Generating SBOMs

Overview

FOSSA can generate a Software Bill of Materials (SBOM) for any analyzed project or release group. Generated SBOMs serve several purposes:

• Security vulnerability reviews with embedded VDR (Vulnerability Disclosure Report) and VEX (Vulnerability Exploitability eXchange) statements
• Customer-facing bills of materials for sales enablement, partnerships, and OEM agreements
• Fully-compliant attribution and copyright notices
• End-of-life and end-of-support communication
• Regulatory compliance for software supply chain mandates, including US EO 14028, the EU Cyber Resilience Act (CRA), FDA premarket cybersecurity requirements for medical devices, the EU Digital Operational Resilience Act (DORA), India's SEBI CSCRF, and PCI DSS

Supported formats

Generating via the CLI

The FOSSA CLI generates SPDX attribution reports directly from your terminal, which is useful for automating report generation in CI pipelines.

1. 1

   Analyze your project

   Run fossa analyze from your project root:

   ShellCopy

   export FOSSA_API_KEY=<your_api_key>fossa analyze

2. 2

   Generate the SBOM

   Run the report command with your desired format:

   ShellCopy

   fossa report attribution --format spdx

   Supported --format values: spdx, json, markdown, text.

Generating via the UI

Navigate to your project or release group page and go to Reports > SBOM. Choose a Standard flow for FOSSA's recommended settings, or a Custom flow to control the content options below.

Expand

Selecting a format

Choose one of the four supported formats. Your selection determines which content options are available.

Expand

Content options

Configure which information to include in the SBOM. Options are split into two groups.

Per-package metadata

These control what data is included for each dependency in the SBOM:

Report sections

These control which dependency groups and additional sections appear in the SBOM:

Embedding VDR and VEX statements

Selecting Open Vulnerabilities or Closed Vulnerabilities on a CycloneDX format adds a vulnerabilities array to the output containing VDR and VEX statements for each security issue.

Open Vulnerabilities; active issues are embedded with their CVE metadata (VDR) and a VEX analysis with state: affected.

Closed Vulnerabilities; ignored issues are embedded with their CVE metadata (VDR) and a VEX analysis reflecting the resolution. The state and optional justification are derived from the FOSSA ignore reason at the time of export:

VEX justifications align with CISA VEX status justifications. Reasons without a justification value (Fixed, Under investigation, Incorrect data found, Other) produce the appropriate VEX state but no justification field.

Example VEX output

An active vulnerability:

{  "bom-ref": "CVE-2023-39956",  "id": "CVE-2023-39956",  "source": { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39956", "name": "NVD" },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",      "method": "CVSSv31"    }  ],  "affects": [    { "ref": "pkg:npm/electron@11.1.1" }  ],  "analysis": {    "state": "affected"  }}

An ignored vulnerability with a VEX justification:

{  "bom-ref": "CVE-2023-39956",  "id": "CVE-2023-39956",  "analysis": {    "state": "not_affected",    "justification": "inline_mitigations_already_exist",    "detail": "CVE not exploitable due to inline mitigation in the form of external input validation preventing injection"  }}

Downloading or emailing your SBOM

Click Download to generate and download the SBOM immediately. For large projects, click Email to trigger an asynchronous generation job; the completed SBOM will be delivered to your email address.

What's next

• Importing SBOMs: Bring existing bills of materials into FOSSA to run compliance checks against their components.
• Sharing SBOMs: Publish and distribute your generated SBOMs to customers or partners.
• Licensing Reports: Generate attribution notices and compliance documentation alongside your SBOMs.