Building in the open
Product
SBOMFlow follows a release from identity to post-market: every stage adds evidence to the same record, every consequential decision stays human, and every capability below carries its real status. The machine-checked source of truth is the capability matrix in the docs.
Evidence is only defensible if it names exactly what it describes. Every run pins a product and release identity, hashes every scanned file, and records the provenance of every fact — so each claim traces to the exact bytes it came from, and a result can be reproduced long after the release.
SBOMFlow reads real builds — firmware trees (Buildroot, Yocto, Zephyr), container images, lockfiles across the common and the embedded ecosystems (Conan for C/C++, NuGet, npm, pnpm, yarn, bun, Go, Rust, Python, Ruby, PHP, Swift and more), and the SBOMs your suppliers send — and generates validated, reproducible CycloneDX and SPDX from what it observed. Imported supplier data is kept distinct from locally observed evidence, declared and file-based licences resolve into SPDX expressions, and secure-update artifacts (TUF/Uptane metadata, update manifests) are recorded as evidence. Signature material such as cosign and Sigstore bundles is recorded as present — never silently "verified".
Components are correlated against advisories — offline by default, with OSV and NVD as explicit network opt-ins — using version-range-aware matching that shows its own confidence on every finding. Cross-source aliases are reconciled so one real vulnerability is never double-counted; withdrawn advisories are excluded and recorded. KEV, EPSS, SSVC suggestions, and conservative reachability arrive as labelled inputs for human triage. VEX statements are authored from reviewer decisions and supplier VEX (OpenVEX, CSAF) is ingested as context — a supplier's "not affected" never silently closes your finding.
Observed evidence maps to a versioned model of the EU Cyber Resilience Act — Annex I, Annex VII, Article 14 — with technical-documentation workspaces, SBOM field-presence checks against NTIA minimum elements and BSI TR-03183-2, and evidence gaps stated plainly. Manual-only areas are labelled, not failed. Every draft is watermarked UNSIGNED, and nothing is ever filed: the output is an engineering gap assessment, never a conformity conclusion. Additional regime views beyond the CRA ship as an experimental preview.
Findings and evidence flow through a review queue into multi-role sign-off with separation of duties and a configurable approval quorum. Release gates are informational until you enforce a policy — then they block with the exact reason recorded, and you can rehearse any gate with a dry run first. Licence risk gates the same way vulnerabilities do. Time-boxed waivers surface before they expire, and everything lands on an append-only, hash-chained audit trail designed to expose later modification.
SBOMFlow runs in the CI you already have (GitHub Actions, GitLab, Jenkins), exports SARIF and CSV, and syncs findings to GitHub, Jira, ServiceNow, and Dependency-Track — dry-run by default, apply only on explicit opt-in. Gate verdicts land as native annotations on a pull or merge request, offline and output-only. Sealed results from an external AI-assisted scanner can be imported as clearly-labelled, needs-review observations — SBOMFlow never runs the scanner and never re-derives its findings.
This is what makes SBOMFlow a system of record rather than a scanner: a local, content-addressed store keeps every release's evidence. Query it across products and versions, roll up a portfolio view, and compare any two releases — new and resolved findings, component and coverage drift, support-period changes. Past releases can be backfilled as clearly-labelled declared records, never presented as observed. Drift is context for your decisions; it never closes a finding by itself.
Every output is a portable file. A static reviewer console and evidence bundle open in any browser with nothing installed; a no-install auditor package exists for exactly that handoff; a redaction-audited sharing pack covers importers and distributors. Hashes travel with the evidence so a recipient can verify nothing was altered. The assurance passport — a self-contained, hash-attested pack per release with a counts-only decision summary and optional Ed25519 signature, verifiable offline by the recipient — ships today as an experimental preview.
When a new advisory arrives after you ship, the case workflow opens a PSIRT case on an append-only, hash-chained journal: advisory intake with provenance and duplicate detection, correlation against shipped releases into exposure candidates — never automatic "affected" verdicts — human triage, remediation verification against a fixing release, time-boxed risk acceptance, and recorded communications. Advisory exports are watermarked UNSIGNED DRAFTs; SBOMFlow never files, publishes, or sends anything. Interfaces may still change — design partners are shaping this toward production.
AI-enabled products depend on more than packages: models, datasets, prompts, services, and agents ship too. SBOMFlow is extending the same release record to that evidence. Today the 0.4 release line ships the first foundations — release-grade identification of shipped model artifacts from bytes (hashed, never executed or deserialised) with identification strength recorded per artifact — and the standard scanner already surfaces model files as recognised evidence rather than ignoring them. Operator-facing AI evidence commands and standards-based AI/ML BOM output are in engineering with design partners.
What you get
A consistent set of evidence you actually own — portable files, not a black box. Each one is observed evidence pending human review, not proof of compliance.
With inputs and run context pinned, release artifacts are reproducible; opt-in phase durations are explicitly excluded from determinism checks. Many outputs are optional, and any draft declaration is clearly marked unsigned and incomplete for a person to finish. Full inventory: evidence outputs · artifact schemas.
This is our direction, not a commitment. Planned items are not yet available, may change, and imply no delivery date or compliance guarantee.
A first audit runs offline on a laptop and produces a complete evidence pack from your real firmware or software build in minutes.