CycloneDX

CycloneDX is an open standard for bills of materials, created in the OWASP community and also published by Ecma International as ECMA-424. A CycloneDX document lists the components in a piece of software, with their versions, identifiers, licenses and relationships, in JSON, XML or Protocol Buffers.

What it is

CycloneDX started as a software bill of materials (SBOM) format and has grown to cover other inventories, such as SaaSBOM for services and HBOM for hardware. It can also carry vulnerability information, which makes it usable for VEX (statements about whether a known vulnerability actually affects a product).

A minimal CycloneDX JSON SBOM looks like this:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "metadata": { "component": { "name": "checkout", "version": "2.4.0" } },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.19.2",
      "purl": "pkg:npm/[email protected]",
      "licenses": [{ "license": { "id": "MIT" } }]
    }
  ]
}

bomFormat and specVersion identify the document. Each component has a type, a name and version, and usually a package URL (purl) and license IDs from the SPDX license list.

Why it matters

A standard format means the SBOM your build tool writes can be read by your vulnerability scanner, your license checker and your customers' tools without conversion. Most SBOM generators in common ecosystems can write CycloneDX.

In AI CodeOps

AI CodeOps uses CycloneDX in two places.

SBOM records. When you record a project's SBOM, format is cyclonedx (or spdx) and formatVersion is the document's specVersion. You also send a licenseSummary, the count of components per license, which you build from the file's licenses entries:

{ "format": "cyclonedx", "formatVersion": "1.5", "licenseSummary": { "MIT": 301, "Apache-2.0": 74 } }

That summary is what the release check's license policy reads. AI CodeOps doesn't parse the file at recording time, so make the summary from the same file whose SHA-256 you record. The full request is on the Security and SBOM page.

The SBOM viewer. The free SBOM viewer opens a CycloneDX JSON file in your browser. It checks for "bomFormat": "CycloneDX", shows the spec version, the subject from metadata.component and the component count, and lists every component (including nested ones) with its version, type, licenses and purl. You can filter the list by text. SPDX files aren't supported in the viewer yet.

Related terms

• SBOM: the inventory CycloneDX describes.
• Software composition analysis (SCA): the tools that usually write CycloneDX files.
• License policy: rules checked against the licenses a CycloneDX file lists.