What is an SBOM?
Short answer. An SBOM is a software bill of materials: a list of the parts inside one piece of software, such as each component's name, version and licence. Think of the ingredients label on food. The common formats are CycloneDX and SPDX.
Does this tool read SBOMs?
No. This tool does not read SBOM files. Its input is a CSV inventory export. See what the input file needs.
An SBOM is not an inventory
- An SBOM lists what is inside one product.
- An inventory export lists what is installed across an estate.
Does this tool have an SBOM of its own?
Yes. Each CI run on a pull request or a push to main writes a CycloneDX 1.5 SBOM and uploads it as a build artifact named sbom. It lists the tool itself and no third-party components, because the tool uses only the Python standard library. It is not attached to releases, and it is not independently assessed.
Not found: a download link on this site. The artifact lives in the CI runs on GitHub.