The CRA requires manufacturers to produce and maintain a software bill of materials. KONFORMA turns that into a self-service step: connect your code, get a release-specific inventory, and see how complete it is.
Connect a repository to pull the inventory GitHub already generates, or upload a CycloneDX/SPDX file directly, your source code never leaves your environment.
A readiness score tells you whether your inventory is actually complete enough to stand behind, not just how many packages were found.
Firmware 2.4 and Firmware 2.5 of the same product can have different components. Each release keeps its own inventory instead of one inventory averaged across versions.
Beyond package-manager metadata, components are matched against a curated database so embedded and firmware components aren’t missed.
CycloneDX and SPDX imports, plus direct GitHub connection which builds an inventory from your repository’s dependency data.
No. On GitHub import, KONFORMA fetches the software inventory GitHub already generates, not your code.
Yes. Components are matched against a curated database built specifically to catch embedded and C/C++ libraries that package-manager metadata alone would miss.