SBOM Lens
Drop a release-level SPDX document plus its component SBOMs and navigate the whole
supply chain as one tree: release → component → sub-component → container image →
package. Everything runs in your browser; files never leave your machine.
Try it: https://sbom-lens.everbright-it.de/app/. The project landing
page lives at https://sbom-lens.everbright-it.de/. The VS Code extension is
on Open VSX.
Two products ship from this monorepo. This page is about SBOM Lens,
the SPDX viewer. Its sibling OCM Lens reads Open Component Model
deliveries (CTF and component archives, signature verification included)
and has its own product home:
repository ·
landing ·
Open VSX.
Issues for both products live in this repo's tracker.
Regenerate with npm run screenshot -w @sbomlens/web (dev server running).
Why SBOM Lens
- Cascading documents are first-class. SPDX 2.3 links documents via
ExternalDocumentRef and cross-document relationships
(DocumentRef-X:SPDXRef-Y). SBOM Lens resolves those references across every
file you load, by checksum first and then namespace, and renders one continuous,
lazily-expanded tree across document boundaries. Unresolved references appear as
actionable placeholders: fetch them by URL, drop the file, or confirm a
suggested match.
- Fast at real-world scale. Multi-megabyte documents (6,500+ packages) parse
in a Web Worker; the tree and source views are virtualized; search runs against
a prebuilt index with ranked results. No pagination, no jank.
- Private by design. A static, client-only app. SBOMs are parsed locally and
never uploaded. URL fetching only happens when you explicitly ask for it.
- Honest about dirty data. Real SBOMs have quirks: checksum spacing variants,
duplicate SPDXIDs, references without relationships, unknown relationship
types, versions hiding in purls. The parser tolerates all of it and reports
what it found as per-document diagnostics instead of refusing to load.
- Answers questions, not just files. Beyond browsing: an exportable
cross-cascade inventory, version-conflict detection, release-to-release
diffs, and a per-document NTIA quality report.
- Useful for Cyber Resilience Act work. Search every loaded SBOM by name,
purl or CPE to answer the first question of an Article 14 early warning:
which of our products contain the exploited component? A purl or CPE
matches by identity, so an advisory's versionless identifier finds every
version you ship and nothing that merely shares a name prefix.
Measure SBOMs against BSI TR-03183-2 and read suppliers' CSAF advisories
next to them. docs/cra.md maps the obligations onto these
features and says what SBOM Lens does not do.
Quick start
git clone https://gitlab.com/everbrightit-group/sbom-lens.git
cd sbom-lens
npm ci
npm run dev # → http://localhost:5173
Click Load example for a bundled four-document demo cascade, or drop your own
.spdx / .spdx.json files (multi-select and whole folders work).
Loading documents
| Method | Notes |
|---|
| Drag & drop | Anywhere in the window; folders are walked recursively |
| Open ▸ Files / Folder | Standard pickers |
| Open ▸ From URL | Fetches a document over HTTP(S), e.g. from a GitLab generic package registry |
?url= deep link | https://sbom-lens.everbright-it.de/app/?url=<sbom-url> opens a document straight from the address bar. Repeatable, so a cascade travels in one link |
| Placeholder ▸ Fetch | Each unresolved reference offers a one-click fetch of its recorded URL |
| Fetch all (status bar) | Downloads every referenced document recursively until the cascade is complete. One click for the full tree instead of one per placeholder. A fetched document only pulls in references on its own host; a reference to another host stays a placeholder until the next click |
Access tokens: for private registries, add a per-host token in the URL dialog
(GitLab PRIVATE-TOKEN or Authorization: Bearer). Tokens live in
sessionStorage only: they die with the tab and are never persisted. A token
goes to the host it was stored for and nowhere else: in the browser a fetch ends
at a redirect, and the VS Code extension follows redirects only to https and
without the token.
Deep links make an SBOM linkable: a README, a release note or a registry
page can point at "this document, rendered" instead of "download this file,
then find a viewer". Repeat the parameter for a whole cascade:
https://sbom-lens.everbright-it.de/app/?url=<release.spdx.json>&url=<component.spdx.json>
A deep link is input from whoever sent it, so five rules apply, and they are
pinned by tests rather than left to review:
以上為 README 的開頭部分。其餘內容請閱讀原文。 檢視完整 README ↗
