Generate SBOM Based on Open-Source Packages

Exporting an SBOM

Aikido allows you to export both SBOMs (Software Bill of Materials) and VEX (Vulnerability Exploitability eXchange) files—giving you visibility into your software components (including open-source components), helping you prioritize what actually needs fixing.

Use Cases:

• SBOM Export (CycloneDX 1.6 , SPDX-2.3 or CSV)

  • Share with third-parties during M&A, procurement, or audits (e.g., ISO 27001, SOC2).
  • Regulatory compliance with regulations like the Cyber Resilience Act (CRA), Medical Device Regulation (MDR) or Executive Order 14028.
  • Feed into third-party risk or procurement tools.
• VEX Export (CycloneDX only)

  • Clearly flag which vulnerabilities are exploitable and which are not applicable.
  • Attestation of due diligence, a VEX proves to third-parties that you are actively managing kown vulnerabilities.

Where to find the SBOM

Step 1. Go to Reports > Licenses & SBOM

Step 2. Download SPDX, CycloneDX, or CSV SBOM via the top right action

Python package license risks overview with filters and SBOM download option.

Optional. Filter licenses on different parameters and export the SBOM after. The export takes into account the chosen filter values.

Filter menu for searching repositories by license, language, risk, and container options.

If you want to filter on team, you can do this via changing the Team Filter on the top of the page.

Team selection dropdown for viewing Licenses & SBOM reports.

If you have multi-branch scanning enabled, you can get different SBOMs per branch by selecting the specific branch repo in the dropdown. Contact us via in-app chat for more info.

Generate and export via API

Generate and download your SBOM via our Export SBOM API.

Monitoring self-generated SBOMs

Embedded systems built using tools like Buildroot or Yocto can generate the SBOM at build time. Since these systems often lack a standard container registry, you can upload these self-generated SBOMs to Aikido via the API to monitor supply-chain security and license compliance.

Generating your SBOM via Buildroot / Yocto

Buildroot

Buildroot generates a CycloneDX SBOM via its built-in generate-cyclonedx utility, which consumes the output of make show-info.

1

Generate the SBOM

Run the following command:

make show-info | utils/generate-cyclonedx > sbom.cdx.json

This produces a single CycloneDX JSON file listing every package in your embedded Linux system together with its version, license, and source information.

Yocto SPDX 2.2 Engine

Upload the SBOM to Aikido

Use the Upload Container SBOM API to push the generated file. See the API authorization docs for details on obtaining and using your API key.

#Prevents word splitting of the JSON file
SBOM=$(cat /path/to/sbom.spdx.json)

# Accepts both CycloneDX and SPDX in JSON formats
curl -X POST "https://app.aikido.dev/api/public/v1/containers/sbom" \
  -H "accept: application/json" \
  -H "Authorization: Bearer $AIKIDO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"sbom\": $SBOM, \"container_image_name\": \"$YOUR_CONTAINER_NAME\"}"

Aikido will list the uploaded SBOM under Containers with the registry Self-reported SBOM and automatically begin scanning for vulnerabilities and license risks.