The SBOM & VEX Working Group (SBOM-VEX-WG) is a Sandbox-level working group of the Open Source Security Foundation (OpenSSF).
We are a format-agnostic, neutral forum that unites tool builders, software producers, end-users, and standards bodies to drive the practical adoption, harmonization, and maturity of Software Bills of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) across the open source ecosystem.
- Read the charter for the group's mission, scope, and governance.
- Join the OpenSSF Slack and say hi in the working group channel, #wg-sbom-vex.
- Attend a call. All meetings are on the OpenSSF Community Calendar. See Meeting Times below.
- Contribute by opening an issue or a pull request in this repository, or in one of the hosted projects.
Our objective is to bridge the gap between specification and application: transforming community energy into actionable guidance, interoperable tooling, and automated supply chain security outcomes.
The full mission statement is in the charter.
The working group structures its initiatives, hosted projects, and community engagement around three pillars (see the charter for details):
- Formats and Standards. A neutral ground to map implementation gaps, capture emerging requirements, and drive the effective application of SPDX, CycloneDX, CSAF, and OpenVEX. We foster interoperability across formats ("Pax Interoperabilitatis"), support the evolution of the VEX metaspec and best practices for SBOM generation in product lifecycles, and maintain feedback loops with external standards bodies.
- Technical Initiatives. We incubate, host, and maintain developer-focused tools that automate the generation, consumption, validation, and enrichment of SBOM and VEX artifacts, and we support emerging domain-specific tools such as those extending SBOMs into data and AI.
- Education and Adoption. We author guides and playbooks, benchmark tooling, and cultivate open forums to lower the barrier to entry for software transparency, for both producers and downstream consumers.
Software transparency underpins multiple facets of security and compliance. To keep our work grounded, we position every effort along two axes. The first axis is the audience we serve: education (guidance, training, and community enablement for practitioners) and industry (tooling, standards, and engineering outcomes for producers and consumers).
The second axis is the set of four anchors where SBOM and VEX data create value: Compliance & Policy, AI, Supply Chain Security, and Vulnerability Management. Each anchor maps to a sister OpenSSF working group we collaborate with.
| Anchor | Education | Industry | Sister WG |
|---|---|---|---|
| Compliance & Policy | Plain-language guides that translate international software transparency regulations and compliance mandates (e.g. the EU Cyber Resilience Act, US federal guidance) into what developers and stewards actually need to produce. | Act as an agile technical responder to regulatory frameworks; map regulatory requirements to concrete SBOM and VEX fields and tooling so that conformance can be automated. | Global Cyber Policy |
| AI | Educational material on software transparency for models, datasets, and AI systems, and how existing SBOM formats express them (e.g. AIBOM). | Design, validate, and expand SBOM and VEX paradigms into data and machine learning domains; support domain-specific tools and feed requirements back to the format communities. | AI/ML Security |
| Supply Chain Security | Playbooks for generating, distributing, and consuming SBOMs across the software lifecycle, and benchmarking criteria to help adopters choose tools. | Host and maintain foundational SBOM tooling (Protobom, bomctl, BOMHort); define how SBOM and VEX artifacts integrate with attestation, provenance, and secure build pipelines. | Supply Chain Integrity |
| Vulnerability Management | Guidance for upstream projects on issuing VEX statements and for downstream consumers on ingesting them, including troubleshooting and peer-to-peer enablement. | Maintain OpenVEX and support the VEX metaspec across CSAF, CycloneDX, OpenVEX, and SPDX; align VEX data structures with coordinated vulnerability disclosure and advisory workflows. | Vulnerability Disclosures |
The working group provides governance, maintenance, and roadmap support for the following projects. Project progression from Sandbox to Incubating to Graduated follows the OpenSSF TAC project lifecycle.
| Project | Description | Repository | Slack | Meeting |
|---|---|---|---|---|
| Protobom | A universal SBOM representation in protocol buffers, with a Go library to read, write, and translate between SPDX and CycloneDX. | protobom/protobom | #protobom | Every other Wednesday, 12:00 PM CT / 1:00 PM ET / 10:00 AM PT |
| bomctl | Format-agnostic SBOM tooling that bridges the gap between SBOM generation and analysis tools, built on Protobom. | bomctl/bomctl | #bomctl | TBD |
| BOMHort | A standalone, Kubernetes-native SBOM visualization and governance platform. | seebom-labs/BOMHort | TBD | TBD |
| OpenVEX | A minimal, compliant, interoperable, and embeddable implementation of VEX, with the vexctl tooling. |
openvex · ossf/OpenVEX | #openssf-sig-openvex | Discussed in the VEX Call, see Meeting Times |
Previous SBOM community work that this working group continues can be found in the SBOM Everywhere SIG repository.
Anyone is welcome to join. The group is open to participation from anyone who abides by the OpenSSF Code of Conduct, OpenSSF member or not.
- Slack: #wg-sbom-vex is the working group's channel. Topic-specific discussion also happens in #sig-sbom-everywhere for SBOM and #openssf-sig-openvex for VEX. Join the workspace at https://slack.openssf.org/.
- Calendar: OpenSSF Community Calendar (Zoom links are in each invite).
- Issues: file issues in this repository for working group matters, or in the relevant hosted project for tooling and specification matters.
The working group uses a multi-tiered meeting structure. All calls are open to everyone and are listed on the OpenSSF Community Calendar, which is the source of truth for dates, Zoom links, and cancellations. Times are shown in US Eastern and US Pacific time and shift with daylight saving time.
| Meeting | Cadence | Time | Notes | Slack | Mailing List |
|---|---|---|---|---|---|
| SBOM Call (calendar: SBOM Everywhere SIG) | Every other Friday | 11:05 AM ET / 8:05 AM PT | Meeting Notes | #sig-sbom-everywhere | openssf-sig-sbom |
| VEX Call (calendar: VEX SIG) | Every other Monday | 3:00 PM ET / 12:00 PM PT | Meeting Notes | #openssf-sig-openvex | openssf-sig-openvex |
| SBOM Coffee Hour (calendar: OpenSSF SBOM Coffee Club) | Every Monday | 11:00 AM ET / 8:00 AM PT | Meeting Notes | #sig-sbom-everywhere | openssf-sbom-coffee-club |
| OpenVEX Project Call | Monthly | TBD | TBD | #openssf-sig-openvex | openssf-sig-openvex |
| Protobom Project Meeting | Every other Wednesday | 12:00 PM CT / 1:00 PM ET / 10:00 AM PT | Meeting Notes | #protobom | protobom |
| SBOMit Weekly Meeting | Every Wednesday | 11:00 AM ET / 8:00 AM PT | Meeting Notes | #sbomit | sbomit |
- The SBOM Call is the structured engineering and planning forum to track deliverables, tool development, and broader ecosystem alignment.
- The VEX Call is a format-neutral sync to review real-world implementation experiences, address automation gaps, and optimize VEX interoperability.
- The OpenVEX Project Call is a dedicated technical sync focused exclusively on OpenVEX specification updates, tooling, and roadmap execution.
- The SBOM & VEX Coffee Hour is an informal community gathering for guest presentations, emerging research reviews, and unstructured Q&A for new adopters.
Fragmented efforts harm the ecosystem. The working group maintains strategic touchpoints with the following OpenSSF working groups, each of which maps to one anchor of the scope axes. We are proposing a collaboration model with each of them, which may take the form of recurring joint calls or standing agenda items on their regular community calls. Their regular meetings are listed below so members of this group can attend; all are on the OpenSSF Community Calendar.
| Working Group | Collaboration Focus | Regular Meeting | Slack |
|---|---|---|---|
| Supply Chain Integrity | Attestation frameworks, provenance pipelines, and how SBOM and VEX artifacts integrate with them. | Every other Wednesday, 12:00 PM ET / 9:00 AM PT | #wg_supply_chain_integrity |
| Vulnerability Disclosures | Downstream ingestion workflows and aligning VEX with coordinated vulnerability disclosure and advisory practices. | Every other Wednesday, 11:00 AM ET / 8:00 AM PT (plus an APAC-friendly call on the fourth Thursday of each month, 6:00 PM ET / 3:00 PM PT) | #wg_vulnerability_disclosures |
| Global Cyber Policy | Translating international software transparency regulations and compliance mandates into actionable developer tools. | Every other Monday, 9:00 AM ET / 6:00 AM PT (3:00 PM CET) | #wg-globalcyberpolicy |
| AI/ML Security | Extending SBOM paradigms into data and machine learning domains (e.g. AIBOM). | Every other Thursday, 2:00 PM ET / 11:00 AM PT | #wg-ai-ml-security |
Outside the OpenSSF, we directly engage the SPDX, CycloneDX, and OASIS CSAF communities to preserve format-neutral interoperability.
The CHARTER.md outlines the scope and governance of our group activities. The working group operates under standard OpenSSF governance principles, striving for lazy consensus among active contributors, and is consistent with the operating guidelines of the OpenSSF Technical Advisory Council (TAC).
The working group is led by three Steering Chairs serving staggered, renewable one-year terms, elected by the active contributors of the working group. The following individuals serve as interim chairs until the first election, which will be held within three months of the group's formation:
- Allan Friedman (@allanfriedman)
- Adolfo García Veytia (@puerco)
- Kate Stewart (@kestewart)
Chairs deliver quarterly status updates to the TAC and post brief bi-weekly summaries to the primary OpenSSF community Slack channels.
In accordance with the OpenSSF Charter, code contributions are licensed under Apache-2.0 and documentation under CC-BY-4.0.
This group operates according to the OpenSSF Code of Conduct.
Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.
Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.