# microsoft/sbom-tool

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/microsoft-sbom-tool).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

1,982 stars · 192 forks · C# · mit

## Links

- GitHub: https://github.com/microsoft/sbom-tool
- awesome-repositories: https://awesome-repositories.com/repository/microsoft-sbom-tool.md

## Topics

`sbom` `sbom-generator`

## Description

The software bill of materials tool is a command-line application that scans source directories and container images to produce standards-compliant inventory manifests of project dependencies and build components. It provides utilities for generating, validating, and aggregating manifest files, alongside features for checking files against industry specifications and target build directories.

The application integrates directly into continuous integration pipelines to automate security workflows during the build process. It features a container image inspection engine that extracts container layers and internal package databases without requiring local installation, as well as a cryptographic hashing pipeline that computes and verifies file integrity using configurable hash algorithms. 

Additional capabilities include aggregating multiple disparate component inventories into a single unified manifest using configuration rules, parsing and validating multiple standard inventory formats dynamically using schema definitions, and redacting sensitive file paths from generated documents. The tool records local execution metrics and operational telemetry into structured JSON log files without external transmission.

## Tags

### Development Tools & Productivity

- [SBOM Generators](https://awesome-repositories.com/f/development-tools-productivity/package-managers/dependency/sbom-generators.md) — Scans a folder of release files and project source paths to produce a standards-compliant manifest inventorying all build components and dependencies. ([source](https://github.com/microsoft/sbom-tool#readme))
- [Container Image Scanning](https://awesome-repositories.com/f/development-tools-productivity/package-managers/dependency/sbom-generators/container-image-scanning.md) — Inspects specified container images to extract and include their dependency packages in the generated software bill of materials. ([source](https://github.com/microsoft/sbom-tool/blob/main/docs/sbom-tool-cli-reference.md))
- [SBOM Validation Utilities](https://awesome-repositories.com/f/development-tools-productivity/package-managers/dependency/sbom-generators/sbom-validation-utilities.md) — Verifies software bill of materials manifests against industry specifications to ensure format correctness.
- [File Reference Redaction Utilities](https://awesome-repositories.com/f/development-tools-productivity/file-pattern-matching/contextual-file-references/file-reference-redaction-utilities.md) — Processes a manifest file to strip out individual file paths and references, outputting a cleaned copy into a separate directory. ([source](https://github.com/microsoft/sbom-tool#readme))

### Software Engineering & Architecture

- [Software Bill of Materials Generators](https://awesome-repositories.com/f/software-engineering-architecture/software-bill-of-materials-generators.md) — Scans source directories and container images to produce standards-compliant software bill of materials manifests.
- [Multi-Specification Schema Engines](https://awesome-repositories.com/f/software-engineering-architecture/specification-validation-schemas/multi-specification-schema-engines.md) — Parses and validates multiple standard inventory formats dynamically using schema definitions mapped directly to version architectures.
- [CI/CD Integrations](https://awesome-repositories.com/f/software-engineering-architecture/integration-extensibility/workflow-automation-integrations/ci-cd-integrations.md) — Integrating manifest generation and validation steps directly into continuous integration pipelines to automate security workflows.

### Content Management & Publishing

- [Manifest-Driven Aggregators](https://awesome-repositories.com/f/content-management-publishing/content-aggregation-curation/content-aggregators/manifest-driven-aggregators.md) — A utility that combines multiple software bill of materials files into a single unified manifest using configuration settings.
- [Manifest Merging Engines](https://awesome-repositories.com/f/content-management-publishing/content-aggregation-curation/content-aggregators/manifest-driven-aggregators/manifest-merging-engines.md) — Combines disparate component inventories into a single unified manifest file according to declarative configuration rules.
- [Multiple Manifest Aggregators](https://awesome-repositories.com/f/content-management-publishing/content-aggregation-curation/content-aggregators/manifest-driven-aggregators/multiple-manifest-aggregators.md) — Combines multiple software bill of materials files from different sources into a single unified manifest using a configuration file. ([source](https://github.com/microsoft/sbom-tool/blob/main/docs/sbom-tool-arguments.md))

### DevOps & Infrastructure

- [Compliance Validators](https://awesome-repositories.com/f/devops-infrastructure/asset-metadata-management/asset-metadata-indexers/package-manifests/manifest-validation/compliance-validators.md) — Inspects an existing software bill of materials file against industry specifications to verify its correctness and output validation results. ([source](https://github.com/microsoft/sbom-tool/blob/main/docs/sbom-tool-cli-reference.md))
- [Container Layer Extractors](https://awesome-repositories.com/f/devops-infrastructure/containerization/image-inspection/container-image-analyzers/container-layer-extractors.md) — Extracts container layers and internal package databases directly to inventory embedded components without local installation.
- [Integrity Checkers](https://awesome-repositories.com/f/devops-infrastructure/asset-metadata-management/asset-metadata-indexers/package-manifests/manifest-validation/integrity-checkers.md) — Inspects an existing manifest file against a target build directory to confirm structural and data integrity for specific manifest versions. ([source](https://github.com/microsoft/sbom-tool#readme))
- [CI Pipeline Integrations](https://awesome-repositories.com/f/devops-infrastructure/ci-cd-pipelines/ci-pipeline-integrations.md) — Integrates build and generation steps into continuous integration pipelines to produce inventory files automatically during builds. ([source](https://github.com/microsoft/sbom-tool/blob/main/docs/setting-up-github-actions.md))

### Security & Cryptography

- [SBOM Policy Evaluation](https://awesome-repositories.com/f/security-cryptography/governance-policy-frameworks/compliance-governance/security-and-compliance/compliance-policy-definitions/sbom-policy-evaluation.md) — Verifying existing software bill of materials files against industry specifications to confirm structural correctness and data integrity.
- [Cryptographic Hash Computations](https://awesome-repositories.com/f/security-cryptography/security/cryptography-and-secrets/cryptographic-primitives-management/cryptographic-hash-computations.md) — Computes and verifies file integrity using configurable cryptographic hash algorithms applied across scanned directory trees.
- [Inventory File Redactions](https://awesome-repositories.com/f/security-cryptography/sensitive-variable-redaction/document-content-redaction/inventory-file-redactions.md) — Strips sensitive file references from generated inventory documents to sanitize data before publishing. ([source](https://github.com/microsoft/sbom-tool/blob/main/README.md))
- [Path Redaction Filters](https://awesome-repositories.com/f/security-cryptography/sensitive-variable-redaction/document-content-redaction/path-redaction-filters.md) — Strips sensitive file paths and references from generated inventory documents to produce clean output copies.