CAST SBOM Manager vs SBOM Manager

CAST SBOM Manager analyzes source code and creates Software Bills of Materials for software product owners, release managers, and compliance specialists. SBOM creation can start from application code, existing files, Git repositories, or CAST Highlight results. A dashboard presents components, vulnerabilities, licenses, obsolescence, languages, topics, and file extensions. Users can define proprietary components with custom descriptions, licenses, vulnerabilities, copyrights, and programming languages, then place components in catalogs for reuse. License tools support custom definitions and management of open-source risks, requirements, obsolescence, and copyrights. Vulnerability information includes CVEs from NIST’s NVD and advisories from GitHub and GitLab, with custom vulnerabilities also supported. SBOMs can be imported from multiple formats and exported as Excel, Word, or CycloneDX. Multiple versions can be managed, and exported contents can be tailored for different audiences. The product runs on Linux and Windows with cloud or on-premises deployment. A free download is listed at free.

SBOM Manager is a free, MIT-licensed command-line tool for maintaining collections of Software Bills of Materials. It records components used in releases or builds and lets users check whether particular components and versions appear. Search tools include module lookup, project filtering, repository listings, and update-history views. Inputs can be SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings. Results can print to the console or go to a file in console or CSV formats. Repository archives can be exported and imported for restoration. The project describes continuous-integration and security-audit use. Vulnerability scanning requires a separately configured scanner that accepts an SPDX Tag/Value file; an example uses cve-bin-tool. The Linux tool requires Python 3.7 or later and installs with pip install sbom-manager. It cannot judge SBOM validity or completeness, or decide whether vulnerabilities require fixes.