+2.2.3 SBOM Open-source Tooling Landscape
|
2.2.3 SBOM Open-source Tooling Landscape
Integration and automation are only possible when supported by the necessary tool stack. Based on the SBOM Adoption State of Play 2026, 33% of the organisations rely on open-source tools, thus Table 4 identifies open-source tools that could be integrated into a CI/CD pipeline to support the end-to-end SBOM lifecycle for both CycloneDX and SPDX formats. The tools are categorised based on the SBOM lifecycle phases and should not be considered as an exhaustive, but rather than an indicative list to support the purpose of this document. The following table demonstrates that while some tools are format-agnostic and can support both SBOM formats, certain stages like SBOM generation, schema validation, and/or consumption require format-specific tooling. | SBOM Lifecycle Phase / Format | Generation | Validation | | | Cryptographic Signing | | Store | | Consumption | | Automation | Schema | | Quality | Attestation | Keyless | | Workflow | Vulnerability Management | | | | | Score | | | | artifact | | | CycloneDX (13) | cyclonedx-maven-plugin (Java/Maven), @cyclonedx/ cyclonedx-npm (npm), Cyclonedx-gomod (Go), Cyclonedx dotnet tool (.NET), cdxgen, Syft, SBOMit | CycloneDX CLI | sbomqs, sbom-scorecard (eBAY) | sbomqs, | GitHub CLI (gh attestation generate) | Cosign, Sigstore | actions/upload-artifact@v4 | actions/upload- | Grype, Trivy, OWASP Dependency Check, OWASP Dependency-Track, GitHub Dependency Review, OWASP dep-scan, OSV-Scanner (Go), CVE Binary Tool, | | | | | sbom- | | | | artifact@v4 | |
scorecard (eBAY) | SPDX (14) | spdx-gradle-plugin, | tools.spdx.org/app/validate/ https://tools.spdx.org/app/ntia_checker/ | sbomqs, sbom-scorecard (eBAY) | GitHub CLI (gh attestation generate) | Cosign, Sigstore | actions/upload-artifact@v4 | Fossology, sbomify, sbom-cve-check, tools.spdx.org/app/spdx3_viz, GitHub Dependency Review |
spdx-maven-plugin, spdx/tools-python, spdx/tools-java, spdx/tools-golang, yocto (enabled by default in poky), linux (make spdx), zephyr (west spdx), kubernetes-sigs/bom, GitHub SBOM, Microsoft sbom-tool (.NET), Syft, Trivy, ORT, SBOMit Table 4 - Open-source SBOM Tool Stack The fragmentation of SBOM formats poses a significant challenge to the implementation and tooling landscape. Tooling exists for seamless conversion between the formats, such as OpenSSF's (15) Protobom.
1. Vue d’ensemble
1.1 Références
1.2 Exigences identifiées
1.3 Réglementations associées
2. Exigences identifiées
Exigences
| Source |
Exigence |
3. Réglementations associées
Réglementations
| Source |
Réglementation |
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|