lunx.docs
DocsSecuritySBOM Guide

SBOM Guide

Generate fully-compliant CycloneDX 1.5 Software Bills of Materials in JSON or XML format. Satisfy SOC 2, NIST SSDF, and US federal SBOM executive order requirements automatically.

What is an SBOM?

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all components, libraries, and dependencies in your software. Like a nutrition label for code — it tells auditors, customers, and security teams exactly what your application is made of.

Since the 2021 US Executive Order on Cybersecurity (EO 14028), SBOMs are required for software sold to US federal agencies. CycloneDX 1.5 is the preferred format.

Generating an SBOM

bash
# Generate during build (recommended)
lunx build    # SBOM written to dist/bom.json automatically

# Generate standalone without building
lunx security sbom

# Specify format and output path
lunx security sbom --format xml --output dist/sbom.xml

Configuration

typescriptlunx.config.ts
export default defineConfig({
  security: {
    generateSBOM: {
      // Output format
      format: 'json',              // 'json' | 'xml'
      outputFile: 'dist/bom.json', // relative to project root

      // Content options
      includeLicenses: true,       // SPDX license identifiers per package
      includeHashes: true,         // SHA-256 of each package tarball
      includeVulnerabilities: true, // embed known CVEs inline in SBOM

      // Metadata
      supplier: 'My Company Inc.',
      authors: [{ name: 'Engineering Team', email: 'eng@example.com' }],
    }
  }
})

Sample SBOM output (CycloneDX 1.5 JSON)

jsondist/bom.json
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2026-05-14T10:31:27Z",
    "tools": [{ "vendor": "Lunx", "name": "lunx", "version": "1.0.0" }],
    "component": {
      "type": "application",
      "name": "my-lunx-app",
      "version": "1.0.0",
      "purl": "pkg:npm/my-lunx-app@1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "react",
      "version": "18.2.0",
      "purl": "pkg:npm/react@18.2.0",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [
        { "alg": "SHA-256", "content": "a3b1..." }
      ]
    }
  ]
}

Verifying an SBOM

bash
# Install the CycloneDX validation CLI
npm install -g @cyclonedx/cyclonedx-npm

# Validate that your SBOM conforms to the spec
cyclonedx validate --input-file dist/bom.json --spec-version 1.5

# Output on success:
# ✓ BOM is valid (CycloneDX Specification 1.5 JSON)
Embed SBOM in GitHub releases
Upload your SBOM as a release asset in GitHub Actions using actions/upload-artifact or the GitHub release API. This makes it available to downstream consumers and satisfies supply-chain transparency requirements.
PreviousCVE DetectionNextPlugins Guide