sbomasm

What sbomasm is

sbomasm is a free, self-hosted toolkit for managing software bills of materials (SBOMs), from assembly and metadata updates to cleanup, enrichment, signing and verification. It works with both SPDX and CycloneDX formats and can merge multiple SBOMs using hierarchical, flat or augment workflows. Its edit command adds or updates details such as supplier information and licenses; its rm command removes components or fields, including internal components before sharing. The enrich command can fill missing license information using ClearlyDefined data. sbomasm can cryptographically sign and verify SBOMs through ShiftLeftCyber’s third-party service. The project documents a Dependency-Track workflow for retrieving SBOMs, assembling them and returning them, and describes automated assembly in GitLab and GitHub CI. Installation choices include Go install, Homebrew, Docker, prebuilt binaries or building from source. The latest release lists macOS Darwin and Linux archives for arm64 and x86_64. Published under Apache-2.0, the toolkit is described as optimized for large-scale operations. It runs on Linux and macOS.