# Software Bill of Materials

DevFeed: [Software Bill of Materials](<https://devfeed.tech/articles/software-bill-of-materials-13961.md>)

Original publisher: [Read original article](<https://developer.espressif.com/blog/software-bill-of-materials/>)

Author: John Lee

Published: 2023-11-02T00:00:00Z

Content type: tutorial

Language: en

Sources: [Blog on Developer Portal](<https://devfeed.tech/sources/blog-on-developer-portal.md>)

Topics: [software bill of materials](<https://devfeed.tech/topics/software-bill-of-materials.md>), [ESP-IDF](<https://devfeed.tech/topics/esp-idf.md>), [Espressif](<https://devfeed.tech/topics/espressif.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [NVD](<https://devfeed.tech/topics/nvd.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [esp-idf](<https://devfeed.tech/tags/esp-idf.md>), [esp32](<https://devfeed.tech/tags/esp32.md>), [espressif](<https://devfeed.tech/tags/espressif.md>), [iot](<https://devfeed.tech/tags/iot.md>), [nvd](<https://devfeed.tech/tags/nvd.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [spdx](<https://devfeed.tech/tags/spdx.md>), [tools](<https://devfeed.tech/tags/tools.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This article introduces software bills of materials (SBOMs), explains their structure and formats such as SPDX and CycloneDX, and presents Espressif's ESP-IDF-SBOM tool. The tool generates SPDX SBOMs for ESP-IDF-based applications and checks them against the National Vulnerability Database for known vulnerabilities.

## Source excerpt

Overview# The "software bill of materials" (SBOM) has emerged as a key building block in software security and software supply chain risk management. An SBOM is a comprehensive list of all the software components, dependencies, and metadata associated with an application. Espressif believes that this information is a key step towards ensuring the security of the connected devices. And as such, we have now enabled easy to use tools and solutions to track and analyze this information.