SBOM Manager

What it does

Data portability

The command line supports exporting a repository archive and importing it to restore a repository.checked 7 Oct 2001

Example integration

The configuration example names cve-bin-tool as the vulnerability-scanning application.checked 7 Oct 2001

Input formats

It supports SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings.checked 7 Oct 2001

Installation

The project documents installation with pip install sbom-manager and requires Python 3.7 or later.checked 7 Oct 2001

Intended use

The project describes use as part of continuous integration and for security audit needs.checked 7 Oct 2001

License

The project is licensed under the MIT License.checked 7 Oct 2001

Output

Results can be printed to the console or written to a file, with console or CSV output formats.checked 7 Oct 2001

Purpose

SBOM Manager manages a collection of Software Bills of Materials (SBOMs) and supports SPDX and CycloneDX formats.checked 7 Oct 2001

Queries

Users can search for modules, filter by project, list repository contents, and view update history.checked 7 Oct 2001

Scanning limitation

The project says deciding whether reported vulnerabilities need fixing is beyond the tool’s capability.checked 7 Oct 2001

Security limitation

The tool cannot determine whether an SBOM is valid or complete, so users are advised to check the quality of input data.checked 7 Oct 2001

Support

Bug reports and feature requests can be submitted through GitHub Issues.checked 7 Oct 2001

Vulnerability scanning

Scanning requires an external vulnerability scanner that accepts an SPDX Tag/Value SBOM file, configured by the user.checked 7 Oct 2001

Workflow

It can maintain records of components in software releases or builds and query whether specific components and versions were used.checked 7 Oct 2001