sbom.day

A daily surrealist gallery of software bills of materials.

Issue No. 001 Tutorial Volume I Hexagonal Edition
scroll to disclose
Volume I — Components

The Honeycomb of Concepts

Each cell holds a foundational idea of the SBOM discipline. Hover, scroll, and the hexagons disclose their tutorial layer.

01

Dependencies

Direct and transitive packages your software pulls in — the visible and the inherited.

npm ls --all
02

Licenses

MIT. Apache-2.0. GPL-3.0. The legal mosaic of obligations stitched into your product.

license-checker
03

Vulnerabilities

Known CVEs against the ingredients. The melting clocks of your supply chain.

osv-scanner --sbom
04

Provenance

Who built this artifact, where, and from what source — the cartography of origin.

slsa.dev/provenance
05

Formats

SPDX, CycloneDX, SWID. Three dialects describing the same ingredient list.

cyclonedx-bom
06

Signing

Cryptographic seal binding an SBOM to an artifact. Wax for the digital age.

cosign attest
07

Compliance

EO 14028, CRA, NTIA minimum elements. The retro-future bureaucracy of trust.

compliance.report
08

Distribution

Where SBOMs live alongside artifacts: registries, attestations, transparency logs.

oras push --artifact
Volume II — Recursion

The Dependency Chain, Receding

A package depends on a package depends on a package. We render the descent as it feels — like falling forward into the vanishing point.

my-app 1.0.0
express 4.19.2
body-parser 1.20.2
qs 6.11.0
side-channel 1.0.4
call-bind 1.0.7
Today's Lesson

How to read an SBOM in eight breaths

  1. i.

    Identify the format.

    Open the file. The first key is your dialect: spdxVersion, bomFormat, or a SWID tag. Each will speak in slightly different verbs.

  2. ii.

    Locate the subject.

    Find the artifact this document describes — the document.name in SPDX or metadata.component in CycloneDX. This is the painting; the rest is its ingredients.

  3. iii.

    Walk the components.

    Each entry is a hexagonal cell. Note the name, version, and unique identifier (PURL or CPE). These three letters form a constellation that any tool can recognize.

  4. iv.

    Trace relationships.

    Components link to other components via DEPENDS_ON or dependsOn. Draw the graph; the shape will tell you about your blast radius.

  5. v.

    Read every license.

    An MIT hex next to a GPL-3.0 hex is not a contradiction — it is a contract. Note the obligations.

  6. vi.

    Cross-check vulnerabilities.

    Run the SBOM through an OSV or CVE matcher. Hexagons that flicker amber are your priorities.

  7. vii.

    Verify the seal.

    Check the cosign or in-toto attestation. An unsigned SBOM is a poem without an author.

  8. viii.

    Archive with provenance.

    Store the SBOM beside the artifact, with a build receipt. Tomorrow's auditor will thank you.