Work with CycloneDX Software Bill-of-Materials (SBOM)

v1.6.3 2022-09-15 14:21 UTC


shield_gh-workflow-test shield_packagist-version shield_license
shield_website shield_slack shield_groups shield_twitter-follow

CycloneDX PHP Library

Work with Software Bill of Materials (SBoM) in CycloneDX format.

!! ATTENTION - v2-dev state

The branch "master" is currently in the transition to next major version: v2. See the progress in the milestone "v2"

Code of v1 is in branch "1.x"


  • Provide a general purpose php-implementation of CycloneDX.
  • Provide phpDoc- & psalm-typing for said implementation, so developers and dev-tools can rely on it.
  • Provide data models to work with CycloneDX.
  • Provide a JSON- and an XML-normalizer, that...
    • supports all shipped data models.
    • respects any injected CycloneDX Specification and generates valid output according to it.
    • can prepare data structures for JSON- and XML-serialization.
  • Serialization:
    • Provide a JSON-serializer.
    • Provide a XML-serializer.
  • Validation against CycloneDX Specification:
    • Provide a JSON-serializer.
    • Provide a XML-validator.
  • Provide composer-based autoloading for downstream usage.


  • Enums for the following use cases:
    • ComponentType
    • ExternalReferenceType
    • HashAlgorithm
  • Data models for the following use cases:
    • Bom
    • BomRef, BomRefRepository
    • Component, ComponentRepository
    • ExternalReference, ExternalReferenceRepository
    • HashDictionary
    • LicenseExpression, NamedLicense, SpdxLicense, LicenseRepository
    • Metadata
    • Tool, ToolRepository
  • Factories for the following use cases:
    • Create data models from any license descriptor string
  • Implementation of the CycloneDX Specification for the following versions:
    • 1.4
    • 1.3
    • 1.2
    • 1.1
  • Normalizers that convert data models to JSON structures
  • Normalizers that convert data models to XML structures
  • Serializer that converts Bom data models to JSON string
  • Serializer that converts Bom data models to XML string
  • Validator that checks JSON against CycloneDX Specification
  • Validator that checks XML against CycloneDX Specification


Install via composer:

composer require cyclonedx/cyclonedx-library


See extended examples.

$bom = new \CycloneDX\Core\Models\Bom();
    new \CycloneDX\Core\Models\Component(

API Documentation

There is no pre-rendered documentation at the time.
Instead, there are code annotations, so that your IDE and tools may pick up the documentation when you use this library downstream.

Additionally, there is a prepared config for phpDoc3 that you can use to generate the docs for yourself.


Due to the fact that this library was split out of /src/Core of cyclonedx-php-composer (346e6200fb2f5086061b15c2ee44f540893ce97d)
it will conflict with its original source: cyclonedx/cyclonedx-php-composer:<3.5.


Feel free to open issues, bugreports or pull requests.
See the CONTRIBUTING file for details.


Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the LICENSE file for the full license.