# Create an SBOM from your source code

Source: https://kernwatch.com/sbom-generator · Last updated: 2026-10-18

Drop your project folder and get a CycloneDX or SPDX software bill of materials in seconds. The analysis runs in this page - your code never leaves your computer.

## What it reads

The generator reads the files your package managers already write. Lock files give exact versions and the whole dependency tree; a manifest alone gives only the direct dependencies.

| Ecosystem | Files |
|---|---|
| JavaScript / TypeScript | package-lock.json, npm-shrinkwrap.json, yarn.lock (v1, berry), pnpm-lock.yaml, bun.lock, deno.lock, deno.json, package.json |
| Python | uv.lock, poetry.lock, Pipfile.lock, requirements*.txt, pyproject.toml, environment.yml |
| Go | go.mod |
| Rust | Cargo.lock, Cargo.toml |
| Java / Kotlin / Scala | pom.xml, gradle.lockfile, libs.versions.toml, build.gradle(.kts), build.sbt |
| .NET | packages.lock.json, *.csproj, packages.config, Directory.Packages.props |
| PHP | composer.lock, composer.json |
| Ruby | Gemfile.lock |
| Swift / iOS | Package.resolved, Package.swift, Podfile.lock, Cartfile.resolved |
| Dart / Flutter | pubspec.lock, pubspec.yaml |
| Elixir / Erlang | mix.lock, rebar.lock |
| Haskell, Julia, R, Lua, Zig, OCaml, Perl | cabal.project.freeze, stack.yaml.lock, *.cabal, Manifest.toml, Project.toml, renv.lock, DESCRIPTION, *.rockspec, build.zig.zon, *.opam, cpanfile |
| C/C++ package managers | conan.lock, conanfile.txt, conanfile.py, vcpkg.json, meson .wrap, MODULE.bazel |
| Embedded | platformio.ini, idf_component.yml, dependencies.lock (ESP-IDF), west.yml (Zephyr), library.properties, library.json |
| Nix | flake.lock |
| C/C++ (vendored) | headers of 60 common libraries (zlib, OpenSSL, mbedTLS, wolfSSL, SQLite, lwIP, FreeRTOS, cJSON, curl, fmt, littlefs, ...) recognised by their version macros; .gitmodules |
| Build files (no lock file) | CMake (find_package, pkg_check_modules, target_link_libraries, FetchContent, CPM), Makefile -l flags, qmake, meson, autoconf; well-known #include headers. Listed without versions. |
| Web pages | CDN links (unpkg, jsDelivr, cdnjs, esm.sh, code.jquery.com, ...) and bundled jQuery, Bootstrap, Vue, pdf.js and other libraries recognised by their banner |
| Containers | Dockerfile base images (FROM) |

Libraries copied into the project are found too: every folder in third_party/, vendor/, external/, deps/ and every name-1.2.3 folder, named and versioned from its own files. Folders such as node_modules, .git, target, build trees and virtual environments are skipped, and test, docs and example projects count as development dependencies. Nothing is executed and no package registry is contacted, so the result depends only on the files in the folder.

## Desktop and CI tool

The same generator as a single program for Windows, macOS and Linux - for large repositories, scripts and build pipelines. It gives the same result as this page.

## Questions

### Is my source code uploaded?

No. In the browser the files are read by JavaScript in your own tab, and the page's Content-Security-Policy forbids it to send data. The desktop tool works offline; it only connects to the network when you ask it to upload the SBOM to Kernwatch.

### Which SBOM formats does it create?

CycloneDX 1.6 JSON and SPDX 2.3 JSON, the two widely used machine-readable formats. Both validate against the official schemas and can be imported by Kernwatch and other SBOM tools.

### Is this SBOM enough for the Cyber Resilience Act?

The CRA asks for an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies, kept with the technical documentation. A lock-file based SBOM covers that and more. The CRA also requires you to handle the vulnerabilities that later appear in those components - that is what Kernwatch monitors.

### Why do some components have no exact version?

Because the folder has only a manifest (such as package.json, pom.xml or a .csproj) without a lock file. The generator never guesses: it records the declared range and says so. Commit your lock file, or enable Gradle dependency locking, to get exact versions and transitive dependencies.

### Does it scan binaries or firmware images?

No. It reads source trees: lock files, manifests and the headers of vendored C/C++ libraries. Declare libraries that you only ship as binaries in your Kernwatch release by hand.