NTIA SBOM: Formats and Tooling
JC Herz and Kate Stewart
Technical Briefing for the Energy Community

Formats and Tooling: Objectives (1/3)●●●●●●Focus on enabling automated SBOM generation and use
Build and expand on what already exists
Try to avoid re-inventing the wheel
Document what tools exist
Identify any gaps in the tooling ecosystem
Promote inclusion of SBOM capabilities into existing tools andservices

Formats and Tooling: Objectives (2/3)
Identify SBOM Formats in Commercial Use● SPDX - https://spdx.github.io/spdx-spec/● SWID - ISO/IEC 19770-2:2015● CycloneDX - https://cyclonedx.org/docs/1.2/
Identify Software Identifiers in Commercial Use and Emerging Identifiers● Common Package Enumeration - CPE● Package URLs - PURL
● Software ID tags - SWID tag● Software Heritage persistant ID - SWHID

Formats and Tooling: Objectives (3/3)●Define and categorize criteria for the minimum required information in an SBOM○○●

Enable translation between SBOM formats○○●

Field definitions
Data extensions for provision of additional/external/deeper information“Decoder Ring” tool - in progress“SwiftBOM” tool - in progress, used in HealthCare PoC

Create Playbooks for Generation and Consumption of SBOM○○Supplier Playbook - in progress
Consumer Playbook - draft release:https://docs.google.com/document/d/1Ae0l1MDS8m1on58e8mdVIA9NujzPD0k5j352VlDZr9I/edit

What should a minimum viable SBOM contain?
NTIA SBOM
Minimum Fields

SPDX

SWID

Supplier Name

(3.5) PackageSupplier:<Entity> @role
publisher(softwareCreator/publisher),@nameComponent Name

(3.1) PackageName:<softwareIdentity> @namenameUnique Identifier(3.2) SPDXID:<softwareIdentity> @tagIDbom/serialNumber andcomponent/bom-refVersion String(3.3) PackageVersion:<softwareIdentity> @version

versionComponent Hash

(3.10) PackageChecksum:<Payload>/../<File>@[hash-algorithm]:hashhashRelationship(7.1) Relationship:
CONTAINS<Link> @rel, @href(Nestedassembly/subassembly
and/or dependency graphs)

Author Name

(2.8) Creator:<Entity> @role (tagCreator), bom-descriptor:metadata/manuf
acture/contact@nameCycloneDX

Source: NTIA’s Framing Software Component Transparency: Establishing a Common Software Bill of Material (SBOM)

Current SBOM Options Available
SPDXSWID

CycloneDX

File formats: .xml

File formats: .xls, .spdx,.rdf, .json, .yml, .xml

File formats: .json, .xml

Translating between SBOM formats & file formats
SwiftBOM: (SPDX(.spdx), SWID(.xml), CycloneDX(.xml,.json))-

Demo at: https://democert.org/sbom/Source code at: https://github.com/CERTCC/SBOM/tree/master/sbom-demo

DecoderRing: (SPDX (.spdx), SWID(.xml))-Source code at: https://github.com/DanBeard/DecoderRIng

SPDX tools: ( SPDX (.spdx, json, yaml, rdf, xml, xls) )-Demo at: https://tools.spdx.org/app/
Source code at: https://github.com/spdx/spdx-online-tools

Where use an SBOM? All stages
Upstream / Produce
Open Source Projects

3rd Party

Need for reference toolingfor efficient and effective exchange ofsoftware bills of materials to enable
compliance, security, export control,pedigree and provenance workflows.

Development → Build → Test → Packaging → Policy Checks → Release/Operate

Downstream / Consume
Customers
Open Source Projects

ProductsServices

Taxonomy used for Classifying SBOM Tools(UPDATED Feb26)
Category

Type of Tool

Description

Produce

Build

SBOM is automatically created as part of building a software artifact and contains
information about the build.

ManualA person will manually fill in the SBOM information

AnalysisAnalysis of source or binary files will generate the SBOM by inspection of the artifacts
and any associated sources.

View

Be able to understand the contents in human readable form (picture, figures, tables,text.). Use to support decision making & business processes.

Diff

Be able to compare two documents of a given formation and clearly see the differences.
For instance, comparing between two versions of a piece of software.

Import

Be able to import an SBOM into your system for further processing

Translate

Change from one file type to another file type while preserving the same information.

Merge

Multiple sources of documents can be merged together for analysis and audit purposes

Tool support

Support use in other tools by APIs, object models, libraries, or other reference sources.

ConsumeTransformTaxonomy used for Classifying SBOM Tools
CategoryType

Description

Produce

Build

Document is automatically created as part of building an artifact and contains information
about the build.

ManualA person will manually fill in the information

Audit Tool

A source code analysis or audit tool will generate the document by inspection of theartifact and any associated sources.

View

Be able to understand the contents in human readable form (picture, figures, tables,text.). Use to support decision making & business processes.

Diff

Be able to compare two documents of a given formation and clearly see the differences.
For instance, comparing between two versions of a piece of software.

Analyze

Be able to import a document into your system

Translate

Change from one file type to another file type while preserving the same information.

Merge

Multiple sources of documents can be merged together for analysis and audit puproses

Tool integration

Support use in other tools by APIs, libraries.

ConsumeTransformTool Support for Different SBOM Formats
SPDX

http://tiny.cc/SPDX

SWID

CycloneDX

http://tiny.cc/SWID

http://tiny.cc/CycloneDXSBOMs Examples (Work in Progress)
SPDX-

https://github.com/lfscanning - LF projects source packages.
https://github.com/swinslow/spdx-examples - source & binary examples

CycloneDX-

https://github.com/CycloneDX/sbom-examples - binary examples

SWID-

Time 1.9 from Red Hat distro - binary example

SBOM Playbooks: Supplier Playbook●●●●

Supplier defined to include: commercial vendor, contract developer, open
source software supplier developing and maintaining OSS code.
SBOM production workflow: development pipeline vs. legacy processes
SBOM scope: What’s in the Box
Build Artifacts○○●

Functional workflow (tool-agnostic) for commit → build with SBOM production as an output
Example outputs: SPDX, CycloneDX

Provision of SBOMs to recipients○

Reference to NTIA Framing Group report:
https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_framing_sharing_july9.pdf

SBOM Playbook: Consumer Playbook●●●●Acquisition of SBOM from supplier
SBOM Ingestion and Parsing
Software Entity Resolution
Data Flows into Third Party Processes and Platforms
○
○
○

●

Configuration Management Database
Security Operations Center
Software Asset Management System

Ongoing MonitoringAreas to Learn: Generalized vs. Energy-Specific Requirements●●●●

Generalized requirements for code: software, firmware, embedded
Where do SBOM requirements of firmware/embedded diverge from IT?
Where do SBOM requirements for licensed/proprietary third party
components diverge from third party open source components?
Lessons Learned and Best Practices for SBOM access control○○○●Open Formats
Content may be delivered under NDA
Rely on confidentiality terms and access control, rather than IP/copyright

Why this matters: SBOM is an intermediary phase of the data○○○

Operational requirement for data to be ingested by enterprise processes and platforms
Ex: CMDB, SAM, SOC
Configuration management can’t become a “derivative work” and function as intended.