EU

Generating SBOMs with CMake

September 21, 2026
, , , and
A diagram titled "From build model to SBOM" illustrating how CMake direct-generation converts a project build tree into an SPDX JSON-LD Software Bill of Materials detailing components, dependencies, versions, and licenses.

CMake now includes experimental support for directly generating Software Bills of Materials (SBOMs) as part of the install process. Instead of relying on post-build scanners, you can produce a standards-based SBOM from the same dependency graph CMake already uses to compile and link your project. The first supported output format is SPDX. The design allows additional SBOM formats to be added in the future as the feature matures.

What Is an SBOM?

A Software Bill of Materials (SBOM) is a machine-readable inventory of the components that make up a software system. It typically includes:

  • Package names and versions
  • Dependency relationships
  • License identifiers
  • Checksums and metadata

SBOMs support cybersecurity analysis, license compliance, auditing, and long-term sustainment. They do not perform vulnerability analysis themselves; instead, they provide structured data that downstream tools can use for impact and compliance evaluation.

CMake’s initial implementation generates SBOMs in SPDX (Software Package Data Exchange) format, a widely adopted open standard for representing software component metadata. By embedding SBOM creation into the build itself, projects avoid ambiguity and reduce reliance on external scanning tools.

Enabling Experimental SBOM Generation

SBOM support is experimental and must be explicitly enabled by setting the feature gate variable CMAKE_EXPERIMENTAL_GENERATE_SBOM to the UUID value required by your version of CMake. Because this UUID may change between releases, refer to Help/dev/experimental.rst in the version of CMake (the link goes to the master branch) you are using to determine the correct value.

You must also request SPDX generation. This can be done either at configure time or directly in your project with CMake commands. To specify at configure time the CMAKE_INSTALL_SBOM_FORMATS variable is used.

Command-line enablement (no source changes required):

cmake -S . -B build \ 
-DCMAKE_EXPERIMENTAL_GENERATE_SBOM=<UUID_FROM_experimental.rst> \   
-DCMAKE_INSTALL_SBOM_FORMATS=SPDX

cmake --build build

With CMAKE_INSTALL_SBOM_FORMATS set to SPDX any exported targets from install commands will create .spdx.json files when install is invoked. Note for this to work the project must already be using the install EXPORT command for targets.

Project-level enablement (CMakeLists.txt):

If you can modify your CMake source code, then you would use the install command SBOM variant. This is best described with a small example.

cmake_minimum_required(VERSION 4.3)
project(sbom_example VERSION 0.0.1
        DESCRIPTION "Example SBOM project")
# enable SBOM in CMake matching Help/dev/experimental.rst of your cmake
set(CMAKE_EXPERIMENTAL_GENERATE_SBOM "ca494ed3-b261-4205-a01f-603c95e4cae0")
# create a library and executable
add_library(libexample STATIC libsbom.cxx)
add_executable(demo_app main.cxx)
# find fmt and link it to the library
find_package(fmt CONFIG REQUIRED)
target_link_libraries(demo_app PRIVATE libexample fmt::fmt)

# install the executable
install(TARGETS demo_app EXPORT demo_app DESTINATION bin)
# install an sbom 
install(
   SBOM sbom_example
   EXPORT demo_app
   FORMAT "spdx-3.0+json"
   DESTINATION bin
)

This produces a file sbom_example.spdx.json during the install of the project. The interesting part of the SBOM is as follows with omitted lines represented by “…”.

{
...
      "comment" : "This SBOM was generated from the CMakeLists.txt File",
      "created" : "2026-04-22T15:35:07Z",
...
      "description" : "Example SBOM project",
...
          "builtTime" : "2026-04-22T15:35:07Z",
          "creationInfo" : "_:Build#CreationInfo",
          "name" : "fmt:fmt",
          "originatedBy" : 
          [
            {
              "creationInfo" : "_:Build#CreationInfo",
              "name" : "fmt",
              "spdxId" : "urn:fmt#Organization",
              "type" : "Organization"
            }
          ],
          "software_packageVersion" : "12.1.0",
          "spdxId" : "urn:fmt:fmt#Package",
          "type" : "software_Package"
 ...
          "creationInfo" : "_:Build#CreationInfo",
          "name" : "demo_app",
          "software_packageVersion" : "0.0.1",
          "software_primaryPurpose" : "application",
          "spdxId" : "urn:demo_app#Package",
          "type" : "software_Package"
...

For more information on the SBOM options of the install command see: https://cmake.org/cmake/help/git-master/command/install.html#sbom

After building, an SPDX document (for example, myproject.spdx.json) will be generated in the build directory alongside your artifacts.

Roadmap

SPDX is the first supported SBOM format. The implementation is designed so additional SBOM formats can be introduced in the future. Ongoing work includes richer metadata modeling, improved handling of transitive dependencies, enhanced license reporting, and tighter integration with packaging and CI workflows.

Feedback from real-world usage will directly shape the evolution of this feature. For discussion use CMake’s discourse, if you find issues use the CMake issue tracker.

Thanks

This material is based upon work supported by DARPA under Contract No. HR001124C0489
Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of DARPA.

The work was performed by Kitware, Inc. in collaboration with Riverside Research, a national security nonprofit.

Leave a Reply