For CycloneDX, the conventional names are bom.json and bom.xml, plus the patterns with cdx in the name, such as app.cdx.json. A media type can carry a version parameter, for example version equals 1.7. Use stable names so tools and people can find files.
What the spec says
The CycloneDX specification overview lists the conventional file names as bom.json and bom.xml, plus the patterns star dot cdx dot json and star dot cdx dot xml. It also says media types take an optional version parameter, such as version=1.7.
I could not confirm a comparable naming convention for SPDX files from the sources I fetched, so check the SPDX specification before you standardize those names.
A naming scheme that works
A file called bom.json in ten repositories is easy to confuse. Add the thing it describes and the version.
- Use the cdx pattern so tools recognize it: orders-service-2.4.1.cdx.json.
- Put the product or component name first.
- Put the release version second, not a build date alone.
- Keep one SBOM per released artifact.
- Keep the same pattern for every team.
Where to put the file
Common places, each with tradeoffs:
- Next to the artifact in the release or registry entry. Easy to find, travels with the artifact.
- In a central store keyed by product and version. Better for search and governance.
- As an attached attestation to the artifact. Better for integrity, since the file can be signed.
Do not bury the only copy in a CI job log that expires.
Label the type
The file name does not tell a reader what type of SBOM it is. Add that to the metadata or the cover note. The CISA types document names design, source, build, analyzed, deployed and runtime, and a reader needs to know which one they hold. See the six SBOM types.
Versioned media types
If you serve SBOMs over an API, send a media type with the format version, so clients can pick the right parser. Without a version, a client may try to read a 1.7 file with a 1.4 schema and fail in confusing ways.
Quick check
Is bom.json required?
No, it is a convention. Using it or the cdx patterns helps tools find files without configuration.
Should the file name include the version?
Yes. It prevents confusion when several releases are in circulation.
Sources
Last reviewed: 19 October 2026.
