sbomasm

Spec sheet

Purpose

sbomasm is a toolkit for managing SBOMs across their lifecycle, including assembly, metadata editing, sensitive-data removal, enrichment, signing, and verification.Read 8 Oct 2026 · github.com

Support

The README lists Slack, live chat, email and GitHub bug reports as ways to contact the project team.Read 8 Oct 2026 · github.com

License

The repository is published under the Apache-2.0 license.Read 8 Oct 2026 · github.com

Assembly

It can merge multiple SBOMs, including hierarchical, flat, and augment merge workflows.Read 8 Oct 2026 · github.com

CI/CD

The README describes GitLab and GitHub CI as ecosystems where sbomasm is used for automated SBOM assembly.Read 8 Oct 2026 · github.com

Formats

It supports both SPDX and CycloneDX formats.Read 8 Oct 2026 · github.com

Installation

The README lists Go install, Homebrew, Docker, prebuilt binaries, and building from source as installation options.Read 8 Oct 2026 · github.com

Integration

The README documents integration with Dependency-Track to pull SBOMs, assemble them, and push them back.Read 8 Oct 2026 · github.com

License enrichment

The enrich command can fill missing license information using ClearlyDefined data.Read 8 Oct 2026 · github.com

Metadata

The edit command can add or update SBOM metadata such as supplier information and licenses.Read 8 Oct 2026 · github.com

Release platforms

The latest release shown provides macOS Darwin arm64 and x86_64 archives, plus Linux arm64 and x86_64 archives.Read 8 Oct 2026 · github.com

Sensitive data

The rm command can remove components or fields, including internal components before sharing.Read 8 Oct 2026 · github.com

Signing

sbomasm can cryptographically sign and verify SBOMs using ShiftLeftCyber’s third-party service.Read 8 Oct 2026 · github.com

Speed

The README describes sbomasm as optimized for large-scale operations.Read 8 Oct 2026 · github.com

Where Specifiction places it

• SBOM Management Software#20 of 226.4