Kubernetes BOM (bom) review
An open-source CLI for generating and working with SPDX SBOMs across varied inputs.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Kubernetes BOM, commonly called bom, is an open-source command-line utility and Go library for creating and working with software bills of materials. It suits teams that need SPDX SBOMs from source directories, individual files, archives, or container images, including workflows that inspect Go dependencies or image contents. Its scope spans generation and follow-on analysis rather than stopping at an exported document, making it relevant to software teams maintaining build or delivery processes.
The documented CLI writes SPDX 2.3 in JSON or tag-value formats; SPDX 3 JSON-LD output is experimental. Scanning can collect package, dependency, and license information, including operating-system packages and image layers in container images. License classification uses the SPDX license catalog. After generation, users can query SBOM contents with filters such as depth, name, or package URL, render structure and relationship graphs, and validate files against checksums recorded in an SBOM. These functions make bom useful when the task includes examining or checking an inventory, not only producing one.
The CLI can export SBOM data as an in-toto provenance statement for CI/CD use, and the product is self-hosted. The documented CLI formats are SPDX variants rather than CycloneDX; while the Go library's protobom documents can be serialized to CycloneDX, that is not documented as CLI generation output. Choose bom when an open-source CLI, broad file and image inputs, SPDX output, and inventory queries or validation fit the workflow. Teams requiring documented CycloneDX generation directly from a CLI should consider another tool.
Kubernetes BOM (bom) pros and cons
- Where it wins
- Scans directories, files, archives, and container images
- Queries, visualizes, and validates SBOM contents
- Exports SPDX documents and in-toto provenance data
- Where it doesn't
- Documented CLI output centers on SPDX, not CycloneDX
- SPDX 3 JSON-LD output is experimental
- Self-hosted CLI use requires a local workflow
Kubernetes BOM (bom) fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update