Generate a software bill of materials

PREREQUISITEAt least one repository that scans for dependencies through Semgrep Supply Chain. See Scan third-party dependencies.

Generate a software bill of materials (SBOM) to assess your third-party dependencies and comply with auditing procedures. Semgrep Supply Chain (SSC) can generate an SBOM for each repository you have added to Semgrep AppSec Platform. When generating an SBOM, Semgrep uses:

The vulnerability information from the default branch for the project
The dependency information from the latest full scan for the project.

Supported standards and formats

Semgrep Supply Chain supports the following SBOM formats:

CycloneDX 1.4 JSON
CycloneDX 1.4 XML

Generate and download an SBOM for a single project

SBOM generation can be performed through Semgrep AppSec Platform or the Semgrep API.

In Semgrep AppSec Platform, go to Supply Chain > Dependencies.

Click the Download icon next to the repository you want an SBOM for.

Click the format you want the SBOM to be in. After clicking, refresh or leave the page only after the SBOM has been generated.

Once Semgrep has generated the SBOM, click the link on the toaster notification to download it.

You have successfully downloaded an SBOM.

SUPPLY CHAIN SCANS ON NON-PRIMARY BRANCHESTypically, full scans are run only on primary (default) branches. However, if your workflow differs and you run full scans on non-primary branches, this can create a mismatch between dependencies and vulnerabilities in the generated SBOM. To avoid the mismatch, ensure that the latest full scan runs on the primary branch of the repository for which you want to generate an SBOM.

Generate an SBOM through the API

Refer to the Semgrep API > SBOM documentation.

Semgrep-specific SBOM data fields

In addition to the minimum elements that define an SBOM, Semgrep provides additional metadata in the vulnerabilities field. Nested under the vulnerabilities field is a list of data objects describing a specific vulnerability. Each data object contains the following data fields:

Semgrep-specific field	Description
Advisories	Links to GitHub or NIST advisories about the specific vulnerability.
Affects	The name and version of the package that the vulnerability affects.
Analysis	Semgrep’s analysis of this vulnerability in your supply chain. Under analysis are `state` and `justification` fields, which describe if your codebase is affected by the vulnerability and why Semgrep thinks it is or is not affected.
CWEs	The assigned CWE (common weakness enumeration) number.
Description	A short description of the vulnerability.
Detail	A longer description of the vulnerability, including the affected versions.
Ratings	Semgrep Supply Chain’s severity rating of this vulnerability.
References	Links to the specific CVE. References can come from NIST, Electron release notes, and GitHub Security .
	The primary source of this vulnerability’s advisory.
Tools	Details about Semgrep, the tool used to generate the SBOM.

License compliance Overview

⌘I

​Supported standards and formats

​Generate and download an SBOM for a single project

​Generate an SBOM through the API

​Semgrep-specific SBOM data fields

Supported standards and formats

Generate and download an SBOM for a single project

Generate an SBOM through the API

Semgrep-specific SBOM data fields