Codenotary Trustcenter vs SBOM Manager

Codenotary Trustcenter manages software bills of materials (SBOMs) and applies trust enforcement to applications and their components. It can import and export SBOMs in any format, create detailed SBOMs for open-source applications or containers, and analyze them. The platform tracks component provenance and trust levels, flags unknown or untrusted components, and monitors attestations and application and stack risk profiles. It provides real-time application risk scores with reachability analysis and can enforce deployment of container images built with known, trusted components. Trustcenter also supports software risk profiles for compliance and audit work, plus artifact attestation guidance such as in-toto. Listed integrations include CI/CD and SCM tools, Docker and OCI registries, Snyk, Aqua, JFrog, Jenkins, GitLab, GitHub, Kubernetes, and AWS Lambda. Language bindings include Java, C++, Python, Node.js, Go, Rust, and PHP. Trustcenter/Teams is offered on-premises or in the cloud, with component discovery, dependency tracking, centralized SBOM storage, and continuous vulnerability scanning. Enterprise plans start at $3,600 a month; Teams pricing is by quote. A 30-day trial is listed.

SBOM Manager is a free, MIT-licensed command-line tool for maintaining collections of Software Bills of Materials. It records components used in releases or builds and lets users check whether particular components and versions appear. Search tools include module lookup, project filtering, repository listings, and update-history views. Inputs can be SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings. Results can print to the console or go to a file in console or CSV formats. Repository archives can be exported and imported for restoration. The project describes continuous-integration and security-audit use. Vulnerability scanning requires a separately configured scanner that accepts an SPDX Tag/Value file; an example uses cve-bin-tool. The Linux tool requires Python 3.7 or later and installs with pip install sbom-manager. It cannot judge SBOM validity or completeness, or decide whether vulnerabilities require fixes.