microsoft/sbom-tool
Sbom Tool
The software bill of materials tool is a command-line application that scans source directories and container images to produce standards-compliant inventory manifests of project dependencies and build components. It provides utilities for generating, validating, and aggregating manifest files, alongside features for checking files against industry specifications and target build directories.
The application integrates directly into continuous integration pipelines to automate security workflows during the build process. It features a container image inspection engine that extracts container layers and internal package databases without requiring local installation, as well as a cryptographic hashing pipeline that computes and verifies file integrity using configurable hash algorithms.
Additional capabilities include aggregating multiple disparate component inventories into a single unified manifest using configuration rules, parsing and validating multiple standard inventory formats dynamically using schema definitions, and redacting sensitive file paths from generated documents. The tool records local execution metrics and operational telemetry into structured JSON log files without external transmission.
Features
- SBOM Generators - Scans a folder of release files and project source paths to produce a standards-compliant manifest inventorying all build components and dependencies.
- Software Bill of Materials Generators - Scans source directories and container images to produce standards-compliant software bill of materials manifests.
- Manifest-Driven Aggregators - A utility that combines multiple software bill of materials files into a single unified manifest using configuration settings.
- Manifest Merging Engines - Combines disparate component inventories into a single unified manifest file according to declarative configuration rules.
- Multiple Manifest Aggregators - Combines multiple software bill of materials files from different sources into a single unified manifest using a configuration file.
- Container Image Scanning - Inspects specified container images to extract and include their dependency packages in the generated software bill of materials.
- SBOM Validation Utilities - Verifies software bill of materials manifests against industry specifications to ensure format correctness.
- Compliance Validators - Inspects an existing software bill of materials file against industry specifications to verify its correctness and output validation results.
- Container Layer Extractors - Extracts container layers and internal package databases directly to inventory embedded components without local installation.
- SBOM Policy Evaluation - Verifying existing software bill of materials files against industry specifications to confirm structural correctness and data integrity.
- Cryptographic Hash Computations - Computes and verifies file integrity using configurable cryptographic hash algorithms applied across scanned directory trees.
- Multi-Specification Schema Engines - Parses and validates multiple standard inventory formats dynamically using schema definitions mapped directly to version architectures.
- File Reference Redaction Utilities - Processes a manifest file to strip out individual file paths and references, outputting a cleaned copy into a separate directory.
- Integrity Checkers - Inspects an existing manifest file against a target build directory to confirm structural and data integrity for specific manifest versions.
- CI Pipeline Integrations - Integrates build and generation steps into continuous integration pipelines to produce inventory files automatically during builds.
- Inventory File Redactions - Strips sensitive file references from generated inventory documents to sanitize data before publishing.
- Path Redaction Filters - Strips sensitive file paths and references from generated inventory documents to produce clean output copies.
- CI/CD Integrations - Integrating manifest generation and validation steps directly into continuous integration pipelines to automate security workflows.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
