A software bill of materials (SBOM) is a machine-readable inventory of every component in a piece of software, including libraries, packages and their versions. It lets teams see what they depend on and quickly check whether a newly disclosed vulnerability affects them. Common formats are SPDX and CycloneDX.
SBOMs became a mainstream requirement after US Executive Order 14028 (2021) asked software suppliers to the federal government to provide them. Many enterprises now ask for SBOMs from every vendor.
Infrastructure code has a supply chain too. Ansible Playbooks depend on Collections and Python packages; Terraform depends on providers and modules. Steampunk Spotter provides supply chain visibility and CVE and SBOM analysis for Ansible and Terraform code, so teams know which components their automation uses.
Regulated teams increasingly need SBOMs for Ansible Playbooks too. Playbooks pull in Collections and Python libraries that can carry CVEs, and auditors expect that inventory.
