EmbedHarborWhat is an SBOM?
A software bill of materials records the components in your product. Good package identities are the foundation of useful vulnerability matching.
Bring your inventory
Import CycloneDX JSON, SPDX JSON or package-lock.json. Pinned requirements.txt and go.mod are accepted as starting inventories. Unpinned dependencies and Go replace/exclude directives require manual review.
Review identity and coverage
Check component names, exact versions, ecosystem and package URLs. A firmware component without a supported ecosystem remains unassessed by OSV. An incomplete scan must not be treated as a clean result.
Export and maintain
Each import is a separate product-version snapshot. Export the current inventory as CycloneDX and regenerate it when a release changes.
Check the primary source and current guidance before relying on this preparation guide.
Primary source ↗