Generate a software bill of materials (SBOM) as part of releasing a specific package or image, publish it alongside that release, and give consumers a way to verify its link to the artifact. A screenshot may help explain a report, but it cannot substitute for a machine-readable component inventory or demonstrate which exact release it describes.
What is an SBOM?
An SBOM is a formal, machine-readable inventory of software components and related information. CISA describes it as an “ingredients list” for software in its July 29, 2026 announcement. Depending on its purpose and generation method, it can record component names, versions, identifiers, relationships, and other details useful to people and tools that inspect software supply chains.
An SBOM is useful only when its scope is clear. A list of source dependencies, a record produced during a build, and an analysis of a finished package can describe different things. CISA’s 2025 Minimum Elements guidance distinguishes pre-build/source, build-time, and analyzed/post-build SBOMs. For a release, state which approach produced the document and ensure the component boundary matches the package or image consumers receive.
How do I generate an SBOM in CI/CD?
Make SBOM creation a repeatable pipeline step, not a manual report exported after the fact. Start by defining the release artifact: for example, a particular JAR, container image, installer, or other package. Then choose a generator and generation point that can describe that boundary accurately.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Identify the artifact and version. Use the same package or image that will be published to customers. Decide whether the SBOM should describe source inputs, components that contributed during the build, or an analysis of the finished artifact.
- Generate the SBOM in the release workflow. Run the appropriate generator as part of the build or release pipeline, and save the machine-readable output as a versioned file. If the release contains multiple independently consumable artifacts, determine whether each needs its own SBOM.
- Check scope and contents. Confirm the SBOM describes the intended package and version, rather than a broader repository or an aggregate of projects that did not contribute to the distribution. Check for component identifiers and versions, relationships, and the fields required by your consumers.
- Record generation context. Include enough information to tell what produced the SBOM and when, and whether it represents source, build-time, or post-build analysis. CISA’s 2026 guidance highlights component hash, license, SBOM tool name, and generation context among refined baseline data fields.
- Bind it to the release and publish both. Create a verifiable association between the SBOM and the exact artifact, then publish the SBOM in the same release channel or alongside the artifact.
- Document consumer verification. Provide the commands or UI steps needed to check the artifact’s identity and the SBOM’s association with it.
SPDX and CycloneDX are both relevant formats, but do not select one solely by name. Compare the fields your organization requires, how the format represents the inventory and relationships you need, and whether downstream consumers can parse the chosen serialization. The OWASP CycloneDX guide describes CycloneDX as a general-purpose BOM format that can represent software, hardware, services, and other inventory. An SPDX field-mapping page illustrates fields such as creator, supplier, package name and version, identifiers, relationships, and timestamp; that page is a development-version specification annex, not evidence that this exact revision is a final normative release.
How do I attach an SBOM to a release?
Publish a versioned SBOM file with the release, and make its relationship to the released artifact checkable. A filename alone is not a strong link: a file called sbom.json could be replaced or paired with the wrong binary without a consumer being able to tell.
The CycloneDX Gradle plugin README demonstrates one project-specific pattern: build a JAR and its direct SBOM, attest build provenance for the JAR, attest the CycloneDX SBOM for that same JAR, and publish the versioned SBOM as a GitHub Release asset. The example is not a universal workflow for every language or hosting platform. Its useful principle is to bind the SBOM and artifact through explicit, verifiable release metadata rather than relying on proximity or a screenshot.
When choosing a release mechanism, check that it preserves the association and integrity information consumers need. That could mean a signed or attested SBOM tied to an artifact digest, depending on the platform and workflow. Keep the artifact, SBOM, and verification instructions available through a consistent release channel.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How can I verify an SBOM?
Verification has two separate questions: is this the expected SBOM, and does it describe the artifact being distributed? Consumers should be able to check the release identity and validate the SBOM’s association with the artifact using the instructions your release provides.
- Match the artifact’s version or digest to the release you intend to use.
- Check the SBOM’s integrity and any signature or attestation against the published verification instructions.
- Inspect the SBOM’s package identity, component versions, and relationships to see whether its stated scope fits the released artifact.
- Check the recorded generation context and tool identity so you understand what the inventory represents.
The CycloneDX Gradle plugin README provides example commands for checking both provenance and an SBOM attestation. NIST’s DevSecOps functional demonstrations also show selected integrations in which pipelines produce downloadable JSON or XML SBOMs, including SPDX or CycloneDX outputs, and document signing, logs, or release-associated evidence. These are demonstrations of particular integrations, not a guarantee that every pipeline performs the same checks; NIST notes that SLSA attestations were deferred in some demonstration tracks.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does an SBOM prove how software was built?
No. An SBOM describes components and related information within a stated scope; by itself, it does not prove the build process, the identity of the builder, or that the published artifact came from a particular source revision. A provenance attestation is a separate claim about the build and its relationship to the artifact.
The CycloneDX Gradle example makes this distinction explicit by producing separate provenance and SBOM attestations for the release JAR. It also cautions that using the plugin alone does not establish a SLSA Build level. Treat an SBOM as one useful release record, not as proof of every security or process claim about the software.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteBest Value
What should a release SBOM workflow get right?
- Scope: The SBOM describes the package or image users actually receive.
- Context: It says whether it was produced from source inputs, during the build, or by analyzing the finished artifact.
- Useful fields: It captures relevant identifiers, versions, relationships, and the required baseline information, such as hashes, licenses, tool name, and generation context where applicable.
- Compatibility: Its format and serialization work for the teams and tools that will consume it.
- Verifiable linkage: Consumers can check the SBOM’s integrity and its association with the artifact.
- Repeatability: The pipeline produces and publishes the SBOM for each relevant release, with verification instructions.
CISA’s July 2026 guidance announcement says its guidance applies to all software while noting that AI and SaaS may need additional elements. Choose fields and generation methods for the software and release boundary at hand; the sources do not mandate one format, generator, or hosting platform for every project.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
