{"id":37130883,"url":"https://github.com/ebay/sbom-scorecard","last_synced_at":"2026-01-14T15:02:41.183Z","repository":{"id":65230545,"uuid":"561538068","full_name":"eBay/sbom-scorecard","owner":"eBay","description":"Generate a score for your sbom to understand if it will actually be useful.","archived":false,"fork":false,"pushed_at":"2024-08-13T08:43:49.000Z","size":4674,"stargazers_count":229,"open_issues_count":8,"forks_count":24,"subscribers_count":11,"default_branch":"main","last_synced_at":"2025-05-07T07:39:47.847Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eBay.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-11-03T22:58:57.000Z","updated_at":"2025-04-21T17:02:43.000Z","dependencies_parsed_at":"2024-01-17T09:21:13.171Z","dependency_job_id":"2ea1dd86-bf7d-4e7f-87bf-df7a4fb5453a","html_url":"https://github.com/eBay/sbom-scorecard","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/eBay/sbom-scorecard","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eBay%2Fsbom-scorecard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eBay%2Fsbom-scorecard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eBay%2Fsbom-scorecard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eBay%2Fsbom-scorecard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eBay","download_url":"https://codeload.github.com/eBay/sbom-scorecard/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eBay%2Fsbom-scorecard/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28424040,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T13:30:50.153Z","status":"ssl_error","status_checked_at":"2026-01-14T13:29:08.907Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-14T15:02:40.377Z","updated_at":"2026-01-14T15:02:41.155Z","avatar_url":"https://github.com/eBay.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SBOM Scorecard\n\n[![Project Status: WIP – Initial development is in progress, but there has not yet been a stable, usable release suitable for the public.](https://www.repostatus.org/badges/latest/wip.svg)](https://www.repostatus.org/#wip)\n\nWhen generating first-party SBOMs, it's hard to know if you're generating something good (e.g. rich metadata that you can query later) or not. This tool hopes to quantify what a well-generated SBOM looks like.\n\nSPDX, CycloneDX and Syft are all in scope for this repo.\n\n![](./usage.gif)\n\n![](./result.png)\n\n## Installation and Usage\n\n1. Download the pre-compiled, platform-appropriate binary from\n   the project's [releases page](https://github.com/eBay/sbom-scorecard/releases) and save it as `sbom-scorecard`.\n2. Install it via go: `go install github.com/ebay/sbom-scorecard/cmd/sbom-scorecard@latest`\n3. Run it from source: `git clone https://github.com/eBay/sbom-scorecard; alias sbom-scorecard=\"go run $PWD/cmd/sbom-scorecard/main.go\"`\n\nFrom there, you can score an SBOM with:\n\n```\nsbom-scorecard score examples/julia.spdx.json\n```\n\nWe do our best to guess the right format, but you can specify it with:\n\n```\nsbom-scorecard score --sbomtype spdx examples/julia.spdx.json\n```\n\nFor other options, run the help subcommand.\n\n```\nsbom-scorecard help\n```\n\n## Scoring.\n\nHere are the metrics by which we score. This is evolving.\n\n1. Is it a spec-compliant?\n2. Does it have information about how it was generated?\n   1. Does it have the software that was used?\n   2. Do we know the version/sha of that software?\n3. For the packages:\n   1. Do they have ids defined (purls, etc)?\n   2. Do they have versions and/or shas?\n   3. Do they have licenses defined?\n\nWe weight these differently.\n\nSpec compliance is weighted 25%.\nInformation about how an sbom was generated is worth 15%.\nThe remaining 60% is split across the packages who are direct dependencies.\n\n### Examples\n\nIn this example, from the Julia project..\n\n```\n34 total packages\n0 total files\n100% have licenses.\n0% have package digest.\n0% have purls.\n0% have CPEs.\n0% have file digest.\nSpec valid? true\n```\n\nThis would result in:\n| Criteria | Result | Points |\n|-----------------|--------|--------|\n| Spec compliant | true | 25/25 |\n| Generation Info | N/A | 15/15 |\n| Packages | | |\n| ...IDs | 0% | 0/20 |\n| ...versions | 0% | 0/20 |\n| ...licenses | 100% | 20/20 |\n\nSo that's 60% (including the whole 15% because we don't have generation info implemented yet)\n\nThis example is from the dropwizard project:\n\n```\n167 total packages\n79% have licenses.\n100% have package digest.\n100% have purls.\n0% have CPEs.\nSpec valid? true\n```\n\nThis results in:\n| Criteria | Result | Points |\n|-----------------|--------------------|--------|\n| Spec compliant | true | 25/25 |\n| Generation Info | N/A | 15/15 |\n| Packages | | |\n| ...IDs | 50% (missing CPEs) | 10/20 |\n| ...versions | 100% | 20/20 |\n| ...licenses | 79% | 16/20 |\n\nSo that's 86% (including the 15% b/c generation info isn't implemented).\n\n## Open Questions\n\n1. Should package info really be split?\n1. Should we break \"license info\" out as it's own top-level criteria?\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Febay%2Fsbom-scorecard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Febay%2Fsbom-scorecard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Febay%2Fsbom-scorecard/lists"}