CycloneDX vs SPDX: which SBOM format to use, and when it matters

Two SBOM standards, both international, both accepted by every regulator that has expressed an opinion, both supported by every serious tool. The choice matters less than the volume of writing about it suggests — and yet you do have to pick one for your pipeline, and the right pick depends on what you will do with the document. This post gives the short answer first, then the reasoning.

Where each one came from

SPDX — Software Package Data Exchange — started in 2010 at the Linux Foundation to solve licence compliance: which licences apply to which files in a distribution, with enough precision to satisfy a lawyer. That heritage shows in its depth on files, snippets, licence expressions and copyright text. It became ISO/IEC 5962:2021 (for SPDX 2.2.1), and SPDX 3.0 in 2024 reorganised the model into profiles, including a security profile.

CycloneDX started in 2017 in the OWASP community, explicitly for security and supply-chain use cases. It models components, services, dependency graphs and — natively — vulnerability disclosures (VDR) and exploitability statements (VEX), along with attestations, cryptographic inventories and more in recent versions. It is published as ECMA-424, and the current version, 1.6, dates from 2024.

What each one is good at modelling

For the job this site cares about — knowing which packages are in a running image so they can be matched to advisories — the deciding row is the identifier one. A vulnerability matcher works from a PURL: pkg:apk/alpine/nginx@1.27.5-r1?distro=alpine-3.21.3 carries the ecosystem, the distro and the exact version that an advisory's affected range is evaluated against. CycloneDX puts that in a required-shaped field on every component; SPDX carries it as one external reference among several. Both work; one is designed for it.

The same package in both

{
  "type": "library",
  "name": "nginx",
  "version": "1.27.5-r1",
  "purl": "pkg:apk/alpine/nginx@1.27.5-r1?arch=x86_64&distro=alpine-3.21.3",
  "cpe": "cpe:2.3:a:nginx:nginx:1.27.5-r1:*:*:*:*:*:*:*",
  "licenses": [{ "license": { "name": "BSD-2-Clause" } }]
}

{
  "SPDXID": "SPDXRef-Package-apk-nginx-3c9251e68aafb845",
  "name": "nginx",
  "versionInfo": "1.27.5-r1",
  "downloadLocation": "NOASSERTION",
  "licenseConcluded": "BSD-2-Clause",
  "externalRefs": [
    { "referenceCategory": "SECURITY", "referenceType": "cpe23Type",
      "referenceLocator": "cpe:2.3:a:nginx:nginx:1.27.5-r1:*:*:*:*:*:*:*" },
    { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl",
      "referenceLocator": "pkg:apk/alpine/nginx@1.27.5-r1?arch=x86_64&distro=alpine-3.21.3" }
  ]
}

Same facts, different shapes. Syft produces either from one scan, and the CycloneDX reference has a complete real document to read alongside the fragment above.

What the regulators actually say

• EU Cyber Resilience Act. Annex I requires manufacturers to "identify and document" components including by drawing up an SBOM in a commonly used machine-readable format, covering at least top-level dependencies. No standard is named; the Commission may specify formats by implementing act. Reporting obligations apply from 11 September 2026. The CRA post goes through the detail.
• United States. NTIA's 2021 minimum elements name SPDX, CycloneDX and SWID as acceptable formats; CISA's 2025 update to the minimum elements keeps both. Executive Order 14028 procurement guidance references NTIA.
• Germany (BSI TR-03183-2) accepts both, with field-level requirements that both can meet.

The consistent pattern: regulators specify content — supplier, name, version, unique identifier, dependency relationships, author, timestamp — and let you pick the container for it. Both formats carry all of it.

Tool support in practice

Generators: Syft, Trivy, cdxgen (CycloneDX only), Docker Scout, BuildKit attestations (SPDX). Consumers: Grype, Trivy, OSV-Scanner, Dependency-Track (CycloneDX first), GUAC, and every commercial platform. In the container and Kubernetes world CycloneDX is the default output and the format most consumers are tested against; SPDX is the default in BuildKit's --sbom attestations and in distribution packaging. StackRadar generates and ingests CycloneDX 1.6, validated against the official schema; the SBOM tools comparison covers the generators.

How to decide

1. Someone else specifies it. A customer contract, a procurement questionnaire, a platform you upload to. Do what they say; generate it directly rather than converting.
2. Vulnerability tracking is the main use. CycloneDX. Native PURLs, a simple dependency graph, VEX in the same document when you get to it.
3. Licence compliance is the main use. SPDX. File-level detail and licence expressions are what it was built for.
4. Both. Emit both from the same scan. Syft does it in one command per format and the cost is one extra file per image.

Frequently asked questions