SBOM Management

Comprehensive guidance for Software Bill of Materials creation, maintenance, and supply chain security.

When to Use This Skill

• Creating SBOMs for software releases
• Responding to customer SBOM requests
• Tracking software components and dependencies
• Implementing supply chain security
• Meeting regulatory requirements (Executive Order 14028, EU CRA)

SBOM Fundamentals

What is an SBOM?

A Software Bill of Materials is a formal, machine-readable inventory of software components and dependencies, their relationships, and associated metadata.

Your Application
├── Dependency A (v1.2.3) → Transitive Dep X
├── Dependency B (v2.0.0) → Transitive Dep Y, Z
├── Dependency C (v3.1.0)
└── Direct code components

NTIA Minimum Elements

Required elements per NTIA SBOM guidelines:

Element	Description	Example
Supplier Name	Entity that creates/maintains	"Microsoft"
Component Name	Designation of component	"System.Text.Json"
Version	Version identifier	"8.0.0"
Other Unique Identifiers	Additional IDs	PURL, CPE
Dependency Relationship	Upstream/downstream	"depends-on"
Author of SBOM Data	Who created SBOM	"Contoso Inc"
Timestamp	When SBOM created	"2025-01-15T10:30:00Z"

SBOM Formats

Format	Strengths	Use Case
CycloneDX	Security-focused, VEX support	Vulnerability management
SPDX	License-focused, ISO standard	License compliance
SWID	Software identification	Asset management

CycloneDX (Recommended)

Basic Structure

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "metadata": {
    "timestamp": "2025-01-15T10:30:00Z",
    "tools": [
      {
        "vendor": "CycloneDX",
        "name": "cyclonedx-dotnet",
        "version": "3.0.0"
      }
    ],
    "component": {
      "type": "application",
      "name": "MyApplication",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:nuget/Newtonsoft.Json@13.0.3",
      "name": "Newtonsoft.Json",
      "version": "13.0.3",
      "purl": "pkg:nuget/Newtonsoft.Json@13.0.3",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "a5c9a4e..."
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:nuget/MyApplication@1.0.0",
      "dependsOn": [
        "pkg:nuget/Newtonsoft.Json@13.0.3"
      ]
    }
  ]
}

Component Types

application    - Standalone application
framework      - Software framework
library        - Software library
container      - Container image
operating-system
device         - Hardware device
firmware       - Device firmware
file           - Arbitrary file
machine-learning-model
data           - Data assets

.NET SBOM Generation

Using CycloneDX Tool

# Install the tool
dotnet tool install --global CycloneDX

# Generate SBOM for solution
dotnet CycloneDX MyApp.sln -o sbom.json -j

# Include dev dependencies
dotnet CycloneDX MyApp.sln -o sbom.json -j --include-dev

# Recursive for all projects
dotnet CycloneDX . -o sbom.json -j -r

Integration with Build

<!-- Add to Directory.Build.props -->
<PropertyGroup>
  <GenerateSBOM>true</GenerateSBOM>
  <SBOMFormat>CycloneDX</SBOMFormat>
</PropertyGroup>

<!-- MSBuild target -->
<Target Name="GenerateSBOM" AfterTargets="Build" Condition="'$(GenerateSBOM)'=='true'">
  <Exec Command="dotnet CycloneDX $(MSBuildProjectFullPath) -o $(OutputPath)sbom.json -j" />
</Target>

Programmatic Generation

using CycloneDX.Models;

public class SbomGenerator
{
    public Bom GenerateSbom(Project project, IEnumerable<PackageReference> packages)
    {
        var bom = new Bom
        {
            Version = 1,
            SerialNumber = $"urn:uuid:{Guid.NewGuid()}",
            Metadata = new Metadata
            {
                Timestamp = DateTime.UtcNow,
                Component = new Component
                {
                    Type = Component.Classification.Application,
                    Name = project.Name,
                    Version = project.Version
                }
            },
            Components = new List<Component>()
        };

        foreach (var pkg in packages)
        {
            bom.Components.Add(new Component
            {
                Type = Component.Classification.Library,
                BomRef = $"pkg:nuget/{pkg.Id}@{pkg.Version}",
                Name = pkg.Id,
                Version = pkg.Version,
                Purl = $"pkg:nuget/{pkg.Id}@{pkg.Version}",
                Licenses = pkg.Licenses?.Select(l => new LicenseChoice
                {
                    License = new License { Id = l }
                }).ToList()
            });
        }

        return bom;
    }
}

Vulnerability Management

VEX (Vulnerability Exploitability eXchange)

VEX documents state whether vulnerabilities apply to your product:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "vulnerabilities": [
    {
      "id": "CVE-2023-12345",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-12345"
      },
      "ratings": [
        {
          "severity": "high",
          "score": 7.5,
          "method": "CVSSv3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "detail": "Vulnerable code path not used in our implementation"
      },
      "affects": [
        {
          "ref": "pkg:nuget/SomePackage@1.0.0"
        }
      ]
    }
  ]
}

VEX States

State	Meaning
exploitable	Vulnerability is exploitable
in_triage	Currently investigating
not_affected	Not vulnerable
resolved	Fixed in current version

Vulnerability Tracking Service

public class VulnerabilityTracker
{
    private readonly IVulnerabilityDatabase _vulnDb;
    private readonly ISbomRepository _sbomRepo;

    public async Task<VulnerabilityReport> ScanSbom(
        string sbomPath,
        CancellationToken ct)
    {
        var sbom = await _sbomRepo.Load(sbomPath, ct);
        var report = new VulnerabilityReport
        {
            SbomSerialNumber = sbom.SerialNumber,
            ScanTimestamp = DateTimeOffset.UtcNow
        };

        foreach (var component in sbom.Components)
        {
            var vulns = await _vulnDb.GetVulnerabilities(
                component.Purl,
                ct);

            foreach (var vuln in vulns)
            {
                report.Vulnerabilities.Add(new VulnerabilityFinding
                {
                    ComponentRef = component.BomRef,
                    ComponentName = component.Name,
                    ComponentVersion = component.Version,
                    CveId = vuln.Id,
                    Severity = vuln.Severity,
                    CvssScore = vuln.CvssScore,
                    Description = vuln.Description,
                    FixedInVersion = vuln.FixedInVersion,
                    VexStatus = DetermineVexStatus(component, vuln)
                });
            }
        }

        return report;
    }

    private VexStatus DetermineVexStatus(Component component, Vulnerability vuln)
    {
        // Check if we have an existing VEX determination
        // Otherwise mark as in_triage
        return VexStatus.InTriage;
    }
}

Supply Chain Security

SLSA (Supply-chain Levels for Software Artifacts)

Level	Requirements
SLSA 1	Build process documented, provenance generated
SLSA 2	Version control, hosted build service
SLSA 3	Hardened builds, provenance verified
SLSA 4	Two-person review, hermetic builds

Package Verification

public class PackageIntegrityVerifier
{
    public async Task<VerificationResult> VerifyPackage(
        PackageReference package,
        CancellationToken ct)
    {
        var result = new VerificationResult { Package = package };

        // Check package signature
        var signature = await GetPackageSignature(package, ct);
        if (signature != null)
        {
            result.IsSigned = true;
            result.SignatureValid = await VerifySignature(signature, ct);
            result.SignerCertificate = signature.Certificate;
        }

        // Verify hash against known-good sources
        var packageHash = await ComputePackageHash(package, ct);
        var expectedHash = await GetExpectedHash(package, ct);
        result.HashMatch = packageHash == expectedHash;

        // Check for known vulnerabilities
        result.Vulnerabilities = await ScanForVulnerabilities(package, ct);

        // Check package age and maintenance status
        result.LastUpdated = await GetLastUpdateDate(package, ct);
        result.IsDeprecated = await CheckDeprecationStatus(package, ct);

        return result;
    }
}

Dependency Pinning

<!-- Enable package lock file for reproducible builds -->
<PropertyGroup>
  <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
  <RestoreLockedMode Condition="'$(CI)' == 'true'">true</RestoreLockedMode>
</PropertyGroup>

CI/CD Integration

GitHub Actions SBOM Generation

name: Generate SBOM

on:
  release:
    types: [published]

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Install CycloneDX
        run: dotnet tool install --global CycloneDX

      - name: Generate SBOM
        run: |
          dotnet CycloneDX MySolution.sln \
            -o sbom.json \
            -j \
            --set-version ${{ github.event.release.tag_name }}

      - name: Sign SBOM
        run: |
          # Sign with cosign or similar
          cosign sign-blob --key ${{ secrets.SIGNING_KEY }} sbom.json

      - name: Upload SBOM to Release
        uses: actions/upload-release-asset@v1
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: ./sbom.json
          asset_name: sbom.json
          asset_content_type: application/json

      - name: Scan for vulnerabilities
        run: |
          grype sbom:sbom.json --fail-on high

SBOM Attestation

      - name: Generate SBOM Attestation
        uses: actions/attest-sbom@v1
        with:
          subject-path: './bin/MyApp.dll'
          sbom-path: './sbom.json'

SBOM Distribution

Where to Publish

Channel	Format	Audience
Release assets	JSON/XML	Developers, security teams
API endpoint	JSON	Automated systems
Documentation	Human-readable	Auditors, customers
Container labels	Reference	Container runtime

Container Integration

# Include SBOM in container
LABEL org.opencontainers.image.sbom="sbom.json"
COPY sbom.json /app/sbom.json

# Or generate at build time
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
RUN dotnet tool install --global CycloneDX
RUN dotnet CycloneDX /src/MyApp.csproj -o /app/sbom.json -j

Regulatory Requirements

Executive Order 14028 (US)

Requirements for software sold to US government:

• SBOM required for all software
• Must include all components
• Machine-readable format (SPDX, CycloneDX)
• VEX for vulnerability status
• Regular updates

EU Cyber Resilience Act

Upcoming requirements:

• SBOM for all products with digital elements
• Vulnerability handling procedures
• Security updates for product lifetime
• Reporting of actively exploited vulnerabilities

SBOM Checklist

Generation

• All direct dependencies included
• Transitive dependencies resolved
• Versions accurately recorded
• Licenses identified
• Hashes computed
• PURLs generated

Quality

• NTIA minimum elements present
• Machine-readable format
• Valid against schema
• Accurate dependency graph
• Matches actual deployed software

Distribution

• Included in release artifacts
• Available via API (if applicable)
• Signed/attested
• VEX document available
• Customer access method documented

Cross-References

• License Compliance: license-compliance for license obligations
• Security: security-frameworks for supply chain security
• AI Governance: ai-governance for ML model SBOMs

Resources

• NTIA SBOM Documents
• CycloneDX Specification
• SPDX Specification
• CISA SBOM Resources