SBOM
Generate signed Software Bills of Materials from the dependencies in your repositories.
OpenHack uses repository dependency data to generate a Software Bill of Materials for an application or service. The artifact records the packages and versions that make up the software, including transitive dependencies resolved from project lockfiles.
Generated SBOMs are signed and can be refreshed as dependencies change, giving engineering, security, and compliance teams a consistent component inventory for reviews and audit workflows.
How it works
- 01
Inventory the repository
Read package manifests and lockfiles to identify the components used by the application.
- 02
Resolve dependency relationships
Include direct packages and the transitive dependencies brought in through them.
- 03
Generate and sign the SBOM
Create a signed artifact that records the available package, version, and dependency information.
- 04
Refresh it as software changes
Generate an updated artifact when the repository's dependency set changes so the inventory remains current.
What it covers
Packages and versions
Record the component names and resolved versions found in the repository's dependency sources.
Dependency relationships
Represent direct and transitive components so reviewers can understand how a package enters the application.
Repository context
Associate the generated inventory with the application or service from which it was created.
Inventory changes
Reflect additions, removals, and version updates when a new SBOM is generated from the repository.
What you get
- A signed Software Bill of Materials
- Direct and transitive package inventory
- Resolved versions and dependency relationships
- An artifact for security and compliance reviews
Get started
Connect a repository to the managed platform to generate a signed component inventory and keep it aligned with dependency changes.