ossbomer
Checks an SBOM three ways in one pass: is the file valid, does it satisfy a regulation, and do its licenses fit your use case.
Get started Profiles CLI reference GitHub
What it does
Most SBOM tools answer one question. ossbomer answers three at once, for both SPDX and CycloneDX:
- Schema. Is the document structurally valid, judged against the spec version it actually declares?
- Conformance. Does it carry the fields a given regulation or program asks for, at the severity that regulation assigns them?
- License policy. Given how you ship this software, does policy allow the licenses the SBOM declares?
You pick a profile. A profile is one YAML file that binds all three, so “does this SBOM meet the EU CRA” is a single argument rather than three tool runs and a spreadsheet.
ossbomer validate --profile eu-cra-annex-i --file sbom.json
Each profile returns its own verdict and its own quality score. Ask for four profiles and you get four independent answers. Scores are never averaged together, because a good NTIA score tells you nothing about CRA readiness.
What comes with it
Thirteen usable profiles ship in the box, covering CISA 2026, NTIA, EU CRA, BSI TR-03183, India CERT-In, OpenChain Telco, FedRAMP, AIBOM, and four license use cases. See Profiles for the full catalog.
Output is console text, JSON, or SARIF, and the exit code is meant to be used directly as a CI gate. Nothing calls the network unless you opt in.
Where to go next
| If you want to | Read |
|---|---|
| Install it and run it once | Getting started |
| Know which profile to pick | Profiles |
| Write or extend a profile | Writing your own profile |
| Understand PASS, WARN, FAIL | Verdicts and exit codes |
| Gate a build on it | Using it in CI |
| Change a license answer | License policy |
| Write your own profile | Profile format |
| Know which formats work | SBOM support |