Tool name: SBOMAudit

### homepage_url

https://github.com/anthonyharrison/sbomaudit

### contact_email

anthony.p.harrison@gmail.com

### code_view_url

https://github.com/anthonyharrison/sbomaudit

### spdx_license_expression

Apache-2.0

### description

SBOMAUDIT reports on the quality of the contents of an SBOM (Software Bill of Materials) by performing a number of checks.

The following are a sample of the checks performed.

### SBOM Format

- Check that the version of the SBOM is either version 2.2 or 2.3 (SPDX) or version 1.3, 1.4, 1.5 or 1.6 (CycloneDX).

- Check that a creator is defined.

- Check that the time that the SBOM is created is defined.

### Files

The following checks are performed for each file item:

- Check that a file name is specified.

- Check that the file type is specified.

- Check that a license is specified and that the license identified is a valid [SPDX License identifier](https://spdx.org/licenses/). Note that NOASSERTION is not considered a valid license.

- Check that the license is an [OSI Approved](https://opensource.org/licenses/) license.

- Check that a copyright statement is specified. Note that NOASSERTION is not considered a valid copyright statement.

### Packages

The following checks are performed on each package item:

- Check that a package name is specified.

- Check that a supplier is specified.

- Check that a version is specified.

- Check that the package version is the latest released version of the package. The latest version checks are only performed if the --offline option is not specified.

- Check that a mature version of the package is being used as determined by the value specified in the --age option. The release date checks are only performed if the --offline option is not specified.

- Check the age of a package being used, which is not the latest released version, is greater than the value specified in the --maxage option. The check is only performed if the --offline option is not specified.

- Check that a license is specified and that the license identified is a valid [SPDX License identifier](https://spdx.org/licenses/). Note that NOASSERTION is not considered a valid license.

- Check that the license is an [OSI Approved](https://opensource.org/licenses/) license.

- Check that a [PURL specification](https://github.com/package-url/purl-spec) is provided for the package.

- Check that a [CPE specification](https://nvd.nist.gov/products/cpe) is provided for the package.

### Latest package version checks

The checks for the latest package version are performed for packages within the following language ecosystems:

- dart
- go
- java
- javascript
- .net
- perl
- python
- r
- ruby
- rust
- swift

### Relationships

The following checks are performed:

- Check that relationships are defined.
- Check that every file is included in at least one relationship.
- Check that every package is included in at least one relationship.

### NTIA Conformance

- Check that the contents of the SBOM meet the minimum requirements for an SBOM as defined by the [NTIA](https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf).

### primary_languages

Python

### short_term_roadmap

Nothing other than bug fixes

### long_term_roadmap

Add support for SPDX 3 (will come via upgrade to Lib4Sbom)

Add additional compliance checks including CRA

### proprietary_data

- [ ] Yes, the tool depends on proprietary data sources

### commercial_features

- [ ] Yes, the tool has a commercial version with different/additional features

### capabilities

- [x] Identifiers - Use Package-URL (PURL) identifiers
- [x] Identifiers - Use SPDX license expressions
- [ ] Scanning - Analyze package manifests and lockfiles
- [ ] Scanning - Analyze package files
- [ ] Scanning - Scan for copyright
- [ ] Scanning - Scan for license
- [ ] Scanning - Analyze source code
- [ ] Scanning - Analyze containers
- [ ] Scanning - Analyze installed system packages (linux distros)
- [ ] Scanning - Analyze installed application packages
- [ ] Scanning - Other analysis
- [ ] Packages - Inventory packages
- [ ] Packages - Inventory packages dependencies
- [ ] Packages - Resolve dependencies
- [ ] Packages - Navigate or display dependency graph
- [ ] Compliance - Generate CycloneDX SBOMs
- [ ] Compliance - Generate SPDX SBOMs
- [x] Compliance - Validate CycloneDX SBOM
- [x] Compliance - Validate SPDX SBOMs
- [ ] Compliance - Generate CycloneDX VEX
- [ ] Compliance - Generate CSAF VEX
- [ ] Compliance - Generate OpenVex
- [ ] Compliance - Generate other compliance documents
- [x] Policies - Define and check license policies
- [x] Policies - Define and check security policies
- [x] Policies - Define and check other policies
- [ ] Data - Database of Package metadata
- [ ] Data - Database of Package dependency relationships
- [ ] Data - Database of License obligations
- [ ] Data - Database of Licenses
- [ ] Data - Database of Vulnerabilities
- [ ] License - Help triage license issues
- [ ] License - Generate license credit and attribution notices
- [ ] License - Generate source code redistribution lists
- [ ] Vulnerabilities - Detect vulnerable code in packages
- [ ] Vulnerabilities - Find known vulnerabilities for package
- [ ] Vulnerabilities - Determine reachable vulnerabilities
- [ ] Vulnerabilities - Help triage vulnerabilities
- [ ] Binaries - Analyze binaries
- [ ] Binaries - Analyze ELF binaries
- [ ] Binaries - Analyze Windows binaries
- [ ] Binaries - Analyze firmware binaries
- [ ] Binaries - Analyze Other binaries
- [ ] Matching - Match source code
- [ ] Matching - Match binary code
- [ ] Tracing - Trace code execution
- [ ] Tracing - Trace build
- [ ] Code Security - Analyze code statically (SAST/linting)
- [ ] Code Security - Analyze code dynamically (DAST)
- [ ] Download - Source package
- [ ] Download - Source repositories
- [ ] Download - Binary package
- [ ] Deployment - Deployable as containers (Docker/OCI/k8s/etc)
- [ ] Deployment - Deployable in CI/CD pipelines
- [x] Deployment - Deployable as a library
- [x] Run - Run as a command line tool
- [ ] Run - Run as a web application
- [ ] Run - Run as an API service

### other_capabilities

_No response_