---
title: Apps Need to Provide Their Own SBOM - Codenotary
description: MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®
image: https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/chub_backup/AgentMon%20Start.svg) **AgentMon Start** See what your AI agents are doing on your machine. TRY NOW →](https://codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 Jan 04, 2023

# Apps Need to Provide Their Own SBOM

 By  [Dennis](https://codenotary.com/blog/author/dennis)  ·   2 minute read

Software Bill of Materials (SBOM) isn’t a particularly complex concept: it’s a manifest that identifies the components that make up a particular software artifact. It’s like the list of ingredients of a cake. Accordingly, for applications an SBOM is a list of all the ingredients or components that went into building the app. 

While SBOMs aren’t a new thing, they have lately become very important because of a surge of software supply chain attacks that have made our most critical government and businesses vulnerable to ill-intentioned actors (state and criminal). A good example is the supply chain vulnerability thru Log4j, a highly popular logging framework, which infected hundreds of thousands of applications and the businesses and governments running them. 

When the log4j supply chain vulnerability was discovered in December 2021, the first question of every CIO was “how can I find all instances of this log4j library in the hundreds or thousands of applications in my business?”. In other words, every organization wants to know which applications to trust and which ones to sanitize immediately.

However, traditional SBOMs are just a snapshot in time of the list of components of an app. It needs to be kept up to date and provided with the application every time a simple update or patch to the application is performed. What guarantee do we have that the SBOM is truly up to date and that it includes the true, full list of contents of an application? None. 

But wait, it gets even more complicated! Some applications update themselves at runtime. Or even think of serverless applications that only run for a short period of time. Who generates an SBOM for an application that self-updates?

If we had a true and trustworthy SBOM of every application available, then it’s a simple and fast search. So, how to obtain an SBOM for the apps we use?

We at Codenotary have created a patent-pending solution to both these questions and thus guarantee that an SBOM of an app is always:

a) a true reflection of the components of an application, even when it self-updates, and 

b) the SBOM is not some file that is stored separately from the application, 

but rather it’s the application itself that – on authenticated request – will export its own SBOM or list of ingredients 

#### How do we do that

**By simply adding 2 lines of code to your source code**

That enables any developer to add automatic SBOM export to applications and they always travel with them. We call it **TrueSBOM**.

Let’s look into a Python and a Golang example:

**Python**

```
import truesbom
truesbom.start_http_server(8001)
```

**Go**

```
go truesbom.Start_http_Handler(":8001")
```

What are the **benefits** of using TrueSBOM?:

- Always updated SBOM
- Runtime changes of dependency usage
- Diff between compile SBOM and actual runtime SBOM
- Alert on dependency on change events
- Works for open-source and closed source
- Machine-readable for automation
- Great in combination with serverless applications

#### How does it work

When the application reaches its destination (i. E. the customer) the SBOM can always be retrieved by accessing the system on Port 8001 (in the example above). The result is machine-readable and can be used to collect, compare and update the central SBOM information.

The minimal SBOM structure looks like this:

- Supplier name
- Component name
- Version of the component
- Cryptographic hash of the component
- Any other unique identifier
- Dependency relationship
- Author of the SBOM data

TrueSBOM also allows the enrichment of the SBOMs with vulnerability scanner results or trust and integrity information.

Example output:

```
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "vendor": "Codenotary",
        "name": "vcn",
        "version": "v1.0.2-dev"
      }
    ],
    "component": {
      "type": "application",
      "name": "."
    }
  },
  "components": [
    {
      "bom-ref": ".-1",
      "type": "library",
      "name": "github.com/rakyll/statik",
      "version": "v0.1.7",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "385dd009952ec8fc6e1843fb078ca951aeec07f887b6a3930d865718cf0a39d4"
        }
      ],
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:golang/github.com%!F(MISSING)rakyll%!F(MISSING)statik@v0.1.7",
      "properties": [
        {
          "name": "LinkType",
          "value": "direct"
        },
        {
          "name": "TrustLevel",
          "value": "TRUSTED"
        }
      ]
    }
  ]
}
```

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/apps-need-to-provide-their-own-sbom&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/apps-need-to-provide-their-own-sbom&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/apps-need-to-provide-their-own-sbom&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/apps-need-to-provide-their-own-sbom&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/apps-need-to-provide-their-own-sbom&utm_medium=social&utm_source=pinterest&media=)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dennis",
    "url" : "https://codenotary.com/blog/author/dennis"
  },
  "dateModified" : "2023-02-14T21:05:36.524Z",
  "datePublished" : "2023-01-04T01:39:28.000Z",
  "headline" : "Apps Need to Provide Their Own SBOM - Codenotary",
  "image" : [ "https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/apps-need-to-provide-their-own-sbom",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "Dennis" ],
    "url" : "https://codenotary.com/blog/author/dennis"
  },
  "datePublished" : "2023-01-04T01:39:28+0000",
  "description" : "MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®",
  "headline" : "Apps Need to Provide Their Own SBOM",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/apps-need-to-provide-their-own-sbom"
}
```