What a software bill of materials is, and what you can do with one
A software bill of materials (SBOM) lists every component a program ships: each library and file, its version, its licence and a hash of it. It lets you check a program against published vulnerabilities and licence rules without taking the maker’s word for what is inside.
15 October 2026 · 4 min read
A list of what is inside
Almost every program is built mostly from other people’s components: open-source libraries, a runtime, fonts, data files. An SBOM is the list of them, written by machine when the program is built, the way a food label lists ingredients. For each component it gives at least its name, its version and who supplies it, and usually its licence and a hash that identifies the exact file.
Two formats are common. CycloneDX comes from the OWASP security foundation; SPDX comes from the Linux Foundation and is an ISO standard. Both are plain JSON or XML that tools read, and converters go between them.
Why they have become common
When a serious flaw is found in a widely used library, the first question for anybody running software is whether they have it. Without a list, answering means asking every supplier. With one, it is a search.
Governments have made that expectation formal. The United States began asking for SBOMs from suppliers of software to federal agencies in 2021, and the European Union’s Cyber Resilience Act requires makers of software sold in the EU to keep one as part of their technical documentation.
What you can do with one
- Check for known vulnerabilities. Free tools read an SBOM and match it against public vulnerability databases. Grype (
grype sbom:./sbom.json) does it from the command line, and OWASP Dependency-Track keeps watching a collection of them and alerts you when a new flaw matches. - Check licences. An organisation with rules about which licences it accepts can read them straight off the list.
- Compare two releases, to see exactly what an update added, removed or changed.
- Check the files. The hashes let you confirm that what you installed is what the list describes.
What it does not tell you
An SBOM says what a program is made of, not whether it is safe. A component with no published vulnerability may still have one, and a listed vulnerability may not be reachable in the way the program uses it. And a list is only as good as the build it came from: an SBOM generated from the same build as the installer, ideally one anybody can reproduce, is worth more than one written by hand.
Our own product, disclosed
Where our own software comes into this
We make Rutba Office, a free and open-source desktop suite for Windows. Since version 2.1 each release on GitHub carries a CycloneDX SBOM beside its installers, listing everything they ship, from the Electron runtime to every package and file, with its licence and hash. The source is public under the AGPL, and the project documents how a build is reproduced.
Related
What “Uninstaller error 2” means when a program updates, and how to get past it
The new version’s installer tried to remove the old version’s files and could not, almost always because the program, or a part of it, was still running. Close it completely, end anything left of it in Task Manager, and run the installer again; a restart clears what is left.
Free alternatives to Microsoft Office, honestly compared
There are four serious ones and they are good at different things. The right answer depends almost entirely on who receives your files and whether you need to work offline.
What is actually inside a .docx file
Rename it to .zip and look. Understanding the parts explains almost everything about why documents behave the way they do between programs, and lets you fix a corrupt file by hand.
Ten apps, one free download
No account, no telemetry, and it works with the network switched off.