What an SBOM is
An SBOM lists every software component in a product: open-source libraries, the operating system, third-party modules and your own packages. For each component it records:
- name and version, for example
openssl 3.0.13 - supplier
- a unique identifier - a package URL (purl) or CPE
- licence
- which other components it depends on
What the CRA requires
Annex I of the Cyber Resilience Act requires manufacturers to identify and document the vulnerabilities and components contained in their products, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at least the top-level dependencies. The SBOM is part of your technical documentation; you do not have to publish it, but market surveillance authorities can ask for it.
CycloneDX and SPDX
Two formats are widely used and both are machine-readable:
- CycloneDX (OWASP) - designed for security use cases, with built-in support for vulnerability exploitability (VEX).
- SPDX (Linux Foundation, ISO/IEC 5962) - originally for licence compliance, widely supported by build tools.
Most build ecosystems can generate them: for example Syft or cdxgen for containers and file systems, the CycloneDX plugins for Maven, Gradle and npm, and the SPDX output of the Yocto Project for embedded Linux.
An SBOM is only useful if it stays current
An SBOM written once for the declaration of conformity is outdated with the next release. What helps in practice:
- one SBOM per released version, generated in the build pipeline;
- every component checked against new vulnerability data every day;
- a recorded decision for every finding - affected, not affected or fixed;
- the differences between releases visible at a glance.
How Kernwatch uses your SBOMs
- Import CycloneDX or SPDX by upload or from CI with an API key.
- Compare releases and see which components were added, removed or changed.
- Components with a package identifier (purl) matched against OSV, the CISA Known Exploited Vulnerabilities list and the EU vulnerability database: daily on paid plans, weekly on Free.
- Triage decisions exported as VEX together with the SBOM when a customer or authority asks.
- Watch: Products, releases and SBOMs (4 min)
- Watch: Upload SBOMs from CI with an API key (2 min)
- Watch: Triage, release comparison and SBOM export (3 min)