CycloneDX/specification

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Supply-chain Levels for Software Artifacts

Open Security Controls Assessment Language (OSCAL)

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

A utility to generate SPDX-compliant Bill of Materials manifests

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

in-toto is a framework to protect supply chain integrity.

GUAC aggregates software security metadata into a high fidelity graph database.