Import your own SBOMs, lockfiles and asset lists

1. Generate an SBOM

Most build tools can write a CycloneDX or SPDX SBOM, for example:

• npm sbom --sbom-format cyclonedx > app.cdx.json (npm 10+)
• syft dir:. -o cyclonedx-json > app.cdx.json or syft <image> -o spdx-json
• cyclonedx-py environment -o app.cdx.json for a Python environment

Provenance reads CycloneDX JSON and XML, and SPDX 2.x JSON and tag-value. The SBOM Explorer (components, dependency tree, vulnerabilities via OSV.dev) reads JSON; the SBOM License Checker reads all four.

2. Import

Choose File → Import assets (paste or file)… (key I). Paste the text or press Open a file…. The dialog tells you what it recognised before anything changes:

• an SBOM → one SBOM asset,
• package.json, package-lock.json, requirements.txt, go.mod, Cargo.lock or composer.lock → one dependency asset,
• a Provenance project file → opens it,
• anything else is read line by line.

3. Asset lists

One asset per line is the fastest way to add a fleet:

gcr.io/distroless/static-debian12:nonroot
quay.io/prometheus/prometheus:v2.45.0
npm:express@4.21.1
pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1
expressjs/express
CVE-2024-3094
shop.example.net

Image references, npm: / pypi: / cargo: / maven: / go: prefixes, pkg: URLs, owner/repo or GitHub URLs, CVE/GHSA/OSV ids, domains and OAuth consent links are recognised. Lines that match nothing are listed and skipped.

4. Run a batch

Select assets with the checkboxes in the list, then Run selected — or Run all checks. Run → Run checks that are new or out of date only runs checks whose input changed since the last result. If a check fails (for example a registry that refuses anonymous requests), the asset's card shows the reason in a sentence and a Retry button.

5. From another app

Other premium apps can hand an SBOM (JSON) or a text list to Provenance through Open in another app…; it arrives in the same import dialog, and nothing changes until you press Add to project.