+2.2.3 SBOM Open-source Tooling Landscape

2.2.3 SBOM Open-source Tooling Landscape

Integration and automation are only possible when supported by the necessary tool stack. Based on the SBOM Adoption State of Play 2026, 33% of the organisations rely on open-source tools, thus Table 4 identifies open-source tools that could be integrated into a CI/CD pipeline to support the end-to-end SBOM lifecycle for both CycloneDX and SPDX formats. The tools are categorised based on the SBOM lifecycle phases and should not be considered as an exhaustive, but rather than an indicative list to support the purpose of this document.

The following table demonstrates that while some tools are format-agnostic and can support both SBOM formats, certain stages like SBOM generation, schema validation, and/or consumption require format-specific tooling.

SBOM Lifecycle Phase / FormatGenerationValidationCryptographic SigningStoreConsumption
AutomationSchemaQualityAttestationKeylessWorkflowVulnerability Management
Scoreartifact
CycloneDX (13)cyclonedx-maven-plugin (Java/Maven), @cyclonedx/ cyclonedx-npm (npm), Cyclonedx-gomod (Go), Cyclonedx dotnet tool (.NET), cdxgen, Syft, SBOMitCycloneDX CLIsbomqs, sbom-scorecard (eBAY)sbomqs,GitHub CLI (gh attestation generate)Cosign, Sigstoreactions/upload-artifact@v4actions/upload-Grype, Trivy, OWASP Dependency Check, OWASP Dependency-Track, GitHub Dependency Review, OWASP dep-scan, OSV-Scanner (Go), CVE Binary Tool,
sbom-artifact@v4

scorecard

(eBAY)

SPDX (14)spdx-gradle-plugin,tools.spdx.org/app/validate/ https://tools.spdx.org/app/ntia_checker/sbomqs, sbom-scorecard (eBAY)GitHub CLI (gh attestation generate)Cosign, Sigstoreactions/upload-artifact@v4Fossology, sbomify, sbom-cve-check, tools.spdx.org/app/spdx3_viz, GitHub Dependency Review

spdx-maven-plugin,

spdx/tools-python,

spdx/tools-java,

spdx/tools-golang,

yocto (enabled by

default in poky),

linux (make spdx),

zephyr (west spdx),

kubernetes-sigs/bom,

GitHub SBOM,

Microsoft sbom-tool

(.NET),

Syft,

Trivy,

ORT,

SBOMit

Table 4 - Open-source SBOM Tool Stack

The fragmentation of SBOM formats poses a significant challenge to the implementation and tooling landscape. Tooling exists for seamless conversion between the formats, such as OpenSSF's (15) Protobom.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Rialacháin ghaolmhara

Rialacháin