SBOM
Also called: software bill of materials, CycloneDX, SPDX
An SBOM is a machine-readable inventory of every component in a piece of software, used to tell quickly whether a newly disclosed vulnerability affects you.
An SBOM (Software Bill of Materials) lists every component, library and dependency in a build, with versions and licences, in a machine-readable format — usually CycloneDX or SPDX.
Its value is speed of answer. When a vulnerability lands in a widely used library, the question “are we affected?” should take seconds, not a week of archaeology. Without an SBOM that question requires reconstructing what shipped.
For an appliance image the inventory is large — the whole OS, not just the application — which is exactly why generating it by hand is not viable and it has to fall out of the build.
SBOMs are increasingly a procurement requirement, particularly for government and regulated buyers.