sbomify

sbomify is a security artifact management platform focused on the creation, storage, management, and sharing of Software Bills of Materials (SBOMs) and related compliance artifacts.

Core function:

• Generates SBOMs directly within CI/CD pipelines via an open source action
• Stores and manages SBOMs, VEX documents, CBOMs (Cryptography BOMs), and other compliance artifacts
• Supports both CycloneDX and SPDX SBOM formats

SBOM Lifecycle Management:

• Automates SBOM generation through CI/CD pipeline integration
• Manages release hierarchies, including complex component relationships
• Distributes SBOMs to stakeholders publicly or privately
• Eliminates manual SBOM distribution and version tracking

Trust Center:

• Provides a hosted portal (optionally on a custom domain) for sharing security artifacts with stakeholders
• Supports web portal access, standardized SBOM formats, and the Transparency Exchange API (TEA) for automated consumption
• Allows sharing of SBOMs, VEX, CBOMs, SOC 2 reports, pentest summaries, and other compliance documents
• Reduces security questionnaire response times by providing a self-service artifact hub

Analysis and Enrichment:

• Integrates with vulnerability analysis tools (Google OSV, Dependency Track) and enrichment platforms (Ecosyste.ms)
• Scan results are VEX-aware, suppressing noise from not-affected decisions in OSV and Dependency Track findings
• Inventories cryptographic assets as CBOMs with a post-quantum readiness view

Compliance Coverage:

• Addresses EU Cyber Resilience Act (CRA) requirements
• Supports US Executive Order 14028 (federal SBOM adoption) and EO 14144 (post-quantum cryptography)

Deployment:

• Available as a managed cloud service or self-hosted via open source on GitHub
• No vendor lock-in