CRA Deadline: September 11, 2026

Generating Your First SBOM in 5 Minutes

By Sydney Parker — Starcaller Intelligence Platform

Published July 18, 2026 · 4 min read

An SBOM — Software Bill of Materials — is a machine-readable list of every component in your software. Think of it as an ingredients label. The EU Cyber Resilience Act requires one for every product with digital elements sold in the EU. Here's how to generate your first one, for free, in 5 minutes.

What You'll Need

Python 3.9+ (you already have this)
A Python project with dependencies (any project with a requirements.txt or pyproject.toml)
The CRA Compliance Kit — pip install cra-compliance-kit

Step by Step

Install the kit

One command. MIT-licensed core — no keys, no signup, no credit card.

pip install cra-compliance-kit

Navigate to your project

Any directory with a requirements.txt, pyproject.toml, or setup.py works. The SBOM generator discovers dependencies automatically.

cd my-project

Generate the SBOM

This produces a CycloneDX 1.5 JSON file — the format accepted by the EU's ENISA reporting pipeline and most compliance tools.

python -m cra_compliance.sbom --format cyclonedx1.5 --output sbom.json

That's it. You now have a sbom.json file containing every direct and transitive dependency with version numbers, hashes, and license identifiers.

Check it against the CISA KEV catalog

The CRA requires monitoring for actively exploited vulnerabilities — not just any CVE. The free CRA Watch API does a daily CISA KEV match against your SBOM.

curl -X POST https://cra-watch.starcaller-teq.workers.dev/check \
  -H "Content-Type: application/json" \
  -d @sbom.json

If anything in your dependency tree matches an actively exploited CVE, you'll know immediately — not when GitHub Dependabot gets around to it.

Publish it alongside your release

Commit sbom.json to your repo and attach it to GitHub releases. Manufacturers downstream of you will look for it. Having it ready before they ask is how you stay the preferred dependency.

git add sbom.json
git commit -m "Add CycloneDX 1.5 SBOM for v1.2.0"
git tag v1.2.0
gh release create v1.2.0 sbom.json

What the SBOM Contains

Here's a sample of what the output looks like:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "components": [
    {
      "type": "library",
      "name": "requests",
      "version": "2.31.0",
      "purl": "pkg:pypi/requests@2.31.0",
      "hashes": [
        {"alg": "SHA-256", "content": "942c5a..."}
      ],
      "licenses": [{"license": {"id": "Apache-2.0"}}]
    }
  ]
}

Each component gets a Package URL (purl), SHA-256 hash, and license identifier. This is machine-readable, which means automated compliance pipelines can ingest it — exactly what manufacturers need for CRA Article 14 reporting.

What About Other Languages?

The CRA Compliance Kit's SBOM generator currently supports Python projects. For other ecosystems:

Node.js: cyclonedx-npm or @cyclonedx/bom
Rust: cargo cyclonedx
Java: cyclonedx-maven-plugin
Go: go-cyclonedx
Docker images: syft (Anchore)

Once you have an SBOM in CycloneDX format from any tool, you can still use the free CRA Watch API for CISA KEV matching — it's format-agnostic as long as the SBOM is valid CycloneDX.

Automating It

Add SBOM generation to your CI pipeline. Here's a GitHub Actions example:

# .github/workflows/sbom.yml
name: Generate SBOM
on:
  release:
    types: [published]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: {python-version: '3.11'}
      - run: pip install cra-compliance-kit
      - run: python -m cra_compliance.sbom --format cyclonedx1.5 --output sbom.json
      - uses: softprops/action-gh-release@v1
        with: {files: sbom.json}

Get the Kit — Free and Open Source

SBOM generation, CISA KEV monitoring, VEX generation, ENISA templates. MIT-licensed core.

pip install cra-compliance-kit Join Discord

Previous: What the EU CRA Means for Your GitHub Repo · Next: CISA KEV vs CRA Reporting