A 'Software Bill of Materials' (SBOM) is a standardized document describing the dependencies of an artifact.

Platform-agnostic tooling can use these to report on interesting properties of the dependency tree, such as license checking or cross-referencing against security advisory databases. As such, for our purposes, an SBOM would typically be restricted to run-time and embedded dependencies (and not include build-time requirements).

There are various SBOM file formats, such as CycloneDX and SPDX.

We encourage projects to publish SBOMs with their releases, and indeed a fair number of ASF projects already do.

Producing SBOMs

Maven

Maven projects users can use the https://github.com/CycloneDX/cyclonedx-maven-plugin and https://github.com/spdx/spdx-maven-plugin (already part of the Apache Commons parent pom). These plugins can take care of both generating the SBOM and publishing it alongside the artifact to the Maven Repository.

These plugins do have known limitations:

Gradle

Gradle projects can use https://github.com/CycloneDX/cyclonedx-gradle-plugin to create an SBOM. Publishing it requires some additional configuration. The plugin appears to generate 'one big' BOM for the whole project, rather than a BOM per artifact.

sbt

There exists an sbt-bom sbt plugin, but right now it only generates the SBOM, not publish it.

Ant

There is an CycloneDX Antlib managed by the Ant project that can create CycloneDX SBOMs. Right now it only supports manual configuration but support for Apache Ivy is planned.

Docker

If you're publishing a Docker image, you might want to consider generating an SBOM for the entire Docker image and publishing that to the Docker Registry by adding a linked resource.

Related technologies

Once you're comfortable publishing SBOMs, some project also use the SBOM-adjacent formats:

Using SBOMs

ASF Ecosystem Graph

We have a fun interactive graph of all artifacts in the ASF for which SBOMs have been published, and their relationships across projects.

DependencyTrack

The Security team has set up an experimental DependencyTrack instance at https://security-tools-ec2-va.apache.org/. If we upload SBOMs to this tool, you can use its interface to discover whether there are any current advisories for dependencies of your project. You should be able to log in with your apache.org id (but note this authentication method is experimental). Email engelen@apache.org if you would like further access.

DependencyTrack VEX support

DependencyTrack supports Vulnerability Exploitability Exchange (VEX) data both as input and as output format:

  • as input: allow suppressing warnings about advisories that have been verified to not affect the project
  • as output: allow 'manually' suppressing advisories through the Web UI and exporting that information

At Apache we prefer to use VEX as input to DependencyTrack rather than output: that gives us the opportunity to have the "source of truth" of the VEX information in version control, and use well-known tools to control access, history, reviewing etc.. This information can then be imported into DependencyTrack to make the reports more accurate.

For more information about VEX see "Dealing with security advisories for dependencies"

Projects publishing SBOMs

Many Maven projects, such as the active Apache Commons components, produce SBOMs in their latest releases. Most are not picking sides and are producing both CycloneDX and SPDX artifacts only because it is easy and both formats provide Maven plugins. The SBOMs are published as siblings of other artifacts like JAR files (in Maven Central) for each release. For example, Apache Commons Lang SBOMs are here.

Airflow publishes separate SBOMs for different supported Python versions.

You can browse these on our DependencyTrack instance mentioned above.

References

  • No labels