--- title: Creating a Standard Compliant SBOM from a Distributions Package Manager description: Exploring the role of Linux package managers in generating standard-compliant Software Bill of Materials (SBOMs) for enhanced cybersecurity image: https://codenotary.com/hubfs/CN-Assets%20(66).png --- **$ protect --distro linux --machines 25 --free** [Start now](https://apps.codenotary.com/linux) [![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/) - Product #### [![AgentMon Start](https://codenotary.com/hubfs/AgentMon%20Start.svg) **AgentMon Start** Organization-wide AI agent spend, security and device fleet TRY NOW →](https://apps.codenotary.com/agentmon-start) #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon) #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control) #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust) - Use Cases #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk) #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops) #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance) #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost) #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security) #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit) - [Blog](https://codenotary.com/blog) - [Press](https://codenotary.com/press) - Resources #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations) #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com) #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success) #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn) [Login](https://apps.codenotary.com/auth/login) [All posts](https://codenotary.com/blog/all) May 16, 2024 # Creating a Standard Compliant SBOM from a Distributions Package Manager By  [blog](https://codenotary.com/blog/author/blog)  ·  2 minute read SBOMs (i.e., Software Bill of Materials) have quickly become the conduit for CyberSecurity professionals to create a basis for the analysis of the components and their vulnerabilities. While dozens of tools exist to create SBOMs for software repositories, containers, and software packages (think JAR files), the question often arises: is a Linux distribution’s package manager a sort of SBOM? In this blog post, we propose several answers to this question. ![CN-Assets (66)](https://codenotary.com/hs-fs/hubfs/CN-Assets%20(66).png?width=1200&height=630&name=CN-Assets%20(66).png) **What is an SBOM?** An SBOM is essentially a detailed inventory of all software components and dependencies used within an application or system. It details versions, licenses, and other crucial information that can be used to monitor software components for vulnerabilities or licensing issues. **Importance of SBOMs** The importance of SBOMs in cybersecurity cannot be understated. They provide: - Visibility: Knowing exactly what software components are in your systems. - Security: Identifying potential security vulnerabilities within those components. - Compliance: Ensuring all software complies with licensing and regulatory standards. **Generating an SBOM from Linux Package Managers** It is certainly possible to generate an SBOM from a Linux distribution package manager. Linux distributions such as Ubuntu, Debian, Fedora, and Arch Linux use package managers like APT, DNF, and Pacman, which can be leveraged to generate SBOMs. But how do you create an SBOM for these package managers? Below, we show an example of how to create a standards-compliant CycloneDX SBOM from the Debian and Ubuntu package manager, APT: APT (Advanced Package Tool) is the package manager used by Debian and its derivatives like Ubuntu. To generate an SBOM, you can list all installed packages and their versions using APT commands: `dpkg -l > debian-sbom.txt` RPM-based distributions can use the following command: `rpm -qa | sort > rpm-sbom.txt` However, this is an extremely simple SBOM and certainly not compliant with the CycloneDX and SPDX standards. Instead, here is our recipe to create a standard-compliant CycloneDX SBOM: **Install Necessary Tools** First, you need to install a tool that can generate a CycloneDX SBOM from package data. There is a nice Python package that you can use, Distro2SBOM ([https://pypi.org/project/distro2sbom/](https://pypi.org/project/distro2sbom/)): `pip install distro2sbom`**Generate Package List and the SBOM** Use `dpkg -l` to generate a list of installed packages or `rpm -qa | sort`. `distro2sbom --distro deb --name --release --input-file --sbom cyclonedx --output-file ` Example: `distro2sbom --distro deb --name Debian --release 11 --input-file /tmp/debian11.list --sbom cyclonedx --output-file /tmp/debian11.json` Or you can use `distro2sbom` if you are on the system you want to generate the SBOM from: `distro2sbom --distro deb --system --format json --output-file /tmp/debian11.json`In case you are using [AlmaLinux](https://almalinux.org/), there is also another project worth a try: [https://github.com/AlmaLinux/alma-sbom](https://github.com/AlmaLinux/alma-sbom) Running `python alma_sbom.py --file-format cyclonedx-json --build-id 4372`will produce a CycloneDX SBOM as well. `Validate the SBOM Optionally, you can use the CycloneDX CLI (https://github.com/CycloneDX/cyclonedx-cli) or other tools to validate the generated SBOM file to ensure it meets the specification's standards.` `cyclonedx-cli validate -i /tmp/debian11.json -o report.json` `Once the validation comes out successful, you can now upload this standard-compliant SBOM to a vulnerability checking and risk factoring service, like the free service https://SBOM.sh to obtain a result like the one shown in the example below:` ![CN-Assets (32)](https://codenotary.com/hs-fs/hubfs/CN-Assets%20(32).png?width=3456&height=1728&name=CN-Assets%20(32).png) [![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager&utm_medium=social&utm_source=pinterest&media=) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "blog", "url" : "https://codenotary.com/blog/author/blog" }, "dateModified" : "2024-06-24T12:31:58.181Z", "datePublished" : "2024-05-16T07:40:51.000Z", "headline" : "Creating a Standard Compliant SBOM from a Distributions Package Manager", "image" : [ "https://codenotary.com/hubfs/CN-Assets%20(66).png" ], "mainEntityOfPage" : { "@id" : "https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://codenotary.com/hubfs/logo-light.svg" }, "name" : "Codenotary, Inc." } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "blog" ], "url" : "https://codenotary.com/blog/author/blog" }, "datePublished" : "2024-05-16T07:40:51+0000", "description" : "Exploring the role of Linux package managers in generating standard-compliant Software Bill of Materials (SBOMs) for enhanced cybersecurity", "headline" : "Creating a Standard Compliant SBOM from a Distributions Package Manager", "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/CN-Assets%20%2866%29.png", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg" }, "name" : "" }, "url" : "https://codenotary.com/blog/creating-a-standard-compliant-sbom-from-a-distributions-package-manager" } ```