SBOM export

A Software Bill of Materials (SBOM) is a machine-readable inventory of the dependencies in your project. MergeGuide generates one from your dependency manifests in the standard CycloneDX and SPDX formats.

Generate an SBOM

# Generate from the current directory (CycloneDX JSON to stdout)
mergeguide sbom generate .

# Write SPDX JSON to a file
mergeguide sbom generate . --format spdx-json -o sbom.json

# Name and version the component
mergeguide sbom generate --name "MyApp" --version "1.0.0" package.json

Supported formats

Format	Standard	Notes
`cyclonedx-json`	CycloneDX 1.5	JSON; widely supported. The default.
`cyclonedx-xml`	CycloneDX 1.5	XML; legacy-compatible.
`spdx-json`	SPDX 2.3	JSON; Linux Foundation standard.
`spdx-tag-value`	SPDX 2.3	Tag-value; human-readable.

List them anytime:

mergeguide sbom formats

Supported manifests

sbom generate reads these dependency manifests:

Ecosystem	Manifests
npm	`package.json`, `package-lock.json`
pip	`requirements.txt`, `Pipfile`, `pyproject.toml`
go	`go.mod`, `go.sum`
cargo	`Cargo.toml`, `Cargo.lock`
maven	`pom.xml`
gem	`Gemfile`, `Gemfile.lock`
composer	`composer.json`, `composer.lock`
nuget	`packages.config`, `*.csproj`

By default, development dependencies are excluded. Include them with --include-dev.

Options

Option	Description
`-f`, `--format`	Output format (default `cyclonedx-json`).
`-o`, `--output`	Write to a file (default stdout).
`-n`, `--name`	Project/component name.
`--version`	Project/component version.
`-d`, `--description`	Project description.
`--include-dev`	Include dev dependencies.

See mergeguide sbom.

Scan dependencies for vulnerabilities

An SBOM inventories your dependencies; to check them against known vulnerabilities, run the vulnerability scanner:

mergeguide scan vuln --fail-on critical

See Running scans.

Next steps

OSCAL export

Export NIST OSCAL compliance evidence.

Compliance overview

How evidence fits your audit.

Get started

Provisioning & account

Setup & installation

Configuration

Operation

Navigation

Integrations & CI/CD

Compliance

Methodology

Troubleshooting & FAQ

Reference

Generate an SBOM

Supported formats

Supported manifests

Options

Scan dependencies for vulnerabilities

Next steps

OSCAL export

Compliance overview

​Generate an SBOM

​Supported formats

​Supported manifests

​Options

​Scan dependencies for vulnerabilities

​Next steps

OSCAL export

Compliance overview

Generate an SBOM

Supported formats

Supported manifests

Options

Scan dependencies for vulnerabilities

Next steps