Update a Project by Importing an SBOM File

Overview

Mend.io enables you to import a previously generated SBOM file, to update an existing project in the application.

An SBOM file traditionally specifies the libraries, code packages, and other third-party components that are used in your project.

Once imported, licensing and vulnerability data will be associated with your project’s dependencies, like any other project scanned into the application. Projects created or updated via SBOM imports will be regularly monitored for new vulnerabilities and updates.

What’s Supported?

Mend.io allows you to import SBOM files exported by the following tools:

• Mend.io’s SBOM Export Report

• CycloneDX cdxgen

• Trivy

• Syft

• DependencyTrack

Supported Standards and Schema Requirements

The supported SBOM standards are CycloneDX (versions 1.4, 1.5, 1.6) and SPDX (versions 2.2, 2.3).
Note: For CycloneDX 1.6, only semantic support is available.
CBOM, CDXA, and AI/ML are not supported.

The supported formats are JSON and XML.

Read more about the schema requirements for SPDX and CycloneDX to ensure a smooth import, especially when creating and importing a self-generated SBOM.

CPE Support

When a package in your SBOM has no Package-URL (PURL), the importer will attempt to identify it using CPE (Common Platform Enumeration) as a fallback.

• PURL always takes precedence when present.

• For best coverage, Mend.io recommends ensuring your SBOM generation tool produces PURL identifiers. CPE is a useful fallback but PURL provides unambiguous package identification. Tools like Syft, Trivy, and Black Duck typically produce PURLs for most packages.

CPE Best Practices

Mend.io resolves packages from CPE by using the vendor field to determine the package ecosystem. A well-formed CPE looks like:

cpe:2.3:a:<vendor>:<product>:<version>:*:*:*:*:*:*:*

For best results, the vendor field should identify the organization or ecosystem that publishes the package — not the package name itself.

Multiple CPE entries

When a package has multiple CPE entries (common in Black Duck SBOMs), the importer will pick the first one with a recognized vendor. This means even if one CPE is ambiguous, a second CPE with a known vendor will work.

Java/Maven Special Handling

For Java packages, Mend includes a built-in lookup table that maps CPE vendor+product pairs to Maven coordinates (groupId and artifactId). This covers popular libraries from Apache, Spring, Eclipse, and many others. For example:

• cpe:2.3:a:pivotal_software:spring-boot:2.7.0:*:*:*:*:*:*:* resolves to org.springframework.boot:spring-boot

• cpe:2.3:a:apache:struts:2.5.30:*:*:*:*:*:*:* resolves to org.apache.struts:struts

Limitations

• Vendor = Package Name: The importer will not import a package when the vendor is just the package name repeated, e.g., cpe:2.3:a:bash:bash:5.2.15:*:*:*:*:*:*:*

• Vendor Ambiguity: The importer will not import a package when the vendor exists across multiple ecosystems, e.g., cpe:2.3:a:protobuf:protobuf:1.4.2:*:*:*:*:*:*:* (Go, Java, etc.)

• Native C/C++ Libraries: The importer will not import a package that isn't distributed through a supported package manager, e.g., pcsc-lite.

• Invalid CPE Strings: The importer will not import a package where file paths or other non-CPE values are specified in the CPE field.

Supported Vendors by Ecosystem

Prerequisites

• Only users with the Product Admin or Organization Admin role can access the product’s Configuration Page and upload a previously generated SBOM file.

Getting it done

Update an Existing Project by Uploading an SBOM File via the Project Administration Screen

To import an SBOM report, you will need the relevant Product Admin (or an Organization Admin) to upload the SBOM file to the SCA application via the Project Administration page:

1. Find your project in the Projects menu and click it:
   

   

   Alternatively, you can navigate to the relevant product and locate the project under “Project Summary”.

2. Clicking the cogwheel button ( ) at the far right will take you to the Project Administration page.

3. Click “Update Project”:
   

   

4. In the Update Project window, click “Choose File” to browse your file system for the SBOM file. Click “Update” to upload the selected file.
   

   

   
   

Compare your SBOMs

Mend.io recommends using the existing “Project Comparison” report to compare SBOMs.

Limitations

1. Source libraries in SBOM Export files generated by Mend.io are ignored.

2. No vulnerability/VEX data in the SBOM file gets imported. Vulnerability information in the newly created/updated project is based on the Mend.io database.

3. No licensing data in the SBOM file gets imported. Licensing information in the newly created/updated project is based on the Mend.io database.

4. Keywords support limitations:

   • For SPDX, Mend.io supports the properties below:

     "DEPENDS_ON", 
     "DYNAMIC_LINK", 
     "STATIC_LINK", 
     "CONTAINS", 
     "DESCRIBE"
     

   • For CycloneDX, Mend.io supports the “dependsOn” property.
     Example:

     "ref": "pkg:maven/com.google.apis/google-api-services-ml@v1-rev20210212-1.31.0?type=jar", 
     "dependsOn": [ "pkg:maven/com.google.api-client/google-api-client@1.31.1?type=jar" ]