Software supply chain
The SBOM viewer opens a software bill of materials - CycloneDX 1.2 to 1.6 in JSON or XML, SPDX
2.2 and 2.3 in JSON or tag-value, SPDX 3.0 - and shows what a product is made of: every component in a table to
sort and search, the dependency tree branch by branch, and a graph of what depends on what. Each licence
expression is judged against your own licence policy - allowed, for review or denied, with patterns such as
GPL-* - and the whole document is checked against the NTIA minimum elements.
Give it your advisories in OSV and your VEX statements in CycloneDX or OpenVEX, and it shows which components they affect, scored from their CVSS vectors, with what your security team decided about each. Give it the last release's SBOM, and it shows what was added, removed, upgraded or relicensed. The SBOM goes out as CycloneDX 1.6 or SPDX 2.3, the components, findings and changes as CSV, and the whole picture as a PDF report. Nothing is looked up online.
Try it with your own SBOMs in confidence: they are opened by your browser, on your device. Nothing is uploaded, no copy reaches us or anyone else, and nothing is kept once you close this tab.
A product's SBOM, against your licence policy
The CycloneDX 1.6 SBOM of Kestrel Inspect 3.2, a made-up field inspection service from a made-up company. The open-source packages are real, with their real licences; the Kestrel packages, a chart renderer and a fonts package are invented. The policy allows the permissive licences, sends LGPL and MPL for review and denies GPL and AGPL. One component is denied: find it, then see what the NTIA checks say is missing.
// Node 18 or later, from the Gold package: fail the build when a component's licence is denied.
import { readFileSync, writeFileSync } from 'node:fs';
import { readSbom, readPolicy, licenceSummary, checkSbom, componentLabel, writeSbom } from './dist/node/bmx-sbom-viewer.mjs';
const { sbom } = readSbom(readFileSync('dist/kestrel-inspect.cdx.json'), 'kestrel-inspect.cdx.json');
const policy = readPolicy(readFileSync('licence-policy.json', 'utf8'));
const byRef = new Map(sbom.components.map(c => [c.ref, c]));
const denied = licenceSummary(sbom, policy).filter(row => row.status === 'denied');
for (const row of denied) {
console.error(`Denied: ${row.licence || '(no licence)'} in ${row.refs.map(r => componentLabel(byRef.get(r))).join(', ')}`);
}
for (const check of checkSbom(sbom).filter(c => c.severity === 'error')) console.error(check.message);
writeFileSync('dist/kestrel-inspect.spdx.json', writeSbom(sbom, 'spdx', policy).text);
process.exitCode = denied.length ? 1 : 0;
What the new release changes
Kestrel Inspect 3.3, compared with 3.2 above: the chart renderer is gone, a print package of Kestrel's own takes its place, and several packages moved on. The advisories in OSV and the OpenVEX statement are invented too, with made-up identifiers. See what changed, which vulnerabilities this release brings in or leaves behind, and the worst one still open. CVSS is owned by FIRST and used by permission.