rorixrorix
sign in →

SBOM Formats

A Software Bill of Materials (SBOM) is a complete inventory of all components in your software. Rorix supports two industry-standard SBOM formats.

CycloneDX

CycloneDX is an OWASP project designed for application security and supply chain analysis.

Output Formats

  • JSON (default)
  • XML

What It Includes

  • Component name and version
  • Package URLs (purl) for precise identification
  • License information (SPDX identifiers)

Generate CycloneDX

rorix sbom --format cyclonedx --output sbom.cdx.json

SPDX

SPDX (Software Package Data Exchange) is an ISO/IEC 5962:2021 international standard maintained by the Linux Foundation.

Output Format

  • JSON

What It Includes

  • Package metadata
  • License information with SPDX expressions
  • External references and download locations
  • Document-level metadata (creator, creation date)

Generate SPDX

rorix sbom --format spdx --output sbom.spdx.json

Comparison

| Feature | CycloneDX | SPDX | | --- | --- | --- | | Primary focus | Security and vulnerability tracking | License compliance and provenance | | Vulnerability data | Included in SBOM | Separate VEX documents | | ISO standard | No | Yes (ISO/IEC 5962:2021) | | Government requirements | Supported for NTIA/EO compliance | Supported for NTIA/EO compliance | | Ecosystem support | npm and NuGet | npm and NuGet | | Output formats | JSON | JSON | | Package inventory | Exact manifest dependencies | Exact manifest dependencies |

Which Format Should You Use?

  • CycloneDX is recommended if your primary concern is vulnerability management and security analysis. It embeds vulnerability data directly in the SBOM.
  • SPDX is recommended if you need to meet ISO compliance requirements or if license compliance is your primary concern.

Both formats satisfy U.S. Executive Order 14028 requirements for SBOMs.

Policy Reference