sbom-diff

How to Generate a Software Bill of Materials (SBOM)

Last updated October 2025

A Software Bill of Materials (SBOM) is a comprehensive inventory of all components, libraries, and dependencies in your software. Here's how to generate SBOMs for various project types.

Why Generate an SBOM?

1. Docker Images

Docker Desktop (version 4.7+) includes built-in SBOM generation using Syft.

Generate CycloneDX SBOM

docker sbom --format cyclonedx-json myimage:latest > sbom.json

Generate SPDX SBOM

docker sbom --format spdx-json myimage:latest > sbom.json

Example: Compare Alpine Linux Versions

# Generate SBOMs for two Alpine versions
docker sbom --format cyclonedx-json alpine:3.18 > alpine-318.json
docker sbom --format cyclonedx-json alpine:3.20 > alpine-320.json

# Load both into https://rozetyp.github.io/sbom-diff/ to see differences (nothing is uploaded)

2. Node.js / npm Projects

Using npm (built-in, npm 9.4+)

npm sbom --sbom-format=cyclonedx > sbom.json

Using CycloneDX Node Module

# Install globally
npm install -g @cyclonedx/cyclonedx-npm

# Generate SBOM
cyclonedx-npm --output-file sbom.json

3. Maven Projects (Java)

Using CycloneDX Maven Plugin

Add to your pom.xml:

<plugin>
  <groupId>org.cyclonedx</groupId>
  <artifactId>cyclonedx-maven-plugin</artifactId>
  <version>2.7.9</version>
  <executions>
    <execution>
      <goals><goal>makeAggregateBom</goal></goals>
    </execution>
  </executions>
</plugin>

Then run:

mvn cyclonedx:makeAggregateBom

Output: target/bom.json

4. Gradle Projects (Java/Kotlin)

Using CycloneDX Gradle Plugin

Add to your build.gradle:

plugins {
    id 'org.cyclonedx.bom' version '1.8.2'
}

cyclonedxBom {
    outputFormat = "json"
}

Then run:

gradle cyclonedxBom

Output: build/reports/bom.json

5. Python Projects

Using CycloneDX Python

# Install
pip install cyclonedx-bom

# Generate from requirements.txt
cyclonedx-py requirements requirements.txt -o sbom.json

# Or from installed packages
cyclonedx-py environment -o sbom.json

6. Universal Tool: Syft

Syft by Anchore works with any language and can scan filesystems, container images, and archives.

Install Syft

# macOS
brew install syft

# Linux
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh

Generate SBOM from Directory

syft dir:. -o cyclonedx-json > sbom.json

Generate SBOM from Container Image

syft myimage:latest -o spdx-json > sbom.json

7. GitHub Actions / CI/CD

Generate SBOM in GitHub Actions

name: Generate SBOM
on: [push]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: sbom.json
      - name: Upload SBOM
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.json

Next Steps

Related Guides