bom

What bom does

bom is a command line utility that creates, views, and transforms Software Bills of Materials, commonly called SBOMs. It was created as part of the effort to produce an SBOM for the Kubernetes project, and it lets software authors generate an SBOM for their own projects in a simple but capable way. Under the hood bom can generate SPDX packages from directories, container images, single files, and other sources. It ships a built in license classifier that recognizes the more than 400 licenses in the SPDX catalog, which means a generated document can carry accurate license identification rather than leaving that field blank. The utility also performs Golang dependency analysis and respects .gitignore files when scanning a git repository, so the output reflects the files a project ships. Because it is incubating in the Linux Foundation's Automating Compliance Tooling TAC, bom sits inside a broader compliance ecosystem rather than being a one off script. The README frames it as a general purpose tool, not something limited to Kubernetes, so any Go or mixed language project can use it to produce a standards based inventory that other tools in the supply chain can consume. This breadth is what lets bom serve both developers and the compliance step that later reads the document.

Commands and workflows

The two main subcommands are generate and document. The generate command builds SPDX manifests and currently supports creating an SBOM from files, images, and docker archives, with the ability to pull images from remote registries for analysis. It accepts flags for directories, individual files, archives, images, image archives, an ignore pattern list, a namespace, an output path, and a format that supports JSON and tag value. A notable option exports the SBOM as an in-toto provenance statement, which a later CI stage can complete. The document command works with existing SPDX documents and offers outline and query subcommands so a user can visualize the structure of a document or search it for information. The README gives concrete examples: generating from the current directory with a single argument, processing a container image such as kube-apiserver and expressing each layer as a subpackage, and describing a set of plain files with the file flag. These examples show that bom handles both source trees and built artifacts, which covers the common points where an SBOM is needed in a pipeline. The combination of source tree and built artifact coverage is what lets a team produce one document that satisfies both developers and the compliance step that consumes the SBOM later in the release process.

Installation and ecosystem fit

Installation is a single Go install command that pulls the bom module at the latest version, which keeps the tool easy to add to a CI environment that already has Go available. The project links to its pkg.go.dev page and Go Report Card, and it points contributors to a tutorial on creating a bill of materials that explains what an SBOM is, what the SPDX standard provides, and how to add various sources. Participation follows the Kubernetes Code of Conduct, which places bom inside the governance norms of the wider Kubernetes community. The README closes with logos for the ACT TAC, SPDX, and Kubernetes, reinforcing that bom is a compliance oriented utility rather than a general purpose package manager. For teams adopting supply chain practices, the practical value is that bom produces a recognized SPDX document, classifies licenses automatically, and can emit provenance metadata, all from one small Go binary that fits naturally into existing build and release automation. The pkg.go.dev and Go Report Card links give downstream users a way to inspect the API and code quality before adopting the tool, and the Kubernetes Code of Conduct places contributions inside a familiar governance model. Both links are part of the project's effort to be transparent about quality and process for adopters.

Editorial conclusion

The tool is published under the Apache-2.0 license and its most recent commit was on 2026-08-26.