SPDX SBOM Generator Integration Guide

Generate SPDX SBOMs from GoMod, npm, PyPI, Maven, Cargo, and more. Note: this project was archived January 2025; Trivy or Syft are recommended for new projects.

Install & scan

$ # Binary download (macOS/Linux/Windows): last release v0.0.15
# https://github.com/opensbom-generator/spdx-sbom-generator/releases

# macOS Homebrew
brew install spdx-sbom-generator
$ # Generate SPDX SBOM for the current project
spdx-sbom-generator -p . -o ./sbom/

# JSON format and SPDX 2.3
spdx-sbom-generator -p . -o ./sbom/ -f json -s 2.3

Run SPDX SBOM Generator in CI

Scan on every push and upload the report as a workflow artifact:

# Note: using Trivy as the recommended modern alternative
- name: Generate SPDX SBOM
  run: trivy fs . --format spdx-json --output sbom.spdx.json

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: spdx-sbom-generator
    path: sbom.spdx.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under SPDX SBOM Generator's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace SPDX SBOM Generator. Keep running it. Vulnetix sits on top of SPDX SBOM Generator (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

SPDX SBOM Generator is strongest at its core category and also carries features in SCA, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What SPDX SBOM Generator does well

• Broad single-tool ecosystem coverage in its day: 11 package managers (Go, Cargo, Composer, .NET, Maven, npm/Yarn, pip/Pipenv, Gems, Swift)
• Auto-detects active package managers and emits SPDX in multiple formats (SPDX tag-value, JSON, RDF in progress)
• Captures license identification (with optional full text) and per-package checksums for integrity
• Distributed under the SPDX/Linux Foundation umbrella with Docker packaging for CI use

Where Vulnetix adds to it: SPDX SBOM Generator is deprecated and generated inventory only, no vuln, malware, VEX or remediation, and its maintainers point users to newer tools (Trivy/Syft/Parlay). Vulnetix generates SBOMs natively (CycloneDX 1.7 + SPDX 2.3) and, more importantly, ingests any SPDX/CycloneDX input to add exploit-intel prioritisation, reachability, versioned VEX, license policy and autofix. Better together where a legacy SPDX feed exists; Vulnetix supplies the modern, supported layer on top.

No migration, no rip-and-replace. SPDX SBOM Generator keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise SPDX SBOM Generator results in Vulnetix

Upload SPDX SBOM Generator SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

SPDX SBOM Generator documentation ↗  ·  Source repository ↗

Wire SPDX SBOM Generator into your CI/CD pipeline →