Software Supply Chain

SPDX vs CycloneDX: Which SBOM Standard to Use

A harbor inspector on a wet night pier between an orange-lit dock of stacked crates and a blue searchlit dock, under the title SPDX vs CycloneDX.

SPDX vs CycloneDX compared on standards status, German BSI rules, VEX, license data, tool defaults, and version churn, with real Syft output for each format.

What Is OpenSSF?

Diagram showing the OpenSSF standard and its relationship to other open source standards.

OpenSSF is a cross-industry initiative improving open source software security. Understand why it exists, how it works, and its role in securing the software supply chain.

What Is SBOM?

Diagram showing the SBOM standard and its relationship to other software standards.

SBOM is a Software Bill of Materials listing all components in software. Understand why it exists, how it works, and its role in software supply chains.