Owner

CycloneDX

45 indexed repositories · View on GitHub

specification
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reductio...

XSLT · 547 stars
cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

C# · 541 stars
cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

Python · 390 stars
cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

Java · 385 stars
cyclonedx-dotnet
Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects

C# · 294 stars
cyclonedx-gradle-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects

Java · 239 stars
bom-examples
A repository with examples of CycloneDX BOMs (SBOM, SaaSBOM, OBOM, VEX, etc)

238 stars
cyclonedx-gomod
Creates CycloneDX Software Bill of Materials (SBOM) from Go modules

Go · 187 stars
cyclonedx-rust-cargo
Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

Rust · 178 stars
sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data

Go · 163 stars
cyclonedx-node-npm
Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.

JavaScript · 150 stars
cyclonedx-node-module
creates CycloneDX Software-Bill-of-Materials (SBOM) from Node.js-based projects

145 stars
Sunshine
Sunshine - SBOM visualization tool

HTML · 124 stars
cyclonedx-core-java
CycloneDX SBOM Model and Utils for Creating and Validating BOMs

Java · 120 stars
cyclonedx-go
Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)

Go · 118 stars
cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python

Python · 116 stars
transparency-exchange-api
A standard API specification for exchanging supply chain artifacts and intelligence

Shell · 113 stars
cyclonedx-bom-repo-server
A BOM repository server for distributing CycloneDX BOMs

C# · 89 stars
cyclonedx-php-composer
Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects

PHP · 87 stars
cyclonedx-linux-generator
Lockheed Martin developed utility to generate CycloneDX SBOMs for Linux distributions

Java · 56 stars
25 more repositories live on View on GitHub

Open All

998 open issues indexed

Conversion of SBOM in XML or JSON format with two licenes creates a wrong JSON or XML SBOM Open

CycloneDX/cyclonedx-web-tool#127 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Support for viewing the BOM as table Open

CycloneDX/cyclonedx-web-tool#128 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Resolve set-output deprecation Open

CycloneDX/cyclonedx-web-tool#135 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
Upgrade CycloneDX libraries to 10.0.2 (SPDX schema 3.26.0) Open

CycloneDX/cyclonedx-web-tool#176 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
Fails on Ubuntu Runners Open

CycloneDX/gh-python-generate-sbom#1 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Using a non-default input path causes the action to fail Open

CycloneDX/gh-python-generate-sbom#4 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
:mega: migrate to `cyclonedx-bom >= 4` ??? Open

breaking change enhancement

CycloneDX/gh-python-generate-sbom#10 · 0 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
Investigate using tools to generate serialization / deserialization implementations Open

enhancement

CycloneDX/cyclonedx-rust-cargo#88 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Investigate if custom registries should result in purl's with a different type from "cargo" Open

cargo-cyclonedx enhancement

CycloneDX/cyclonedx-rust-cargo#231 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Document important design decisions in the Wiki Open

documentation

CycloneDX/cyclonedx-rust-cargo#346 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
Trailing zeros in fractional digits of timestamp fails validation. Open

CycloneDX/cyclonedx-rust-cargo#353 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Support for -sys style crates Open

enhancement

CycloneDX/cyclonedx-rust-cargo#366 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Consider using `packageurl::PackageUrl` instead of custom `Purl` type. Open

CycloneDX/cyclonedx-rust-cargo#410 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Consider using `url::Url` instead of custom `Uri` type. Open

CycloneDX/cyclonedx-rust-cargo#411 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Reproducible SBOMs Open

CycloneDX/cyclonedx-rust-cargo#514 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Capture data only available during the build process Open

cargo-cyclonedx enhancement

CycloneDX/cyclonedx-rust-cargo#532 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Make bom-ref use relative paths for workspace items as well Open

CycloneDX/cyclonedx-rust-cargo#556 · 11 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
Provide an easy way to map an artifact to a SBOM Open

CycloneDX/cyclonedx-rust-cargo#557 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Use a license id or name instead of an expression if there is only one license Open

CycloneDX/cyclonedx-rust-cargo#570 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Replace qualifier with optional namespace for local packages Open

CycloneDX/cyclonedx-rust-cargo#612 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`cyclonedx-bom` is unsuitable for `cargo auditable` use case Open

CycloneDX/cyclonedx-rust-cargo#628 · 0 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Hashes for packages from registries with parameters in the URL may not be recorded Open

CycloneDX/cyclonedx-rust-cargo#629 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The type of external references shouldn't be "open" Open

CycloneDX/cyclonedx-rust-cargo#664 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Refactor `.new_unchecked()` on enums into `impl From<&str>` Open

CycloneDX/cyclonedx-rust-cargo#684 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Do round trip tests Open

CycloneDX/cyclonedx-rust-cargo#696 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Split `specs` module for XML and JSON Open

CycloneDX/cyclonedx-rust-cargo#697 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Avoid null fields Open

CycloneDX/cyclonedx-rust-cargo#698 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
XML de/serialization of `normalizedstring` fields is incorrect Open

CycloneDX/cyclonedx-rust-cargo#737 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Support Cargo resolver v2 Open

enhancement

CycloneDX/cyclonedx-rust-cargo#760 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Metadata components should not have sub-components Open

CycloneDX/cyclonedx-rust-cargo#763 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Optional Dependencies Open

CycloneDX/cyclonedx-rust-cargo#766 · 6 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
[Feature] Support CycloneDX 1.6 Open

CycloneDX/cyclonedx-rust-cargo#769 · 17 comments · 6 reactions · 0 assignees · Indexed Sep 15, 2026
Add ability to specify output path when using as library. Open

CycloneDX/cyclonedx-rust-cargo#778 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
[cyclonedx-bom] top-level `bom.version` should be optional in `Bom` struct Open

CycloneDX/cyclonedx-rust-cargo#785 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Expose spec in cyclonedx-bom Open

CycloneDX/cyclonedx-rust-cargo#802 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Latest release doesn't compile on loongarch64 Open

CycloneDX/cyclonedx-rust-cargo#814 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Output is target specific but does not go in target directory Open

CycloneDX/cyclonedx-rust-cargo#820 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Generated SBOMs use deprecated features Open

CycloneDX/cyclonedx-rust-cargo#825 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Better feedback when no SBOMs are generated Open

CycloneDX/cyclonedx-rust-cargo#827 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Reliance on unstable `source` field in `cargo metadata` output Open

CycloneDX/cyclonedx-rust-cargo#854 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
License of cargo-cyclonedx declared Apache-2.0, but “derived from” MIT project Open

legal

CycloneDX/cyclonedx-rust-cargo#864 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
chore(legal): add license headers to all significant Rust source files Open

legal

CycloneDX/cyclonedx-rust-cargo#865 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add configurable XML parser maxDepth support Open

CycloneDX/cyclonedx-rust-cargo#867 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The --target flag does not seem to respect target-conditional features in generated SBOM. Open

CycloneDX/cyclonedx-rust-cargo#871 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The tool leaves the repo in a dirty state Open

CycloneDX/cyclonedx-rust-cargo#878 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Feature Request: Create a Python package Open

enhancement

CycloneDX/Sunshine#9 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Support for respecting Analysis state Open

enhancement

CycloneDX/Sunshine#15 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Make vulnerabilities links Open

enhancement

CycloneDX/Sunshine#24 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Allow Enriching in Air-Gapped Environment Open

enhancement

CycloneDX/Sunshine#25 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
docker support feature Open

CycloneDX/cyclonedx-buildroot#54 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026

CycloneDX

Get new issues in your inbox