To generate an SBOM for a Go project, run an SBOM tool that understands Go modules, such as the OWASP cyclonedx-gomod tool, against your application. Use its app mode for a shipped program, mod mode for a library, and bin mode for a compiled binary. Output is CycloneDX in XML or JSON.
Which mode fits what you ship
The tool has three modes, and the choice changes what ends up in the file.
| Mode | Input | What it lists | Use it for |
|---|---|---|---|
| app | Your main package | Only modules the program actually depends on, with build constraints applied | A service or CLI you deploy |
| mod | The whole module | Every module required by all packages in the module, optionally including test dependencies | A library other teams import |
| bin | A compiled binary | A rudimentary list read from the Go build information in the binary | Software you did not build |
The app mode leaves out modules needed only by tests or by packages the application never imports. That makes it the closest match to what runs in production.
Steps
- Install the tool. Homebrew works, as do prebuilt binaries from the project releases page, or a Go install from source.
- Check out the full repository history. Version detection reads Git, and a shallow clone can give incomplete results for pseudo versions.
- Generate the file for each build target.
cyclonedx-gomod app -json -output sbom.cdx.json -main ./cmd/server
- Validate the result and feed it to your scanner.
JSON is opt in. The default output is XML, so add the JSON option if your pipeline expects JSON.
Build constraints matter
Go resolves modules differently depending on operating system, architecture and cgo settings. The tool reads GOOS, GOARCH, CGO_ENABLED and GOFLAGS, so an SBOM made on a Mac laptop can differ from one made for a Linux container. The project itself recommends one app SBOM per build target. Generate in the same environment variables as your release build.
Known limits
- With vendoring, the SBOM carries no hashes, and license detection can fail because Go does not always copy license files into vendor.
- License detection is off by default. When enabled, detected licenses are recorded as evidence unless you ask the tool to assert them, because detection accuracy cannot be guaranteed.
- Content for app mode can vary with the Go version used to run it, so pin that version in CI.
- For a binary, the embedded information should not be trusted unless you know the binary was not modified.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a component and look at how a direct dependency pulls in transitive ones, which is the same structure a Go SBOM records.
Quick check
Does a Go SBOM include test dependencies?
Not in app mode. In mod mode they are added only if you ask for them.
Why does my SBOM differ between my laptop and CI?
Build constraints and the Go version both affect module selection. Match the environment of your release build.
Safeguard's SBOM and dependency scanning ingests CycloneDX files like this one, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
