microsoft/sbom-tool

View on GitHub

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

Stars: 2.1k
Forks: 201
Open beginner issues: 0
Indexed issues: 56
Avg merge: 6d 21h
Merged PRs (30d): 1

Dominant language: C#
License: MIT
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: No contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

56 open issues indexed

Support Creation of BSI-Conformant SBOMs Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

microsoft/sbom-tool#1531 · 4 comments · 1 reaction · Opened Aug 19, 2026
Please consider posting Microsofts Issue list for SPDX V 3.1 submitted to the Linux Foundation Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

microsoft/sbom-tool#1528 · Opened Jul 14, 2026
Feature Request: Safety Relevance classification support via externalRefs or custom annotations Open

Difficulty 5/5 Over a week Newbie friendliness 42/100

microsoft/sbom-tool#1527 · 1 comment · Opened Jun 25, 2026
Sbom fails to parse lisence from packages Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

microsoft/sbom-tool#1511 · 1 reaction · Opened May 21, 2026
Add support for SPDX V 2.3 Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

microsoft/sbom-tool#1509 · Opened May 19, 2026
SBOM Tool 4.1.5 fails to parse package-lock.json file Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

microsoft/sbom-tool#1471 · 1 comment · 1 reaction · Opened Apr 13, 2026
Is sbom-tool being deprecated? Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

microsoft/sbom-tool#1459 · 4 comments · 22 reactions · Opened Apr 1, 2026
Microsoft.Sbom.Targets lists generated package twice in SBOM Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#1425 · 1 comment · Opened Feb 25, 2026
Add support for customized nuget globalPackagesFolder Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

microsoft/sbom-tool#1424 · Opened Feb 24, 2026
Level up the license detection for nuget packages Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

microsoft/sbom-tool#1420 · 1 comment · 5 reactions · Opened Feb 17, 2026
Tool fails on Dotnet 10 with System.InvalidOperationException: The JSON property name for 'Microsoft.ComponentDetection.Contracts.TypedComponent.SwiftComponent.packageUrl' collides with another property. Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#1380 · 1 comment · Opened Jan 6, 2026
Microsoft.Sbom.Targets SbomGenerationVerbosity property has no effect Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#1377 · Opened Jan 4, 2026
Fatal error when directory path has a valid trailing backslash Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#1355 · Opened Dec 2, 2025
Request SHA256 is added when linking external SBOMs in the primary SBOM. Open

accepted

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#1209 · Opened Sep 5, 2025
FileHasher.HashAlgorithmNames is wrong when generating aggregated SBOM Open

accepted

Difficulty 4/5 3-5 days Newbie friendliness 42/100

microsoft/sbom-tool#1159 · Opened Aug 15, 2025
Add support for DEV_DEPENDENCY_OF Relationship in SPDX 2.2 SBOMs Open

accepted

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sbom-tool#1140 · 3 comments · 1 reaction · Opened Jul 16, 2025
Our version of AutoMapper has been deprecated Open

accepted

Difficulty 4/5 3-5 days Newbie friendliness 52/100

microsoft/sbom-tool#1107 · 5 comments · Opened Jun 25, 2025
Calling SbomValidator.ValidateSbomAsync With Directory As OutputPath Returns False Positive Open

accepted

microsoft/sbom-tool#1093 · 5 comments · 1 reaction · 2 assignees · Opened May 29, 2025
External SPDX files appear in the files section Open

accepted

microsoft/sbom-tool#1090 · 3 comments · 1 assignee · Opened May 28, 2025
Can we handle case-variant names in the same folder? Open

accepted

microsoft/sbom-tool#1089 · 1 assignee · Opened May 26, 2025
Sbom-tool generates cargo purl strings with extra "/" char Open

accepted

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sbom-tool#1050 · 1 comment · Opened May 13, 2025
Consider changing RootPathFilter to accept pattern matching Open

accepted

microsoft/sbom-tool#1040 · 2 comments · 1 reaction · 1 assignee · Opened May 8, 2025
Allow Microsoft.ManifestTool -bl option to read files from any directory Open

needs investigation

microsoft/sbom-tool#988 · 1 assignee · Opened Mar 20, 2025
[Microsoft.Sbom.Targets] Add target for publish Open

.NET tabled

Difficulty 4/5 3-5 days Newbie friendliness 45/100

microsoft/sbom-tool#983 · 6 comments · 2 reactions · Opened Mar 19, 2025
SBOM generation skips SPDX 3.0 documents when looking for external document references Open

accepted

microsoft/sbom-tool#981 · 1 comment · 1 reaction · 2 assignees · Opened Mar 18, 2025
Package SBOMs are included in SBOM files section Open

accepted

microsoft/sbom-tool#956 · 1 reaction · 2 assignees · Opened Mar 3, 2025
Generating SBOM with NuGet (`Microsoft.Sbom.Targets`) on MacoSX results in intermittent hangs Open

needs investigation

microsoft/sbom-tool#946 · 3 comments · 1 reaction · 1 assignee · Opened Feb 23, 2025
License information may not be fully recorded Open

help wanted

Difficulty 3/5 1-2 days Newbie friendliness 38/100

microsoft/sbom-tool#944 · 6 comments · Opened Feb 21, 2025
[Microsoft.Sbom.Targets] Generates the wrong .nupkg file name and cannot find it. Open

await community interest tabled

Difficulty 3/5 1-2 days Newbie friendliness 48/100

microsoft/sbom-tool#920 · 12 comments · Opened Feb 4, 2025
Provide better documentation around usage/integration into various pipelines Open

needs investigation

microsoft/sbom-tool#909 · 3 comments · 1 reaction · 1 assignee · Opened Jan 29, 2025
Feature request: Allow caching when running SBOM multiple times on the same commit Open

needs investigation

microsoft/sbom-tool#907 · 1 comment · 1 assignee · Opened Jan 28, 2025
SBOM tool always includes package entry when .nuspec file is found Open

needs investigation

microsoft/sbom-tool#866 · 1 assignee · Opened Jan 14, 2025
Conflict when a package is both direct and transitive Open

accepted

microsoft/sbom-tool#833 · 4 comments · 1 assignee · Opened Dec 13, 2024
The Maven dependencies graph is different from other package managers Open

accepted

microsoft/sbom-tool#827 · 6 comments · 1 assignee · Opened Dec 6, 2024
Lack of a "proper" Github Action prevents pinning to specific versions as hardening advice recomments. Open

tabled

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sbom-tool#820 · 2 comments · 2 reactions · Opened Dec 3, 2024
Support Ubuntu Chisel manifests as an sbom input Open

needs investigation

microsoft/sbom-tool#811 · 2 comments · 1 reaction · 1 assignee · Opened Nov 21, 2024
PIP Comp Detect Adapter - No License or Supplier information Open

tabled

microsoft/sbom-tool#802 · 2 comments · 1 reaction · 1 assignee · Opened Nov 15, 2024
[Microsoft.Sbom.Targets] Rename internal MSBuild properties to minimize risk of conflicts Open

.NET help wanted

Difficulty 4/5 3-5 days Newbie friendliness 38/100

microsoft/sbom-tool#800 · 3 comments · Opened Nov 15, 2024
Support German BSI TR-03183 2.0.0 by supporting SPDX 2.2.1 or higher Open

accepted

microsoft/sbom-tool#738 · 3 comments · 3 reactions · 1 assignee · Opened Oct 7, 2024
[Microsoft.Sbom.Targets] License detection properties have no effect Open

.NET

Difficulty 3/5 1-2 days Newbie friendliness 48/100

microsoft/sbom-tool#718 · 2 comments · 6 reactions · Opened Sep 19, 2024
[Microsoft.Sbom.Targets] Include SBOM in this package Open

.NET

Difficulty 3/5 1-2 days Newbie friendliness 38/100

microsoft/sbom-tool#717 · Opened Sep 19, 2024
[Microsoft.Sbom.Targets] Generate SbomGenerationPackageVersion with Nerdbank.GitVersioning Open

.NET

Difficulty 3/5 1-2 days Newbie friendliness 42/100

microsoft/sbom-tool#716 · 1 comment · Opened Sep 19, 2024
[Microsoft.Sbom.Targets] Doesn't find files in Artifacts output layout Open

.NET

Difficulty 4/5 3-5 days Newbie friendliness 42/100

microsoft/sbom-tool#715 · Opened Sep 19, 2024
SBOM Task Outputs Directly to Console Instead of Using MSBuild Logging APIs Open

.NET

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#712 · 6 comments · Opened Sep 19, 2024
Support for Command Line Argument Passthrough Open

.NET

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sbom-tool#711 · Opened Sep 19, 2024
Support for Response Files in CLI Open

await community interest tabled

Difficulty 3/5 1-2 days Newbie friendliness 45/100

microsoft/sbom-tool#710 · Opened Sep 19, 2024
Implement Consistent Path Normalization Across sbom-tool Open

tabled

Difficulty 5/5 Over a week Newbie friendliness 35/100

microsoft/sbom-tool#709 · Opened Sep 19, 2024
Add Logging Localization Support Open

.NET

Difficulty 4/5 3-5 days Newbie friendliness 35/100

microsoft/sbom-tool#708 · Opened Sep 19, 2024
.NET integration follow-up considerations Open

.NET

Difficulty 5/5 Over a week Newbie friendliness 20/100

microsoft/sbom-tool#693 · 17 comments · 6 reactions · Opened Aug 30, 2024
SBOM API will show `information` logs when verbosity is set to be more restrictive Open

tabled

Difficulty 3/5 1-2 days Newbie friendliness 35/100

microsoft/sbom-tool#616 · 1 comment · Opened Jul 17, 2024

microsoft/sbom-tool

Get new issues in your inbox