Skip to main content
A Software Bill of Materials (SBOM) is a formal inventory of a piece of software’s components and their provenance. Anaconda produces SBOMs for the conda packages it builds and maintains in accordance with Software Package Data Exchange (SPDX) specifications, version 2.2.1. Each SBOM records the package’s supplier and originator, the artifact’s download location, its declared and concluded licenses, and checksum hash values down to the individual file level, so you can verify exactly what a package contains and where it came from. SBOMs give security, compliance, and procurement teams a standard artifact to work from. Common use cases include:
  • Responding to newly disclosed vulnerabilities by identifying which packages in your environments contain affected components
  • Satisfying audit and regulatory reporting obligations
  • Reviewing the contents of software before approving it for use in your organization

​
Viewing a package’s SBOM

From the package details view, click on a file’s name, then click the File SBOM tab.
Package file SBOM tab
If no SBOM tab appears, there is no SBOM for that package file.

​
Downloading SBOMs programmatically

For compliance workflows that need SBOMs at scale, the SBOM API provides programmatic access to the SBOMs Anaconda has on file for packages on the main and main-x channels. Look up a package by its SHA256 hash, or by its name, channel, platform, and version together. The SBOM API is available to members of organizations with a Business subscription. For more information, see SBOM API.