CycloneDX
A bill-of-materials standard maintained by OWASP and published by Ecma International as ECMA-424, covering SBOMs and inventories of services, cryptography and machine-learning models, with built-in support for VEX.
Covered in
Choose SBOM formats and identify components accurately
Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.
Generate an SBOM for the software you actually release
Define the inventory boundary, compare build and artifact evidence, and connect the resulting SBOM to an immutable release.
Use VEX without losing vulnerability evidence
Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.
Review SBOM changes between releases
Turn inventory differences into explainable release decisions without confusing generator changes with software changes.
Open source license compliance: SPDX expressions, obligations and SBOM checks
Know which licenses you ship, read SPDX license expressions correctly, meet the obligations of common licenses for the way you distribute, and enforce a license policy in CI from the SBOM.
Practice: SBOM completeness lab: Find the dependencies missing from a release SBOM · Local project: Build and verify a signed software release