Go
anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache-2.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#spdx
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
50 records
Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.0Sep 9, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.0Sep 9, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
Apache-2.0Aug 27, 2026 · metrics 2.10.0
Go
guacsec/guac
GUAC aggregates software security metadata into a high fidelity graph database.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Maven · npm
oss-review-toolkit/ort
A suite of tools to automate software compliance checks.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Maven
CycloneDX/cyclonedx-core-java
CycloneDX SBOM Model and Utils for Creating and Validating BOMs
Apache-2.0Oct 19, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-node-npm
Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
spdx/ntia-conformance-checker
Validate SPDX 2 and 3 SBOM against NTIA, CISA, and other minimum element requirements.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
NuGet
CycloneDX/cyclonedx-dotnet
Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
Apache-2.0Oct 11, 2026 · metrics 2.10.0
npm · PyPI
CycloneDX/cyclonedx-javascript-library
Functionality and DataModels of OWASP CycloneDX for JavaScript (Node.js or WebBrowser) written in TypeScript.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Packagist · PyPI
CycloneDX/cyclonedx-php-library
Functionality and DataModels of OWASP CycloneDX for PHP
Apache-2.0Sep 18, 2026 · metrics 2.10.0
PyPI
fsfe/reuse-tool
This is a mirror of https://codeberg.org/fsfe/reuse-tool
Custom licenseSep 12, 2026 · metrics 2.10.0
PyPI
kdeldycke/meta-package-manager
🎁 snapshot every package on your machine to one file, restore it on a new one
GPL-2.0Sep 12, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-webpack-plugin
Generate CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Maven · npm
eclipse-apoapsis/ort-server
A scalable server implementation of the OSS Review Toolkit.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
npm
janbiasi/rollup-plugin-sbom
Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease
MITSep 9, 2026 · metrics 2.10.0
—
package-url/purl-spec
A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
Custom licenseOct 19, 2026 · metrics 2.10.0
Packagist
CycloneDX/cyclonedx-php-composer
Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects
Apache-2.0Sep 14, 2026 · metrics 2.10.0
crates.io
EmbarkStudios/cargo-deny
❌ Cargo plugin for linting your dependencies 🦀
Apache-2.0Oct 20, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-node-yarn
Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
aboutcode-org/scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
Custom licenseSep 12, 2026 · metrics 2.10.0
npm · Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Maven
CycloneDX/cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
Apache-2.0Sep 14, 2026 · metrics 2.10.0
crates.io
EmbarkStudios/cargo-about
📜 Cargo plugin to generate list of all licenses for a crate 🦀
Apache-2.0Aug 23, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-esbuild
Create CycloneDX Software Bill of Materials (SBOM) from projects built with esbuild or Bun.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Go
rezmoss/sbomlyze
Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.
Apache-2.0Sep 12, 2026 · metrics 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
—
CycloneDX/cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
Apache-2.0Oct 20, 2026 · metrics 2.10.0