Choose the generation point

PointWhat it can observeWhat to reconcile
Source and manifestsDeclared dependencies, vendored files, source metadataVersion ranges and unused development dependencies.
Dependency resolutionResolved direct and transitive packagesOptional flags, platforms and private registries.
BuildInputs selected for an actual buildBuild tools versus runtime contents.
Packaging and containersPackaged libraries, OS packages and layersFinal image contents and removed intermediate files.
Binary analysisEvidence in delivered executables and firmwareStripped symbols, static linking and identification confidence.
Deployed or runtimeInstalled or observed loaded componentsPlugins, environment drift and code paths not exercised.

Source: CISA · Tooling and Implementation (SBOM types).

Document the actual tool observation scope. An archive scan may recognize a package but miss a library embedded inside another binary. A resolved dependency graph may include software that never enters the final executable.

A release pipeline

ResolveBuildInventoryValidatePublish
  1. Check out the exact revision and resolve dependencies in the intended environment.
  2. Capture build configuration, target platform, lockfiles and artifact digest.
  3. Run the pinned generator and preserve its version, arguments and output logs.
  4. Add first-party and proprietary component information that discovery cannot supply.
  5. Validate schema, identifiers, graph and reference coverage.
  6. Attach the approved SBOM to the release and publish through authenticated delivery.
  7. Retain failures and exceptions with an owner and correction date.

Treat coverage as an engineering question

Direct dependencies are only the first layer. Test transitive dependencies, vendored source, static libraries, base-image packages and bundled proprietary software. Inspect plugins and runtime downloads separately when they are part of the supported deployment.

Separate build dependencies from shipped runtime components. Both can matter, but combining them without context creates ambiguous vulnerability findings. Record target architecture and optional feature flags: one source revision can produce artifacts with different component inventories.

For embedded products, request inventories from upstream suppliers and link them to the assembled product. A missing supplier inventory is a known gap to investigate, not evidence that no dependencies exist. Keep the boundary and exclusions visible.

A documented tool example

Syft documents SBOM generation from container images and filesystems and output formats including SPDX and CycloneDX. The commands below illustrate its documented output syntax. Pin a reviewed release in your own pipeline and confirm its supported schema versions before adoption.

# Illustrative local artifact scan with Syft
syft dir:./release -o cyclonedx-json=release.cdx.json
syft dir:./release -o spdx-json=release.spdx.json

Source: Syft · Official project documentation.

The example does not execute a scan here or assert completeness. Check that the scanned directory is the delivered artifact and that your receiving tool accepts the emitted version. Prefer a digest-pinned image over a mutable container tag for release evidence.

Why generators disagree

Tools may use different evidence, package catalogs, matching heuristics and deduplication rules. One may read lockfiles, another inspect binaries, and another enumerate installed OS packages. Larger component counts do not automatically mean more accurate coverage.

Compare outputs against a controlled reference manifest, not against each other alone. Classify disagreements as missing expected component, unexpected component, wrong version, ambiguous identity, different granularity or missing relationship. Assign investigation effort to security-relevant differences first.

Maintain the artifact after release

Keep released inventories immutable. A corrected SBOM for the same artifact receives a new inventory revision and links back to its predecessor. A changed software release receives an appropriately bound new inventory. Re-evaluate vulnerability intelligence against retained inventories without pretending a new advisory changes the shipped components.

Before scaling, run one release through intake, querying and response. Generation is successful only when the consumer can use the result. See the quality checks and management workflow for the next steps.

Primary sources