Name: SBOM Registry — App Coverage (Monthly)
Brand: CRM Sync
SKU: sbom-registry
Price: 49.00 USD
Availability: InStock

Document stack with content lines — SBOM registry, monochrome line art

SBOM Registry — App Coverage (Monthly)

$49.00

An always-current parts-list for every app release — generated for you, kept honest. The EU rule doesn't want a parts-list once; it wants one that's always current. This generates it from your code on every release, so it can never quietly drift out of date.

How it works

Every release, the parts-list is generated straight from your lockfile — automatically.
It's served from a registry, one address per version, ready to scan for known issues.
Private by default — shown to authorities or customers on request, not posted for attackers.

What makes it different

A parts-list you write by hand is stale the day after you finish it. This one can't drift — it's built from the code itself, on every push, so "keep it current" happens on its own.

Under the hood

CycloneDX generated per release from the lockfile; registry-served and content-addressed (ETag = SHA-256); scan-ready for Grype and Dependency-Track; private by default.

Preview the vault wizard → — browse the Upload, Access, SBOM, Embed, and Vault tabs before you buy; it unlocks the moment your order is paid.

Open the Channel Wizard →

Mint an attributed link or QR for this product — preview it free in the modal; minting unlocks with the Channel Publish add-on.

A machine-readable CycloneDX SBOM for every app release, generated in CI from your lockfile and kept in a vulnerability-scanned registry — current by construction.

What you get

✓A CycloneDX SBOM per release — auto-generated from the lockfile.
✓A private registry — stores and version-tracks each document, vulnerability-scanned in place.
✓A CI key — push from your pipeline; a disclosure path for authorities and customers on request.

The Cyber Resilience Act expects a current Software Bill of Materials for every product you ship — not one produced once and left to rot. Hand-maintained, it drifts from the build the day after you write it.

Documents follow the standards regulators name — CycloneDX (ECMA-424), SPDX (ISO/IEC 5962), the NTIA minimum elements, and BSI TR-03183-2. Private by default.