Composition (SBOM)
An SBOM — software bill of materials — is the list of what a product is made of. Each library in it, its version, who made it, under what license, its hash and its package address. Customers ask for it to know whether a newly found vulnerability concerns them; the law starts to ask for it too. Cobalt Installer makes it with each build, from the files it installs, so nobody has to fill it in by hand.
Who asks for it
| Who | What |
|---|---|
| The EU | The Cyber Resilience Act: from December 2027 every product with software sold in the EU must have an SBOM, and its maker must take vulnerability reports. |
| The US | Federal customers have asked for one since Executive Order 14028; the NTIA's minimum elements say what goes in it. |
| Germany | BSI TR-03183 says the same for the EU in detail: formats, fields, hashes. |
| Banks, big companies | Their procurement asks for it beside the setup, and their scanners read it. |
The section is always in the list, under Release, but off in a new project: not every product needs it. Turn the switch on, and the SBOM is made with each build.
Formats
Both standard formats, as JSON. Usually both are wanted:
| Format | Standard | File |
|---|---|---|
| SPDX 2.3 | ISO/IEC 5962 — asked for more in the EU | Product-1.0.0.spdx.json |
| CycloneDX 1.6 | ECMA-424 — read more by vulnerability scanners | Product-1.0.0.cdx.json |
The file name is the setup's, without -Setup.
Where it goes
| Where | What it is for |
|---|---|
| Beside the setup | In the build folder next to the setup file: for whoever gets the product — a customer, an authority. |
| In the install folder | Installed with the product, in sbom\ of its folder: the asset tools on the customer's computers find it there. The uninstall takes it away. |
| Both | Beside the setup and in the install folder. |
Report to
The supplier in the SBOM is the publisher of Description. Report to is where to report vulnerabilities: an address (security@example.com) or a page. The CRA asks for it, so Problems says when it is empty.
Components
The section finds the components in the files of Files — nothing to list by hand:
| Found in | What it gives |
|---|---|
| the product | Your own programs: the product itself, by Description. |
| .deps.json | The NuGet packages of a .NET program and its runtime when it is self-contained, with the license from the package. |
| package.json | npm packages of an Electron or Node program. |
| version resource | A DLL's own version, maker and product name. |
| by its name | Well-known libraries by their file names: Ghostscript, FFmpeg, SQLite and the like. |
| Prerequisites | What Prerequisites installs: the .NET runtime, Visual C++, WebView2. |
| supplier's SBOM | Components from a supplier's own SBOM, below. |
| not known | A file nothing is known about: say what it is. |
A license is found in the package, or in a LICENSE or COPYING file next to the files. A component of one file gets its SHA-256 — of the signed file, as it is installed.
The filter above the table shows All, No license, Strong copyleft, Others' and Own, each with its count.
Put it right
Click a component to open its card:
| Field | What it is |
|---|---|
| License | An SPDX id or expression: MIT, Apache-2.0, MIT OR Apache-2.0. For a license of your own, LicenseRef-…. Empty — as found. |
| Supplier | Who made it. |
| purl | The package's universal address, pkg:nuget/Newtonsoft.Json@13.0.3: scanners look for vulnerabilities by it. |
What you say is kept in the project and wins over what is found at the next build.
Strong copyleft
A component under the GPL or AGPL makes you open the source of the whole product to those who use it. The card and Problems say so. Take the component out, or buy a commercial license from its maker and give it here as LicenseRef-…. A choice like GPL-2.0-only OR MIT is not counted: you may take the other one.
Suppliers' SBOMs
If a library's supplier gave its own SBOM, press Add an SBOM and pick it — SPDX or CycloneDX, JSON. Its components go into yours with their licenses and their own components. It is matched to your files by hash, by file name, or by name:
| Mark | Means |
|---|---|
| fits | It is about your files: it goes in. |
| not about your files | No file of yours matches it — another version of the library? It stays out, and Problems says so. |
| the file is gone, can't be read | Pick it again. |
Check it
Problems says what to fix before the SBOM goes out:
- no format chosen;
- no address to report vulnerabilities to;
- components whose license is unknown;
- a component under strong copyleft;
- a supplier's SBOM that is about none of your files, or can't be read.
The files can be checked with the standards' own tools, for example the SPDX online validator or cyclonedx validate --input-file Product-1.0.0.cdx.json.