We are happy to announce the first public release of ocaml-sbom, a tool for generating Software Bills of Materials (SBOMs) for your OPAM-based projects.
Software Bills of Materials are playing an increasingly important role in enterprise and regulated environments where compliance and security are priorities. Producing these reports by hand is impractical, so an automated solution was needed. ocaml-sbom provides exactly that.
ocaml-sbom was developed by @mjambon as part of his collaboration with LexiFi. We are releasing it as open source because we believe it fills an unmet need and will be useful to the wider OCaml community.
The tool invokes opam at runtime and requires OPAM 2.2.0 or later. To install it:
$ opam install ocaml-sbom
Generating an SBOM for your project is a two-step process. First, generate the SBOM in ocaml-sbom’s internal format (this is the longer step). Run the command from the directory containing your *.opam files:
$ ocaml-sbom -o myproject.sbom
Then export the SBOM to one of the supported standard formats (this step is quick). Currently, CycloneDX 1.6, SPDX 2.3.1, and SPDX 3.0 are supported. By default, ocaml-sbom exports to CycloneDX:
$ ocaml-sbom export myproject.sbom -o myproject.cdx
See the README or the --help output for more details.
Note: This is an initial release and should be treated as such. We believe the tool is already useful and shows considerable promise, but it still needs real-world validation before it can be considered production-ready. Feedback is very welcome.
Finally, I’d like to thank @mjambon for his work on this tool.
Happy SBOM-ing!
Cheers,
Nicolas