Blog : About : RSS : Blogroll

Quickly visualizing an SBOM document

Seth Larson @ 2025-01-15

Have you ever had a Software Bill-of-Materials (SBOM) document and just want to look at the dang thing? Preferably using CLI tools? SBOMs tend to be quite large for non-trivial software projects, so looking at them in a text editor becomes difficult fast.

Many "solutions" for visualizing an SBOM document require running a service which is something I don't want to do. Here's what you can do to quickly visualize an SBOM document using Anthony Harrison's sbom2dot project, the DOT language, and GraphViz:

# Ensure GraphViz and sbom2dot are installed.
$ dot --version
$ python -m pip install sbom2dot

# Create an SVG from an SBOM!
$ sbom2dot -i bom.cdx.json | dot -Tsvg -o bom.cdx.svg

# Open the SVG, either in image viewer or browser.
$ firefox bom.cdx.svg

Here's what the visualization looks like for a work-in-progress SBOM generation for the Python Cryptography package:

sbom cryptography pkg:pypi/cryptography@44.0.0 NOASSERTION cryptography-cffi cryptography-cffi NOASSERTION cryptography->cryptography-cffi cryptography-keepalive cryptography-keepalive NOASSERTION cryptography->cryptography-keepalive cryptography-key-parsing cryptography-key-parsing NOASSERTION cryptography->cryptography-key-parsing cryptography-openssl cryptography-openssl NOASSERTION cryptography->cryptography-openssl cryptography-x509 cryptography-x509 NOASSERTION cryptography->cryptography-x509 cryptography-x509-verification cryptography-x509-verification NOASSERTION cryptography->cryptography-x509-verification pyo3 pkg:cargo/pyo3@0.23.2 MIT OR Apache-2.0 cryptography-cffi->pyo3 openssl-sys pkg:cargo/openssl-sys@0.9.104 MIT cryptography-cffi->openssl-sys cryptography-keepalive->pyo3 cryptography-key-parsing->cryptography-x509 cryptography-key-parsing->openssl-sys cfg-if pkg:cargo/cfg-if@1.0.0 MIT OR Apache-2.0 cryptography-key-parsing->cfg-if openssl pkg:cargo/openssl@0.10.68 Apache-2.0 cryptography-key-parsing->openssl asn1 pkg:cargo/asn1@0.20.0 BSD-3-Clause cryptography-key-parsing->asn1 cryptography-openssl->openssl-sys cryptography-openssl->cfg-if cryptography-openssl->openssl foreign-types pkg:cargo/foreign-types@0.3.2 MIT OR Apache-2.0 cryptography-openssl->foreign-types foreign-types-shared pkg:cargo/foreign-types-shared@0.1.1 MIT OR Apache-2.0 cryptography-openssl->foreign-types-shared cryptography-x509->asn1 cryptography-x509-verification->cryptography-key-parsing cryptography-x509-verification->cryptography-x509 cryptography-x509-verification->asn1 once_cell pkg:cargo/once_cell@1.20.2 MIT OR Apache-2.0 cryptography-x509-verification->once_cell pyo3-macros-backend pkg:cargo/pyo3-macros-backend@0.23.2 MIT OR Apache-2.0 quote pkg:cargo/quote@1.0.37 MIT OR Apache-2.0 pyo3-macros-backend->quote pyo3-build-config pkg:cargo/pyo3-build-config@0.23.2 MIT OR Apache-2.0 pyo3-macros-backend->pyo3-build-config proc-macro2 pkg:cargo/proc-macro2@1.0.92 MIT OR Apache-2.0 pyo3-macros-backend->proc-macro2 syn pkg:cargo/syn@2.0.89 MIT OR Apache-2.0 pyo3-macros-backend->syn heck pkg:cargo/heck@0.5.0 MIT OR Apache-2.0 pyo3-macros-backend->heck quote->proc-macro2 pyo3-build-config->once_cell target-lexicon pkg:cargo/target-lexicon@0.12.16 Apache-2.0 pyo3-build-config->target-lexicon unicode-ident pkg:cargo/unicode-ident@1.0.14 (MIT OR Apache-2.0) AND Unicode-3.0 proc-macro2->unicode-ident syn->quote syn->proc-macro2 syn->unicode-ident libc pkg:cargo/libc@0.2.166 MIT OR Apache-2.0 pyo3->libc pyo3->cfg-if pyo3-macros pkg:cargo/pyo3-macros@0.23.2 MIT OR Apache-2.0 pyo3->pyo3-macros portable-atomic pkg:cargo/portable-atomic@1.10.0 Apache-2.0 OR MIT pyo3->portable-atomic pyo3->once_cell memoffset pkg:cargo/memoffset@0.9.1 MIT pyo3->memoffset pyo3-ffi pkg:cargo/pyo3-ffi@0.23.2 MIT OR Apache-2.0 pyo3->pyo3-ffi indoc pkg:cargo/indoc@2.0.5 MIT OR Apache-2.0 pyo3->indoc unindent pkg:cargo/unindent@0.2.3 MIT OR Apache-2.0 pyo3->unindent openssl-sys->libc openssl->openssl-sys openssl->libc openssl->cfg-if openssl->once_cell openssl-macros pkg:cargo/openssl-macros@0.1.1 MIT OR Apache-2.0 openssl->openssl-macros openssl->foreign-types bitflags pkg:cargo/bitflags@2.6.0 MIT OR Apache-2.0 openssl->bitflags asn1_derive pkg:cargo/asn1_derive@0.20.0 BSD-3-Clause asn1->asn1_derive itoa pkg:cargo/itoa@1.0.14 MIT OR Apache-2.0 asn1->itoa pyo3-macros->pyo3-macros-backend pyo3-macros->quote pyo3-macros->proc-macro2 pyo3-macros->syn asn1_derive->quote asn1_derive->proc-macro2 asn1_derive->syn pyo3-ffi->libc openssl-macros->quote openssl-macros->proc-macro2 openssl-macros->syn foreign-types->foreign-types-shared pem pkg:cargo/pem@3.0.4 MIT base64 pkg:cargo/base64@0.22.1 MIT OR Apache-2.0 pem->base64

Notice the dependencies off on the top-right that aren't a part of the graph? This visualization makes it easy to spot those types of issues. You can fiddle with the options of dot to match how you'd like the visualization to be rendered.

Do you have a better method for quick SBOM visualization in the terminal? Send me an email please!

Wow, you made it to the end!