CycloneDX on OpenChain KWG

cdxgen

Mon, 01 Jan 0001 00:00:00 +0000

cdxgen is an open source SBOM generation tool managed by OWASP (Open Web Application Security Project). It analyzes source code, build artifacts, and container images to automatically generate SBOMs in CycloneDX format.

GitHub: https://github.com/CycloneDX/cdxgen
License: Apache-2.0

Features

Wide language and ecosystem support: Java (Maven/Gradle), Node.js, Python, Go, Rust, PHP, Ruby, .NET, and 20+ more
Multiple scan targets: Source code directories, container images, GitHub repositories
CycloneDX standard output: Supports CycloneDX 1.4/1.5/1.6 in JSON and XML formats
REPL mode: Interactive interface for exploring and querying SBOMs
CI/CD integration: Easy integration with GitHub Actions, GitLab CI, and other major pipelines

Installation

Install with Node.js 18 or later:

Syft

Mon, 01 Jan 0001 00:00:00 +0000

Syft is an open source SBOM generation CLI tool developed by Anchore. It scans container images, filesystems, and archives to identify included packages and generates SBOMs in SPDX or CycloneDX format.

GitHub: https://github.com/anchore/syft
License: Apache-2.0

Features

Multiple scan targets: Container images (Docker, OCI), local filesystems, tar archives
Wide ecosystem support: Alpine (apk), Debian/Ubuntu (dpkg), RPM, Python, Java, Go, Node.js, Ruby, Rust, and more
Standard output formats: SPDX 2.2/2.3 (JSON, tag-value), CycloneDX 1.4/1.5 (JSON, XML), Syft JSON
Grype integration: Pairs naturally with Anchore’s Grype vulnerability scanner for SBOM-based vulnerability analysis
Easy installation: Single binary distribution, no additional runtime required

Installation

Script Installation (Linux/macOS)

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

Homebrew (macOS)

brew install syft

Docker

docker pull anchore/syft

Basic Usage

(1) Scan a Container Image

# Scan a Docker image and output SPDX JSON
syft ubuntu:22.04 -o spdx-json=sbom.spdx.json

# Output as CycloneDX JSON
syft ubuntu:22.04 -o cyclonedx-json=sbom.cdx.json

(2) Scan a Local Directory

syft dir:/path/to/project -o spdx-json=sbom.spdx.json

(3) View Results in Terminal

# Print package list to terminal
syft ubuntu:22.04

# Output as JSON to stdout
syft ubuntu:22.04 -o json

(4) Vulnerability Scanning with Grype

# Generate SBOM with Syft and analyze vulnerabilities with Grype
syft ubuntu:22.04 -o json | grype

CI/CD Integration Example

# GitHub Actions example
- name: Generate SBOM with Syft
 uses: anchore/sbom-action@v0
 with:
 image: myapp:latest
 format: spdx-json
 output-file: sbom.spdx.json
- name: Upload SBOM
 uses: actions/upload-artifact@v4
 with:
 name: sbom
 path: sbom.spdx.json

References

Syft GitHub: https://github.com/anchore/syft
Grype (vulnerability scanner): https://github.com/anchore/grype
SPDX Standard: https://spdx.dev/
CycloneDX Standard: https://cyclonedx.org/

Dependency-Track

Mon, 01 Jan 0001 00:00:00 +0000

Dependency-Track is an open source SBOM management and vulnerability analysis platform managed by OWASP. It continuously monitors component-level vulnerabilities based on uploaded SBOMs (CycloneDX, SPDX) and automatically evaluates policy violations.

GitHub: https://github.com/DependencyTrack/dependency-track
Official docs: https://docs.dependencytrack.org/
License: Apache-2.0

Features

SBOM-based continuous monitoring: Automatically tracks the latest vulnerabilities per component after uploading SBOMs in SPDX or CycloneDX format
Multiple vulnerability data sources: NVD, OSV, GitHub Advisories, VulnDB, and more
Policy engine: Define rules for license policies, vulnerability severity thresholds, and component allowlists for automatic evaluation
REST API: Integrate with CI/CD pipelines to automatically upload SBOMs and receive feedback at build time
Web UI dashboard: View per-project risk scores, vulnerability status, and license distribution at a glance
Notifications: Send new vulnerability alerts via Slack, email, Webhook, and other channels

Installation

Using Docker Compose is the simplest approach:

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Sun, 09 Aug 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

On July 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and 17 other agencies published a revised set of minimum elements for a Software Bill of Materials (SBOM)A2. The document states plainly that it replaces, rather than amends, the baseline established in 2021 by the National Telecommunications and Information Administration (NTIA).