The Supply Chain Problem
Modern software is assembled from hundreds of open source dependencies, each pulling in more. When a vulnerability is disclosed in one library, every team scrambles to answer a simple question: do we ship it, and where.
What an SBOM Is
A software bill of materials is a complete inventory of the components in a piece of software. Like an ingredient label, it lists each package, its version, and its supplier.
- It enables fast answers when a new vulnerability appears.
- It supports license compliance checks.
- It is generated automatically during the build, not written by hand.
Beyond the Inventory
An SBOM is a list, but supply chain security also needs trust that the artifact is genuine.
- Provenance records how and where an artifact was built.
- Signing lets consumers verify an artifact came from the expected pipeline and was not tampered with.
- Verification at deploy time rejects unsigned or unknown artifacts.
Why It Matters
When a widespread library flaw is announced, teams with an SBOM query their inventory in minutes. Teams without one spend days guessing.
Key idea
An SBOM inventories every component in software so teams can instantly find vulnerable dependencies, and pairing it with provenance and signing proves the artifact is genuine throughout the supply chain.