[opensourcedex]

bomber is a free, open source erp & operations project written in Go and released under MPL-2.0. It has 624 GitHub stars, 56 forks and 29 open issues, and was last pushed 7 months ago. On this registry it ranks #20 of 25 tracked projects in ERP & Operations, with 5 head-to-head comparisons available.

What is bomber?

bomber is a Go command-line application that scans Software Bill of Materials (SBOM) files for security vulnerabilities and component licence information, built for security and DevSecOps teams that need to assess third-party software they cannot read the source of.

What it is

bomber lives in the SBOM and software supply chain security ecosystem, alongside formats and generators such as CycloneDX, SPDX and Syft. It ingests an SBOM and reports whether the components listed inside it carry known vulnerabilities, plus the licences those components ship under. The README frames the tool's origin clearly: an organisation asks a vendor for an SBOM for a closed source product, receives a JSON file, and then needs a way to turn that file into risk information.

The concrete problem it solves is the visibility gap on closed source software. Vendor software composition analysis tools from providers such as GitHub, Sonatype and Snyk scan open source and can generate SBOMs, but they cannot look inside software for which no source or repository access exists. An SBOM supplies the composition of that opaque software, and bomber is the piece that determines whether anything in that composition is vulnerable. The README states the project was created to scan closed source SBOMs received from vendors, while noting it can also scan open source SBOMs and could be used as an open source SCA tool.

Key capabilities

  • Reads any JSON or XML based CycloneDX SBOM, plus JSON SPDX and Syft formatted SBOMs.
  • Scans a single SBOM or an entire folder of SBOMs in one run.
  • Emits results as HTML, JSON or Markdown output formats.
  • Supports ignoring vulnerabilities and filtering output to suppress known or accepted findings.
  • Enriches findings with Exploit Prediction Scoring System (EPSS) data.
  • Reads SBOMs from STDIN and accepts configuration through environment variables.
  • Ships experimental features: highest severity return codes for pipeline gating, and an OpenAI AI enriched HTML report output.

Who uses it and how

  • Security and procurement teams assessing vendor risk, where an SBOM arrives for a closed source product and the components must be checked before adoption.
  • DevSecOps and security automation workflows, where the experimental highest severity return codes let a scan fail a build or gate a pipeline step.
  • Teams triaging at folder scale, scanning a directory of SBOMs rather than one file at a time.
  • Internal teams scanning their own internal or open source SBOMs for vulnerability and licence data.
  • Terminal-driven workflows that pipe an SBOM into bomber over STDIN instead of storing it on disk.

Getting started

The README documents installation for Mac and Linux, after which bomber is run against a single SBOM or an entire folder of SBOMs; the project homepage hosts the full documentation.

How it compares

The README positions bomber against vendor SCA tools such as GitHub, Sonatype and Snyk, which cover open source components and can generate SBOMs but cannot see into closed source software. bomber occupies the complementary slot: it works from the SBOM as the only available view of that software. It is released under MPL-2.0, so it can be self-hosted and run inside an organisation's own environment.

When to use it — and when not to

The project is marked BETA, so teams should expect changing behaviour, in particular around the experimental return code and OpenAI report features. It is only as useful as the SBOM supplied to it, and it depends on configured vulnerability data providers for enrichment, so anyone without a supported SBOM format in hand gains nothing from it. Those wanting a fully supported, non-beta tool with an enumerated support matrix should look elsewhere until the project leaves beta.

project readme (upstream, from github) — read inline

bomber

GitHub release (latest by date) Go Report Card CII Best Practices codecov

bomber is an application that scans SBOMs for security vulnerabilities.

Overview

So you've asked a vendor for an Software Bill of Materials (SBOM) for one of their closed source products, and they provided one to you in a JSON file... now what?

The first thing you're going to want to do is see if any of the components listed inside the SBOM have security vulnerabilities, and what kind of licenses these components have. This will help you identify what kind of risk you will be taking on by using the product.

Finding security vulnerabilities and license information for components identified in a SBOM is exactly what bomber is meant to do. bomber can read any JSON or XML based CycloneDX format, or a JSON SPDX or Syft formatted SBOM, and tell you pretty quickly if there are any vulnerabilities.

Table of Contents

Open vs. Closed Source

Software can either be open or closed source. You can look at third party components you'll find in Github, or any public source repository as open source. Technically, the software you create internally at your own company is open source as well - it's not public, but your internal teams can see it. Closed source software can also be internal, but usually this is software that you purchase from external vendors.

Companies can use SCA tools provided by vendors such as Github, Sonatype, Snyk, etc. to scan any kind of open source and provide vulnerability data - and even generate SBOMs in some cases. What they can't do (yet...) is scan closed source software that you don't have visibility into. This is where SBOMs and bomber come into play. SBOMs provide the composition of software that you can't access, and bomber determines if anything in the SBOM has vulnerabilities.

Purpose

We created bomber to scan the closed source SBOMs that are provided when you receive them from vendors. It can scan open source SBOMs too, and technically you could use bomber as an open source SCA tool if you wanted to.

Supported SBOM formats

There are quite a few SBOM formats available today. bomber supports the following:

Providers

bomber supports multiple sources for vulnerability information. We call these providers. Currently, bomber uses OSV as the default provider, but you can also use the Github Advisory Database, the Sonatype OSS Index, or Snyk.

At this time, please note that OSV is free and does not require any credentials to use, Sonatype OSS Index is free but requires you to register and obtain a token, and Snyk support requires a Snyk license.

In addition to data bomber collects from Providers, it also enriches vulnerability data with extra information such as exploitation probabilities.

Provider Support

Please note that each provider supports different ecosystems, so if you're not seeing any vulnerabilities in one, try another. An ecosystem is simply the package manager, or type of package. Examples include rpm, npm, gems, etc. It is important to understand that each provider may report different vulnerabilities. If in doubt, look at a few of them.

If bomber does not find any vulnerabilities, it doesn't mean that there aren't any. All it means is that the provider being used didn't detect any, or it doesn't support the ecosystem. Some providers have vulnerabilities that come back with no Severity information. In this case, the Severity will be listed as "UNDEFINED"

Provider Documentation

Provider documentation for bomber can be found:

Installation

Mac

You can use Homebrew to install bomber using the following:

brew tap devops-kung-fu/homebrew-tap
brew install devops-kung-fu/homebrew-tap/bomber

If you do not have Homebrew, you can still download the latest release (ex: bomber_0.4.1_darwin_all.tar.gz), extract the files from the archive, and use the bomber binary.

If you wish, you can move the bomber binary to your /usr/local/bin directory or anywhere on your path.

Linux

To install bomber, download the latest release for your platform and install locally. For example, install bomber on Ubuntu:

dpkg -i bomber_0.5.0_linux_arm64.deb

Using bomber

You can scan either an entire folder of SBOMs or an individual SBOM with bomber. bomber doesn't care if you have multiple formats in a single folder. It'll sort everything out for you.

Note that the default output for bomber is to STDOUT. Options to output in HTML or JSON are described later in this document.

Single SBOM scan

# Using OSV (the default provider) which does not require any credentials
bomber scan cyclonedx.sbom.json

# Using a provider that requires credentials (ossindex)
bomber scan --provider=xxx --username=xxx --token=xxx [sbom.json]

If the provider finds vulnerabilities you'll see an output similar to the following:

If the provider doesn't return any vulnerabilities you'll see a message saying no vulnerabilities were found.

NOTE: Just because may not have found any vulnerabilities using a specified provider doesn't mean there are no vulnerabilities. Please try the other providers that bomber supports.

Entire folder scan

This is good for when you receive multiple SBOMs from a vendor for the same product. Or, maybe you want to find out what vulnerabilities you have in your entire organization. A folder scan will find all components, de-duplicate them, and then scan them for vulnerabilities.

# scan a folder of SBOMs (the following command will scan a folder in your current folder named "sboms")
bomber scan --provider=xxx --username=xxx --token=xxx ./sboms

You'll see a similar result to what a Single SBOM scan will provide.

Output Formats

bomber outputs data into three useful formats. By default, output is rendered to the command line. For enhanced reporting, you can output to HTML using the --output=html flag. To output to JSON, utilize the --output=json flag. Use comma separated output specification to get output in multiple formats --output=html,stdout,json.

HTML Output

If you would like a readable report generated with detailed vulnerability information, you can utilized the --output flag to save a report to an HTML file.

Example command:

readme truncated — read the full docs on github

Frequently asked questions

Is bomber free to use?

bomber is open source under the MPL-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does bomber do?

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

What is bomber written in?

bomber is primarily written in Go. Its source is publicly available at https://github.com/devops-kung-fu/bomber, and it has 624 GitHub stars.