SBOM Manager vs sbomify

SBOM Manager is a free, MIT-licensed command-line tool for maintaining collections of Software Bills of Materials. It records components used in releases or builds and lets users check whether particular components and versions appear. Search tools include module lookup, project filtering, repository listings, and update-history views. Inputs can be SPDX 2.3 Tag/Value or JSON, CycloneDX 1.4 XML or JSON, CSV, and directory listings. Results can print to the console or go to a file in console or CSV formats. Repository archives can be exported and imported for restoration. The project describes continuous-integration and security-audit use. Vulnerability scanning requires a separately configured scanner that accepts an SPDX Tag/Value file; an example uses cve-bin-tool. The Linux tool requires Python 3.7 or later and installs with pip install sbom-manager. It cannot judge SBOM validity or completeness, or decide whether vulnerabilities require fixes.

sbomify is a security artifact hub for generating, managing, analyzing and sharing software bills of materials (SBOMs) and compliance documents. It supports CycloneDX and SPDX, with generation workflows for 17 ecosystems, container images, directory scans and Yocto/OpenEmbedded builds. For CI/CD, its Action supports GitHub, while documented Docker workflows cover GitLab, Bitbucket and other systems. Vulnerability analysis integrations include Google OSV and OWASP Dependency-Track. Trust Centers let teams share security materials through a custom domain, with public or private access. Supported materials include SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports and compliance attestations. Trust Center content is also available programmatically through the Transparency Exchange API. The open-source platform can be self-hosted or used as a hosted service. The free Community plan limits accounts to one product, five components, public documents and one user. Business costs $159/mo (annual); Enterprise pricing is by custom quote.