Security · Flashcard
What is a Software Bill of Materials (SBOM)?
- AA machine-readable inventory of the components in an artifact, their versions and relationships
- BA signed record of who built an artifact and which steps and inputs produced it
- CA ranked report of the known vulnerabilities affecting an application's dependencies
- DA policy document listing which open-source licenses a project is permitted to use
Why this is the answer
An SBOM answers what is inside an artifact — which components, at which versions, related how. Who built it and how is provenance, carried by a separate attestation. A vulnerability report is derived by matching an SBOM against advisory data; it is an output, not the SBOM. A license policy states what is permitted, whereas an SBOM only records what is actually present.
Official docs