xbom.wiki

XBOM

.wiki

The Extended Bill of Materials Field Guide

What is an XBOM

An Extended Bill of Materials is a comprehensive, machine-readable inventory of all components, dependencies, and metadata that comprise a software system. Where a traditional BOM catalogs physical parts, an XBOM extends this concept into the digital realm, recording not just what components exist, but their relationships, vulnerabilities, licenses, and provenance across the entire supply chain.

The XBOM is a field guide to the invisible architecture of software -- a map drawn in structured data, revealing the hidden dependencies, transitive relationships, and supply chain vectors that define modern applications.

SPDX: Software Package Data Exchange. ISO/IEC 5962:2021
Application
Framework
Crypto Lib
Utils
Logger
Component relationships: Direct, transitive, optional

Component Taxonomy

XBOM components are classified by their role and relationship within the dependency graph. Direct dependencies are those explicitly declared. Transitive dependencies are those pulled in by direct dependencies. Each class has distinct attributes: version, license, provenance hash, and vulnerability metadata.

Direct Dependencies
Transitive Dependencies
Optional Components
Peer Dependencies

Reading an XBOM

Like a naturalist's field journal, an XBOM records detailed observations of each component in the ecosystem. The format is machine-readable, following standards like SPDX or CycloneDX, but the underlying structure is fundamentally the same as a Victorian-era inventory: itemized, annotated, and indexed.

<component> <name>openssl</name> <version>3.1.4</version> <license>Apache-2.0</license> </component>
Provenance: cryptographic hash of component source
react
scheduler
loose-envify

Fig. 1: Dependency tree with direct and transitive relationships

SLSA Framework: Supply chain Levels for Software Artifacts

Standards & Specifications

Multiple XBOM standards exist, each designed for different contexts. SPDX is the ISO standard for comprehensive software identification. CycloneDX focuses on application security. SWID tags provide asset management. All serve the same purpose: making the invisible supply chain visible and verifiable.

SPDX
Linux Foundation
ISO/IEC 5962
CycloneDX
OWASP
AppSec Focus
SWID
ISO/IEC 19770
Asset Mgmt