@indigo@social.labmonkeys.space
Post #3002805
2026-05-20 10:00 UTC
I had to scratch one of my itches. I have to work with SBOMs and I couldn't find something, so I'm announcing blitsbom — a zero-install, browser-only SBOM viewer.
Drop a CycloneDX or SPDX bom.json on the page, get a searchable view of every component, license category (FSF-classified), and — if you add a VEX file on top — known CVEs with severity. URL-encoded filters so you can share a view. CSV export for legal.
Every byte stays in your browser. No upload, no telemetry, no CDN. Works offline from file:// on an air-gapped machine. ~60 KB gzipped JS, 50 MB ~325 kB Docker image, MIT.
If you've ever wanted to just look at an SBOM without onboarding a platform — this is that.
→ https://github.com/no42-org/blitsbom
#sbom #opensource #selfhosting
Replies (3)
-
@ripienaar@devco.social 2026-05-20 12:05
@indigo@social.labmonkeys.space very nice!
-
@elricofmelnibone@mastodon.social 2026-05-20 12:10
@indigo@social.labmonkeys.space TIL there are multiple SBOM formats.
-
@hyc@mastodon.social 2026-05-20 13:28
@indigo@social.labmonkeys.space I don't get it. If this is zero install, why would anyone need it in a docker image?