XRAY: SBOM Generation from SCM Repositories Using JFrog Xray On Demand

Overview
JFrog Xray enables developers and security teams to generate Software Bills of Materials (SBOMs) directly from source code repositories (SCM) on demand, without publishing binaries to Artifactory. Using the JFrog CLI, SBOMs can be generated locally from a cloned repository based on resolved dependencies.
This approach supports early security visibility, compliance requirements, and modern shift-left security practices.

What Is an SBOM?
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all software components that make up an application.
It lists:

• Open-source libraries
• Third-party packages
• Transitive dependencies
• Component versions and metadata

An SBOM is conceptually similar to an ingredient list on packaged food, it allows organizations to understand what is inside their software.

Why SBOMs Are Important
SBOMs are used to:

• Identify vulnerable components quickly when new CVEs are disclosed
• Meet regulatory and compliance requirements (for example, executive orders and industry standards)
• Improve software supply chain transparency

Without an SBOM, identifying whether an application is affected by a newly discovered vulnerability often requires time-consuming manual analysis.

Simple Real-World Example
A development team builds a web application that uses:

• Spring Boot
• Log4j
• Jackson
• Several transitive open-source libraries

When a critical vulnerability is announced in Log4j, the security team needs to immediately answer:

• Is Log4j used in any of our applications?
• Which versions are affected?
• Which builds need to be remediated?

An SBOM provides this information instantly by listing Log4j and all related dependencies, allowing teams to take immediate action.

On-Demand SCM SBOM Generation Using JFrog CLI
Using JFrog Xray, developers can generate SBOMs on demand from a locally cloned Git repository using the JFrog CLI.
This allows SBOM generation directly from source code without requiring binaries to be published to Artifactory.

How It Works

1. The source code is checked out from the Git repository
2. The build environment resolves dependencies using the project’s package manager
3. The JFrog CLI command is executed from the project root
4. JFrog Xray generates an SBOM from the resolved dependency tree

The resulting SBOM reflects what the application actually depends on at build time, including transitive dependencies.

Advantages of On-Demand SBOM Generation
Early Security Visibility (Shift-Left)

• SBOMs are generated before artifacts are published
• Vulnerabilities are identified earlier in the development lifecycle
• Developers can remediate issues before they reach downstream environments

Developer-Friendly Workflow

• No need to modify build pipelines or publish binaries
• SBOMs can be generated locally or in CI pipelines
• Supports multiple output formats for different consumers

Compliance and Audit Readiness

• Generate SBOMs on demand for audits or regulatory requirements
• Supports industry-standard formats such as CycloneDX and SARIF

JFrog CLI Command Reference
To view available options:
jf audit --help
Relevant Options:

• --sbom
  Enables SBOM generation and includes all components in the output.
• --format
  Supported values:
  • table
  • json
  • simple-json
  • sarif
  • cyclonedx

The --sbom option is applicable only with above listed  format

How It Works: Step-by-Step
Download and Configure the JFrog CLI:

• Download and install JFrog CLI v2 from https://jfrog.com/getcli/
• Choose the installation method that best fits your environment.
• Configure the CLI to connect to JFrog Artifactory. In automation scripts, an access token can be provided via environment variables:
• export ACCESS_TOKEN=ey[...Access-Token...]
• jf config add --access-token=$ACCESS_TOKEN --url=http://localhost:8082 --interactive=false artifactory-example

To verify the config is loaded with "jf config show" and then run a "jf rt ping" to ping the Artifactory: 
Expected output:

 


Generating SBOMs from SCM
Run the following commands from the root of the cloned repository to obtain the SBOM reports in the required format.

CycloneDX Format:
jf audit --sbom --format cyclonedx > sbom-cyclonedx-format.cdx.json

 

Table Format:
jf audit --sbom --format table > sbom-table-format.txt

 

Simple JSON Format
jf audit --sbom --format simple-json > sbom-simple-json-format.json

 

SARIF Format:
jf audit --sbom --format sarif > sbom-sarif-format.cdx.txt

 


Developer and Application Impact

• Immediate feedback on dependency composition
• Reduced friction between development and security teams
• Faster remediation cycles with actionable SBOM data
• Better visibility into application risk
• Reduced exposure to vulnerable components
• More predictable and secure release cycles

Shift-Left Security Impact
By generating SBOMs directly from SCM:

• Security checks move earlier into development workflows
• Vulnerabilities are detected before artifacts are promoted
• This approach aligns with modern DevSecOps practices and reduces downstream risk and rework.

On-demand SBOM generation empowers teams to build, release, and operate software with greater confidence and security.