Auto Generate SBOMs for Your Open Source Project Written in Any Language Running on Any Platform
summary
A command line tool called the spdx sbom generator auto produces SBOM documents that conform to SPDX 2.2, is written in Go, and runs on macOS Linux and Windows. It uses per-language generators that invoke package manager APIs (go mod graph, npm/yarn, Maven) to build full dependency graphs, validates ~16–17 required fields, emits tagvalue JSON and RDF outputs, and ships a GitHub Action. It is Apache‑2.0 with a DCO, at 0.0.13 release and already produces usable SBOMs while 3.0 support and deeper validation are roadmap items.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:06What does it do?
- 5:14What is a SPDX Document
- 7:47SPDX field specifications supported (Document Creation)
- 8:25SPDX field specifications supported (Other Licensing)
- 8:45Architecture of the SBOM Generator
related talks
42mBoF: State of SBOM Tools
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
43mUsing SBOMs for Linux Foundation Projects
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
41mSoftware Bill of Materials and Supply Chain with the Yocto Project
32mComposing the Ultimate SBOM
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
38mTeach Your SBOM New Tricks with Bomshell