# Software Bill Of Materials

> Use when managing software bill of materials.

- Skill: `loopyluci/software-bill-of-materials` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/software-bill-of-materials`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/software-bill-of-materials/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/software-bill-of-materials

---


# Software Bill of Materials

Managing software bill of materials (SBOM) — from SBOM generation (SPDX, CycloneDX) through dependency tracking, vulnerability correlation, and supply chain security.

## When to Use

- Tracking third-party dependencies in software
- Complying with executive order on software supply chain security
- Vulnerability correlation (SBOM + CVE database)
- Supply chain risk assessment
- Building software supply chain transparency

## SBOM Generation

```python
SBOM_FORMATS = {
    'spdx': 'Software Package Data Exchange — ISO standard, broad adoption',
    'cyclonedx': 'OWASP standard — security-focused, vulnerability support',
    'swid': 'ISO/IEC 19770-2 — software identification tag',
}

def generate_sbom_python(requirements_path: str) -> Dict:
    """Generate SBOM from Python dependencies."""
    import pkg_resources, hashlib, json
    sbom = {
        '$schema': 'http://cyclonedx.org/schema/bom-1.5.schema.json',
        'bomFormat': 'CycloneDX', 'specVersion': '1.5',
        'components': [],
        'dependencies': [],
    }
    
    with open(requirements_path) as f:
        for line in f:
            pkg_name = line.strip().split('=')[0].split('>')[0].split('<')[0]
            if pkg_name:
                try:
                    pkg = pkg_resources.get_distribution(pkg_name)
                    sbom['components'].append({
                        'type': 'library', 'name': pkg.key,
                        'version': pkg.version, 'purl': f'pkg:pypi/{pkg.key}@{pkg.version}',
                    })
                except: pass
    return sbom
```

## Verification Checklist

- [ ] SBOM format chosen (SPDX or CycloneDX)
- [ ] SBOM generation automated in CI/CD pipeline
- [ ] All direct and transitive dependencies included
- [ ] SBOM validated against schema
- [ ] Vulnerability correlation (SBOM + CVE database)
- [ ] SBOM signed for integrity
- [ ] SBOM stored and versioned alongside releases
- [ ] Customer access to SBOM on request