CycloneDX vs SPDX with Bomdesk
This opens a sample lockfile and the download panel. Produce both formats from the same scan, open them side by side, and see the same packages described in two vocabularies.
- Scan a lockfile, or use the sample that is already loaded.
- Download CycloneDX and SPDX.
- Open both: the same packages, described in different vocabularies.
- Send the one the requester names.
What to know
Both formats describe software components, versions and licences in machine-readable form, and both come as JSON. CycloneDX comes from the OWASP community and was built around security use, so it has first-class fields for vulnerabilities and dependency relationships. SPDX comes from the Linux Foundation and grew out of licence compliance; it is also an ISO/IEC standard (5962).
In practice the requester decides. Security teams and scanners often ask for CycloneDX; legal, procurement and some public-sector buyers often ask for SPDX. If nobody says, either is accepted by most tools, and producing both costs nothing.
Bomdesk writes CycloneDX 1.5 and SPDX 2.3. Both files were validated against the official JSON schemas for those versions. The CycloneDX file also carries the advisories found by your scan. Where a licence cannot be written as a valid SPDX expression, the SPDX file says NOASSERTION and keeps the original text in a comment instead of inventing a value.
Updated · Cosmovex
Questions
Which one do customers usually want?
Whichever their form names. When it just says SBOM, CycloneDX JSON is a safe default for application dependencies.
Can I convert between them?
Yes, with tools such as the CycloneDX CLI, but producing both from the source lockfile avoids conversion loss.
What is NOASSERTION?
SPDX's way of saying no statement is made. Bomdesk uses it rather than guessing a licence.
Do both formats list vulnerabilities?
CycloneDX has a vulnerabilities section, and Bomdesk fills it with your scan results. SPDX describes packages and licences; advisories are not part of the core SPDX file.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
