top of page

Solving Software Supply Chain Transparency

Open Source tooling for generating, notarizing, linking and validating Software Bills of Materials (SBOM)

What is an SBOM?

What is an SBOM?

A complete, formally structured list of components, libraries, and modules that are required to build a given piece of software and the supply chain relationships between them. Source: NTIA

​

There are machine-readable, standard formats for SBOMs, like SPDX and CycloneDX. However, an SBOM could be just a spreadsheet or a text document.

​

The supply chain relationships between SBOMs were, up until now, missing. The SBOM ledger leverages software and metadata integrity and authenticity, allowing users to verify that the source of the SBOM data was not tampered with.

Generate your SBOM now

Using our public API you can generate your own SBOM for free, safely and anonymously. Just download a CLI or the Audit Workbench (                          ) and compare your code against the millions of OSS components in our knowledgebase to identify even small snippets.

Download the SBOM Workbench for Windows
Download the SBOM Workbench for Apple Silicon Macs
Download the SBOM Workbench for Intel Macs
Download the SBOM Workbench for Linux
Download the SBOM Workbench source code from GitHub

Repository

URLs indexed

github.com

79,046,284

npmjs.org

43,524,408

stackoverflow.com

28,793,907

maven.org

28,602,701

debian.org

15,760,517

fedoraproject.org

12,582,055

pythonhosted.org

12,530,176

nuget.org

9,253,049

rpmfind.net

9,070,167

googlesource.com

2,128,202

sourceforge.net

2,067,844

bitbucket.org

1,904,885

rubygems.org

1,559,774

gnome.org

1,450,902

gitee.com

970,497

gitlab.com

694,990

java2s.com

499,518

spring.io

419,554

drupal.org

348,719

codeplex.com

288,341

apache.org

178,032

cpan.org

158,119

eclipse.org

89,015

opensuse.org

80,581

kernel.org

78,724

launchpad.net

71,183

nasm.us

33,858

gnu.org

33,353

angularjs.org

27,721

videolan.org

21,102

nodejs.org

11,859

unity.com

10,069

centos.org

9,666

apple.com

7,499

rpmfusion.org

7,029

invent.kde.org

6,980

isc.org

6,106

nmap.org

1,975

postgresql

1,405

mozilla.org

1,021

jquery.com

473

netfilter.org

286

vcgit.hhi.fraunhofer.de

148

gitlab.freedesktop.org

133

sudo.ws

98

slf4j.org

88

zlib.net

71

script.aculo.us

30

java.sun.com

9

maven.google.com

8

INTRODUCING

The decentralized SBOM Ledger

Blockchain technologies provide a foundation to meet the technical and ethical challenges of establishing trust and information perpetuity. However, access to Blockchain technologies is difficult for corporations since they involve the use of cryptocurrencies.

​

The Software Transparency Foundation aims at creating the first decentralized SBOM ledger which connects and validates SBOMs regardless of their format. SPDX, CycloneDX and even Excel or CSV files can be interconnected and validating, enabling traceability across the supply chain tree.

Abstraction layer for Blockchain registration

Software Transparency Foundation proposes to solve the issue of Blockchain transaction fees, by providing a set of Open Source tools that allow registration of SBOM metadata, validation of declared software integrity, and traceability of preceding SBOMs.

License Compliance and Cybersecurity

President Biden’s “Executive Order on Improving the Nation’s Cybersecurity” (May 12, 2021) adds momentum to the SBOM movement by specifically requiring “providing a purchaser a Software Bill of Materials (SBOM) for each product directly or by publishing it on a public website”.

​

Perhaps the biggest single challenge to supply-chain transparency and the SBOM model is the abundance of open ‘standards’ intended to reduce redundant work in the supply-chain by providing common processes and formats for organizations and communities to share important data, thereby streamlining and improving compliance, security, and dependability.

​

With the proposal of the decentralized SBOM Ledger, we propose to bridge this gap by enabling format-agnostic SBOM connectivity.

The first Open Source SBOM ledger

Group 325.png

Generate SBOM

Open Source tooling to generate a standardized Software Bill of Materials

Group 319.png

Notarize SBOM

Tooling to notarize your Software Bill of Materials for external distribution

Group 324.png

Relate SBOM

Open Source tooling to generate a standardized Software Bill of Materials

Group 323.png

Validate SBOM

Open Source tooling to generate a standardized Software Bill of Materials

bottom of page