonstration tracks, so an SBOM in a demonstrated pipeline should not be taken as evidence that provenance was always generated.
How do I attach an SBOM to a release?
Publish the SBOM in the same release channel as the artifact, with a filename and version that make the association understandable to humans. For example, a project could attach a versioned JSON SBOM asset to the corresponding GitHub Release. The file should remain a structured document in a supported machine-processable format; a screenshot may accompany it for convenience, but should not replace it.
For a stronger association, publish an attestation that identifies the artifact and the SBOM claim, and make the verification procedure available to consumers. The Gradle plugin README’s example publishes the versioned SBOM as a release asset and documents verification commands for both the artifact’s provenance and its SBOM attestation. Adapt the mechanism to your hosting and signing ecosystem; a release attachment by itself is distribution, not proof that the file describes the artifact.
How can I verify an SBOM?
Verification has two parts: inspect whether the SBOM describes the intended package, and check whether the claimed relationship between that SBOM and the released artifact is verifiable. A consumer should be able to identify the release, retrieve its SBOM and any associated attestation, and follow published instructions using compatible verification tooling.
Best Value
- Compare the SBOM’s package name and version with the release you obtained.
- Review its component scope, relationships, hashes, licenses, generator identity, and stated generation context against your needs.
- Verify the attestation or other integrity mechanism against the exact artifact, following the project’s documented commands and trust configuration.
- Treat missing fields, unclear scope, or an unverifiable association as limitations; do not infer that a well-formatted document necessarily represents the shipped package.
SPDX’s Annex L field mapping illustrates fields corresponding to creator, supplier, package name and version, identifiers, relationships, and timestamp, and says the document must describe at least one package. That page is a development-version specification annex, so it is an illustration of field mapping rather than evidence that this precise revision is a final normative release.
Does an SBOM prove how software was built?
No. An SBOM describes components and related information; by itself, it does not establish the build process, identify every build input, or prove that the released binary came from the claimed source. Build provenance is a separate claim that needs its own evidence and verification. In the Gradle example, provenance for the JAR and the SBOM attestation are separate claims, each associated with the artifact. That distinction is why publishing an SBOM should be part of a broader release-evidence workflow when consumers need to verify both contents and build origin.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
