fatbom
fatbom copied to clipboard
fatbom (Fat Bill Of Materials) is a tool which combines the SBOM generated by various tools into one fat SBOM. Thus leveraging each tool's strength.
**Name of the app** fatbom **Describe the bug** The merged sbom built with the project is invalid. **To Reproduce** While applying [quality checks](https://github.com/interlynk-io/sbomqs) on SBOMs , I found merged spdx...
The license detection is currently meh. Scancode will vastly improve this.
See https://github.com/microsoft/sbom-tool/pull/110#issuecomment-1273604042
Tracked upstream at https://github.com/kubernetes-sigs/bom/issues/169 . For now purls by `bom` would be ignored if the package has been detected by `syft`.