A Comparative Analysis of SPDX and CycloneDX
A Software Bill of Materials (SBOM) provides transparency and accountability for a software release by documenting the metadata of its components and their dependencies. However, the adoption and utility of SBOMs depend heavily on the tools that generate, analyze, and manage them. With two dominant SBOM formats — SPDX and CycloneDX — the ecosystems surrounding these formats vary significantly in maturity, tool support, and community engagement. We conduct a quantitative comparison of use cases for 108 open-source and 62 proprietary SBOM tools, compare the health metrics of each format's entire tool ecosystem (171 CycloneDX vs. 470 SPDX tools), analyze 36,990 GitHub issue reports, and investigate the characteristics of the top 250 open-source projects using each format's tools. Our findings reveal distinct characteristics: while projects using CycloneDX tools demonstrate higher developer engagement, SPDX tools benefit from a more mature and extensive ecosystem with broader tool availability.
A 4-RQ empirical study combining manual tool analysis, CHAOSS health metrics, GitHub issue mining, and CI pipeline adoption analysis.
{{ rq.question }}
Which use cases do the current SBOM tools support?
{{ kf.note }}
Percentage of tools supporting each SBOM use case
{{ uc.desc }}
How is the health of current OSS SBOM tools distributed?
CycloneDX tools generally exhibit higher contributor activity, more frequent commits, and shorter issue resolution times, reflecting stronger recent momentum. SPDX tools, however, benefit from a larger and more established ecosystem with broader tool availability — 471 vs. 171 open-source tools. Practitioners should weigh both format maturity and ecosystem vitality.
Median values across open-source tools in each ecosystem
What are the areas for improvement in the OSS SBOM tools?
Across all open-source SPDX & CycloneDX tools
CycloneDX resolves bug-related issues 174% faster than SPDX
Only 5 of 456 SPDX tool repos advertise SPDX 3.0 support
Distribution of issue types
Distribution of issue types
Issue activity shows a visible inflection following the 2021 NTIA executive order mandating SBOM adoption. This illustrates how external regulatory events can reshape open-source development dynamics at ecosystem scale.
How is the health of GitHub projects that use SBOM tools distributed?
Projects with a higher number of commits tend to adopt tools with reporting capabilities, while projects with fewer commits prefer tools focused on SBOM editing. More active projects (more stars, watchers, releases, PRs, contributors) are more likely to adopt CycloneDX-based tools.
Median health metrics of top-250 CI-adopting projects per format
{{ imp.body }}
If you use this work, please cite:
{{ bibtex }}