🧩 `SBOM` Generation for Security and Compliance

Software supply chains are under more scrutiny than ever.
High-profile incidents like SolarWinds and Log4Shell have made one thing clear — organizations can’t secure what they don’t fully understand.
That’s where SBOMs (Software Bill of Materials) come in.

🎥 Watch related video: SBOM in Practice — Anchore Syft & Grype Overview

🔍 What Is an `SBOM`?

An SBOM (Software Bill of Materials) is a structured inventory of every component in your software — including third-party libraries, dependencies, and their versions.

Think of it as a nutrition label for your codebase: it tells you exactly what’s inside, where it came from, and what potential risks it introduces.

SBOMs serve three main goals:

Transparency — knowing every dependency and its version.
Traceability — being able to map each build artifact back to source.
Accountability — ensuring teams can prove compliance and security posture.

🧠 Why SBOMs Matter

Security and compliance teams are increasingly required to produce SBOMs for every release — both for internal governance and external audits.

Key benefits include:

Detecting known vulnerabilities (CVEs) early in the pipeline.
Ensuring license compliance for open-source software.
Enabling rapid response to new zero-day threats.
Supporting regulatory compliance, including:
- U.S. Executive Order 14028 on Cybersecurity
- NIST’s Software Supply Chain Security Guidance
- ISO/IEC 27001 and IEC 62443 standards

When new vulnerabilities emerge, SBOMs help teams quickly locate affected components — instead of guessing which projects depend on them.

⚙️ SBOM in Practice

There are several open-source tools that can automatically generate SBOMs from source code, containers, or binaries.
The most common formats are SPDX (Software Package Data Exchange) and CycloneDX.

Tool	Description	Supported Formats
Syft (Anchore)	Scans source, images, or file systems for components.	SPDX, CycloneDX
Trivy (Aqua Security)	SBOM and vulnerability scanner integrated with Docker/K8s.	CycloneDX
Grype (Anchore)	Vulnerability scanner that consumes SBOMs from Syft.	CycloneDX
Docker SBOM	Native SBOM generation built into Docker CLI.	SPDX
GitHub / GitLab CI	Native SBOM generation via CI workflows.	SPDX / CycloneDX

🧪 Example: Generating an SBOM for a Docker Image

Using Syft, generating an SBOM is as simple as:

1
2
3
4
5
# Install Syft (on macOS/Linux)
brew install syft

# Generate SBOM for your image
syft your-app:latest -o cyclonedx-json > sbom.json

You can then scan that SBOM for vulnerabilities using Grype:

1
grype sbom:sbom.json

Output example:

1
2
3
NAME             INSTALLED  FIXED-IN  TYPE     VULNERABILITY     SEVERITY
urllib3          1.26.6     1.26.8    python   CVE-2021-33503   Medium
openssl          1.1.1k     1.1.1t    apk      CVE-2022-0778    High

🧱 Integrating SBOM into CI/CD

Treat SBOM generation as part of your secure build pipeline, not an afterthought.

flowchart LR
    A[Source Code] --> B[Build Image]
    B --> C[Generate SBOM]
    C --> D[Sign & Store SBOM]
    D --> E[Scan for Vulnerabilities]
    E --> F[Deploy to Production]
    F --> G[Monitor & Patch]
    style C fill:#f9f,stroke:#333,stroke-width:2px

Example GitHub Action snippet:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
name: Generate SBOM
on:
  push:
    branches: [ main ]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Generate SBOM with Syft
        uses: anchore/syft-action@v1
        with:
          image: myapp:latest
          format: cyclonedx-json
          output: sbom.json
      - name: Upload SBOM Artifact
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.json

This ensures every build produces a signed SBOM, stored alongside release artifacts for auditing.

🧩 Best Practices

✅ Automate SBOM generation in CI/CD — don’t rely on manual steps.
🔒 Sign SBOMs (e.g., using Cosign) to guarantee authenticity.
🧾 Store SBOMs as part of your release assets or in an artifact registry.
⚡ Scan regularly — new CVEs can appear long after release.
📦 Propagate SBOMs through your dependency chain if you build multi-tier software.

🧭 Final Thoughts

SBOMs are more than a compliance checkbox — they’re a foundation for modern software assurance. By embedding SBOMs into your delivery pipelines, you gain:

Visibility into every component
Confidence in your security posture
Traceability when things go wrong

In a world where supply chain attacks are the new normal, SBOMs turn uncertainty into measurable control.

Visibility is the first step toward trust — and trust begins with transparency.

🚀 Follow me on norbix.dev for more insights on Go, Python, AI, system design, and engineering wisdom.

🧩 SBOM Generation for Security and Compliance

🔍 What Is an SBOM?