customer questionnaire with Bomdesk
This opens a lockfile with the advisories view first. Fix or explain what a customer would see before you send the file.
- Scan your lockfile with the lookup on.
- Read the advisories first: a customer's scanner will find the same ones.
- Download the SBOM in the format they named.
- Optionally export the Markdown report (Pro) as a cover note.
What to know
Questionnaires usually ask three things: do you produce an SBOM, can we have a copy, and how do you handle vulnerabilities in it. A lockfile gives you the first two in minutes. The third is a process answer, and the advisories list shows what you would be asked about.
Scan before you send. The customer, or their tooling, will run the same advisory check against your file. Having already looked at each finding and either upgraded or have a sentence on why it does not apply turns a worrying file into a reassuring one. The fixed-in version is shown next to each advisory.
State what the file covers. A lockfile SBOM lists what your application depends on at build time; it does not list your operating system image, the runtime or things installed outside the lockfile. Say so in the cover note, and list the runtime version separately (the Runtime support tab checks it against published support dates).
Updated · Cosmovex
Questions
What should I say about vulnerabilities in the list?
That you reviewed them, which are fixed, and which you assessed as not reachable, with a date. Never delete findings from a file you send.
Does a lockfile SBOM cover everything?
No. It covers the packages in that lockfile. Add a note for container images, system packages and anything vendored by hand.
Which format?
The one they ask for. If unspecified, send CycloneDX and offer SPDX.
How often should I regenerate it?
Whenever the lockfile changes in a release you ship, and again before you send it, because new advisories appear for versions that did not have any.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
