"How to Generate Your First SBOM in 5 Minutes"

You've decided to generate an SBOM. Good. Now let's do it — in under 5 minutes, with zero configuration.

This tutorial walks you through generating your first SBOM using VulnLedger CLI. No accounts, no setup wizard, no complex configuration. Just one command.

Prerequisites

- Python 3.8+ installed

- A project with dependencies (any language)

- 5 minutes

Step 1: Install VulnLedger

pip install vulnledger

That's it. No configuration files, no API keys, no accounts. The CLI is free and open-source.

Step 2: Navigate to Your Project

cd /path/to/your/project

VulnLedger works with any project that has dependency files:

- Python: requirements.txt, pyproject.toml, Pipfile

- JavaScript: package.json

- Go: go.mod

- Rust: Cargo.toml

- Java: pom.xml, build.gradle

Step 3: Run the Scan

vulnledger scan .

This does two things:

1. Generates a CycloneDX SBOM (lists every dependency)

2. Checks every dependency against OSV.dev for known CVEs

The scan takes 5-30 seconds depending on project size.

Step 4: Review the Output

The scan outputs:

Scanning ./my-project...
Found 247 components
Checking vulnerabilities against OSV.dev...

Results:
  Critical: 2
  High: 5
  Medium: 12
  Low: 8
  Total: 27 vulnerabilities in 247 components

The output tells you:

- How many components your project has

- How many have known vulnerabilities

- The severity breakdown

Step 5: Export as SBOM

For compliance or sharing:

vulnledger scan . --json --output sbom.json

This generates a CycloneDX JSON file with:

- Complete component list with versions

- Package URLs (PURLs) for each component

- License information

- Vulnerability status

What Your SBOM Contains

The generated sbom.json includes:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:...",
  "components": [
    {
      "name": "requests",
      "version": "2.31.0",
      "purl": "pkg:pypi/[email protected]",
      "type": "library",
      "licenses": [{"id": "Apache-2.0"}]
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-35195",
      "severity": "high",
      "description": "...",
      "affects": [{"ref": "pkg:pypi/[email protected]"}]
    }
  ]
}

Language-Specific Examples

Python Project

# Navigate to your Python project
cd my-python-app

# Scan (reads requirements.txt or pyproject.toml automatically)
vulnledger scan .

# Export SBOM
vulnledger scan . --json --output sbom.json

JavaScript Project

# Navigate to your Node.js project
cd my-node-app

# Install dependencies first
npm install

# Scan (reads package.json automatically)
vulnledger scan .

# Export SBOM
vulnledger scan . --json --output sbom.json

Go Project

# Navigate to your Go project
cd my-go-app

# Scan (reads go.mod automatically)
vulnledger scan .

# Export SBOM
vulnledger scan . --json --output sbom.json

Docker Image

# Scan a Docker image
vulnledger scan docker://nginx:latest

# Export SBOM
vulnledger scan docker://nginx:latest --json --output sbom.json

What to Do After Generating Your SBOM

1. Review vulnerabilities — the scan shows CVEs automatically

2. Fix critical issues — upgrade vulnerable packages

3. Add to CI/CD — generate SBOMs on every build

4. Store with releases — attach SBOM to GitHub releases

5. Share with stakeholders — customers and auditors can request it

Automating SBOM Generation

Add to your CI/CD pipeline:

# .github/workflows/sbom.yml
name: SBOM Generation
on: [push, pull_request]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install vulnledger
      - run: vulnledger scan . --json --output sbom.json
      - uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

Now every build generates an SBOM automatically.

Troubleshooting

"No dependencies found" — Make sure you're in the project root directory where your dependency files are.

"Scan failed" — Check that your dependency files are valid (no syntax errors in requirements.txt, package.json, etc.)

"Too many components" — Large projects (1000+ components) take longer to scan. The scan still works, just give it time.

What's Next

After generating your SBOM:

- Check for vulnerabilities — the scan does this automatically

- Set up CI/CD — automate SBOM generation on every build

- Read about compliance — SBOM for Compliance: EU CRA, FDA, NIST

- Compare formats — SBOM Format Comparison: SPDX vs CycloneDX vs SWID

Previous: SBOM: The Document Every Open Source Project Needs

Next: SBOM for Compliance: EU CRA, FDA, NIST