“spdx”

SBOMs at Scale: SPDX, CycloneDX, and Registry Integration

Generating a bill of materials is easy; operating millions of them is not. This post compares SPDX 2.3/3.0 with CycloneDX 1.5/1.6, shows how to produce SBOMs with syft and Trivy, and covers storing them as OCI artifacts in your registry and querying them at scale.