Upload your first SBOM

Ready to upload your first SBOM, or not sure what an SBOM is? We’re here to help! Helm supports both CycloneDX and SPDX SBOM formats, making it easy for you to manage your software components.

Upload a CycloneDX or SPDX SBOM

1. Click Add SBOM > Upload SBOM.

2. If you are uploading a compressed SPDX SBOM file, follow these steps.

Supported SBOM versions and formats

Versions:

• CycloneDX: 1.3 (import only), 1.4 (import and export), 1.5 (import only)

• SPDX: 2.2, 2.3

Formats:

• CycloneDX: .json, .xml

• Single SPDX files: .spdx, .json, .yaml, .xml

• Compressed SPDX files: .gz, .tgz, .zip, .zst, .tzst

File size: 50MB

Where did my Add SBOM button go?

If you've already uploaded an SBOM, this button changes to Manage SBOM, providing you with additional actions. You can also check your SBOM file upload status from here.

1. In the modal that displays, specify a product name and version.

2. Click the Choose file button to browse to your SBOM file.

3. Click Upload SBOM.

4. If you're not seeing your SBOM dependency components loading, check that you have Auto-refresh turned on, or manually refresh the page. Larger SBOMs will take a bit more time. If you're still not seeing your SBOM, click Manage SBOMs > View file upload status. If you see a Failed status here, click the icon next to that status for more information. If you can't resolve the issue, contact us for help.

5. Once you’ve uploaded your SBOM, you will see all of the dependency components that are contained in that product display on the page. We’re already starting to match, drawing data from the NVD, including Package URLs (PURL) of Cargo, NPM, Nuget, or Pypi package manager), CPE strings, dependency component name/version/supplier combo, and alias matches.

6. If you need to aggregate and merge additional SBOMs to this SBOM, click Manage SBOMs > Upload SBOM. This will add dependency components from that SBOM to your existing SBOM.

7. If you see any warning or error icons next to your dependency component version, click the icon for more information. You should be able to just edit the version for a warning scenario, but will need to contact us for an error scenario. You'll need to resolve this issue before we can match this dependency component and return any vulnerabilities.

Not ready to add your SBOM yet? No worries!

You can create each of your products and their respective versions, then add your SBOM at any time.

1. In the Select product drop-down, select the Create product option, specify the product name, then Save. You’ll now see your new product selected. You’ll now need to add a version to upload an SBOM to.

2. In the Select version drop-down, select the Create version option, specify the version, then Save. Click the Add SBOM drop-down button, then select the Upload SBOM option.

Upload a compressed SPDX file

If you have a compressed SPDX SBOM file, follow these steps to upload it:

1. Prepare your files:

   • Create a directory named after what you want to name your zip file.

   • Navigate into that directory and create a subdirectory named packages in this directory.

   • Copy your individual SBOM files into the packages directory.

2. Compress your files:

   • Use the following commands to compress your files into a .tar.gz or .zip format:

     • Create .tar.gz: COPYFILE_DISABLE=1 tar -zcvf yourfilename.tar.gz yourdirectory

     • Create .zip: zip -r yourfilename.zip yourdirectory -x '**/.*'

3. Upload your file:

   • Once compressed, go to Helm and upload your .tar.gz or .zip compressed file following the upload process above.

What happens after upload?

Once you’ve uploaded your SBOM, Helm will automatically start matching your components with known software in the NVD (National Vulnerability Database). This leverages several match sources, such as Package URLs (PURLs), CPE strings, dependency component names, and alias matches. Refer to Match statutes and Resolve match statuses for more information.

Check out Match sources for more information on sources we consult, and Match statuses to understand how we determine match statuses and suggest possible matches.

Create products and versions without an SBOM

1. In the Select product drop-down, choose Create product, specify the product name, then click Save.

2. In the Select version drop-down, choose Create version, specify the version, and click Save.

3. When you have an SBOM ready, just click the Add SBOM drop-down button (Manage SBOM if you already have uploaded other SBOMs), then select Upload SBOM when you’re ready to add your SBOM file.

Troubleshooting and support

You may have turned off auto-refresh. You can either turn it back on from the Auto-refresh switch above the table, or you can click Refresh to manually refresh the page.

Not seeing your SBOM dependency components?

You may have turned off auto-refresh. You can either turn it back on from the Auto-refresh switch above the table, or you can click Refresh to manually refresh the page.

No exact match

If Helm can’t find an exact match in the NVD, refer to Resolve match statuses for further instructions.

Upload issues

Have a large SBOM file?

If you have a larger SBOM file, this could take a little longer to upload. Get a cup of coffee or tea while we process your SBOM! We'll automatically start matching to known software in the NVD as soon as your upload is completed successfully.

Don't think your SBOM uploaded successfully?

If you're still not seeing your SBOM, check the status of your SBOM file upload via the Manage SBOMs drop-down button > View file upload status. In the status modal, click the icon next to the Failed status to get more information. If you need help, contact us.

SBOM contains component hashes

Although you can't currently view masked component hashes in Helm, rest assured that the component hash information in your SBOM has been retained and will be exported intact to any SBOM report.

Need help getting started?

Have a different SBOM format

If you have another format (e.g., Word, CSV), contact us so we can convert it for you. We’re in the process of adding more complete support for all of the data in your CycloneDX format of SBOM, as well as adding support for the SPDX SBOM format.

Don’t worry – we’ve got you covered! We can provide expert assessment, guidance, and design of anything from building cybersecurity and continuous improvement into your product development lifecycle to your Public Key Infrastructure cryptography to FDA letters and most anything in between.

Need to generate an SBOM

We've worked with a lot of open-source tools ourselves and have also provided any other tools we know of for generating a CycloneDX SBOM or a SPDX SBOM.

Don't know what an SBOM is or not sure where to start

Take our FDA readiness assessment survey to start down your path to a smooth FDA submission process!