the visual guide to software supply chains
A Software Bill of Materials is the ingredient label for your software. It lists every component, library, and dependency that makes your application run -- like a recipe card for digital products. Understanding your SBOM is the first step toward software supply chain transparency.
Every modern application is a web of interconnected packages. A single project can have hundreds of direct and transitive dependencies, each a thread in a complex tapestry of shared code.
A package your project explicitly imports and uses.
A dependency of your dependency -- the hidden layers.
The full graph of all packages your software relies on.
Understanding open source licenses through geometry
The most popular open source license. Do almost anything you want with the code -- just include the original copyright notice. Minimal restrictions, maximum freedom.
Similar to MIT but with an explicit patent grant. Provides more legal clarity for enterprise use. Requires preservation of copyright and license notices.
The strong copyleft license. Any derivative work must also be released under GPL. Ensures software freedom propagates through the dependency chain.
A permissive license similar to MIT but with a non-endorsement clause. You cannot use the project's name to promote derived products without permission.
Vulnerability scanning in the dependency landscape
A single vulnerable transitive dependency can compromise an entire application. SBOMs make it possible to quickly identify which of your projects are affected when a new CVE is disclosed.
When every component is understood, the whole becomes clear
When every dependency is known, every license is understood, and every vulnerability is tracked -- the supply chain transforms from a mystery into a map.
The Linux Foundation standard. ISO/IEC 5962:2021. Comprehensive and widely adopted across industries.
OWASP standard optimized for security use cases. Rich vulnerability and service modeling.
ISO/IEC 19770-2. XML-based software identification standard used in enterprise asset management.