sbom-diff

Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.

GitHub Action for installing and running sbom-tools — semantic SBOM diff, validation, and quality scoring

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash changes, checks OSV.dev for new vs fixed vulns, and enforces policy. Text/JSON/SARIF/Markdown, GitHub Action.

Homebrew tap for sbomlyze, the fast SBOM diff tool for CycloneDX, SPDX, and Syft—install macOS and Linux releases with brew.

Compare two SBOMs (CycloneDX or SPDX) and check licenses, entirely in your browser. Nothing is uploaded.