What is an SBOM?

A Software Bill of Materials is a machine-readable inventory of everything inside your software: libraries, open-source components and their versions. Without this list you simply cannot know whether a newly disclosed vulnerability affects you.

How do I create one?

Free tools like Syft or Trivy generate one in seconds from your build or firmware image. Common formats are CycloneDX and SPDX (both as JSON). KONFORMA reads both.

Do I have to publish it?

No. The SBOM belongs in your technical documentation and must be available to market surveillance authorities on request, it does not have to be public.