Sending a customer an SBOM is easy. Sending one they can verify, and keeping it consistent across formats, takes some structure. SBOM Studio is Safeguard's workbench for that.
What it is
The product page describes a workbench for authoring and managing software bills of materials. One shared component graph feeds both CycloneDX and SPDX exports, so the formats stay consistent. Each SBOM can carry a Sigstore signature, an in-toto attestation and SLSA provenance metadata.
VEX authoring lets you write statements against components, mark findings not affected with a justification, and publish them, with audit history kept. SBOMs and attached VEX data can be delivered to customers through a portal.
How to use it
- Build or import the component list for the release.
- Export in the format your customer asked for.
- Sign it and attach the provenance data.
- For findings that do not apply, write a VEX statement with a justification.
- Share through the portal, not by email attachment.
What the page does not say
It describes signing but not ingest, diff or labels, so do not assume those exist in this product. Other parts of Safeguard handle SBOM import and comparison, and the docs have an SBOM area for them.
Quick check
Why use one graph for two formats?
So the CycloneDX and SPDX exports stay consistent with each other.
