2026 SBOM minimum elements

2026 SBOM 최소 요소

Record component hashes, licenses, tool names, and generation context under the updated 2026 guidance.

···
html
<div class="stage" data-phase="0"><div class="title">2026 SBOM · MINIMUM FIELDS</div><div class="release panel">app v4 <span>release inventory</span></div><div class="fields"><div class="panel field">Component hash</div><div class="panel field">License</div><div class="panel field">SBOM tool name</div><div class="panel field">Generation context</div></div><div class="sub">Four fields travel with this release</div></div>
css
.stage{width:min(94vw,760px);height:min(88vh,330px);padding:clamp(9px,2.6vmin,20px);border:1px solid var(--line);border-radius:14px;background:var(--surface);font:600 clamp(12px,2.5vmin,16px)/1.3 "Pretendard Variable",Pretendard,-apple-system,BlinkMacSystemFont,"Apple SD Gothic Neo",sans-serif;display:flex;flex-direction:column;gap:clamp(6px,1.7vmin,12px);overflow:hidden;position:relative}.stage *{min-width:0}.stage .title{color:var(--accent);font-weight:800}.stage .sub{color:var(--muted)}.stage .row{display:flex;align-items:center;gap:clamp(5px,1.6vmin,12px)}.stage .panel{border:1px solid var(--line);border-radius:8px;background:var(--bg);padding:clamp(6px,1.6vmin,12px)}.stage .mono{font-family:ui-monospace,SFMono-Regular,monospace;font-size:clamp(12px,2.5vmin,15px)}.stage .grow{flex:1}.stage .on{color:var(--accent)}.stage{font-size:clamp(12px,4vmin,16px)}.release{display:flex;justify-content:space-between;color:var(--accent)}.release span{color:var(--muted);font-weight:500}.fields{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:clamp(5px,1.5vmin,10px);flex:1;min-height:0}.field{display:grid;place-items:center;text-align:center;transition:background .3s,border-color .3s}.stage[data-phase="0"] .field:nth-child(1),.stage[data-phase="1"] .field:nth-child(2),.stage[data-phase="2"] .field:nth-child(3),.stage[data-phase="3"] .field:nth-child(4){border-color:var(--accent);background:color-mix(in srgb,var(--accent) 16%,var(--surface));color:var(--accent)}
js
const stage=document.querySelector('.stage');let phase=0;function advance(){phase=(phase+1)%4;stage.dataset.phase=String(phase)}const timer=setInterval(advance,900);stage.addEventListener('pointerdown',()=>{clearInterval(timer);advance()})

An SBOM records direct and transitive components so teams can trace which products contain a newly affected package. It is an inventory and a starting point for response.

The demo highlights the hash, license, tool, and generation-context fields attached to a release. The 2026 CISA guidance adds component hashes, licenses, SBOM tool names, and generation context to the minimum fields. An SBOM still needs maintenance and response work to be useful.

When to use

Use it to document a release supply chain and locate affected dependencies.

Open as page ↗