Request SBOMs from your suppliers

You are responsible for the components you ship, including the ones other companies make. When a supplier provides a component, you can ask it for that component's own software bill of materials (SBOM). Declara emails the supplier a link, the supplier uploads one file, and you get it back stored and scored.

Before you start

• A Growth or Partner plan.
• A published disclosure page. The supplier's link lives under it, so the form is hidden until it is published.
• A member, admin or owner role (products.write) to send or withdraw a request.

Send a request

1. Open Components, then Supplier SBOMs.
2. Enter the Supplier (the company) and the Supplier email the link goes to.
3. Enter the Component you need the SBOM for, such as a library or a module.
4. Set Expires after (days), from 1 to 30. A request cannot stay open longer.
5. Tick the products the component goes into. At least one is required.
6. Add a Message if you want. It is sent as plain text.
7. Press the send button.

Declara emails the supplier a link under your disclosure page. Replies to that email come to your workspace's notification addresses, or to you when none are set.

The link is in that email and nowhere else. Declara keeps a hash of the secret, not the link, so it is not shown on screen and cannot be recovered later. If a supplier loses it, withdraw the request and send a new one. If the email cannot be sent, the request is withdrawn at once and you are told, so you can try again. On a deployment with no mail provider configured, the request stays open but no email exists, so withdraw it and send a new one once mail works.

What the supplier sees

The supplier opens the link and sees who is asking, the component, your message and the date the link stops working. It accepts one file: a CycloneDX or SPDX document in JSON, XML or tag-value form, up to 25 MB. The file goes straight to private storage and is visible only to your workspace.

The link works once. After the file is accepted it refuses any further upload, and the supplier is told to reply to the email if a corrected file is needed. An expired, withdrawn, already answered or mistyped link all get the same answer, so a link tells nobody whether a request exists. Requests from one address are rate limited.

Reminders, expiry and withdrawing

• Reminders. If the supplier has not answered, Declara sends a reminder 7 days and another 14 days after the request, while it is open. A reminder cannot repeat the link. It points the supplier to the first email by date and reference, and asks for a reply if the link is lost. A reminder whose send fails is not retried; the next one still goes out. Nothing is sent after the request expires.
• Expiry. At the end of the period the request becomes Expired and the link stops working.
• Withdraw. Press Withdraw on a request that is still waiting. Its link stops working at once, and the request shows as Withdrawn. Withdrawing needs no plan feature, so a link can always be stopped.

What you get

When the file arrives, the request shows Received and your notification addresses get an email. The Received list on the same page shows the supplier, the component, the products it goes into, the detected format and component count, and the SBOM's quality score: how much of the BSI TR-03183-2 field coverage the file carries, and the checks it missed. Download returns the file exactly as the supplier sent it. A file that cannot be read is marked Unreadable, with the reason.

What it does not do yet

A supplier's SBOM is stored and scored. It is not merged into your product's component inventory and it is not matched against advisories. It describes the supplier's component, not your build, so it never raises an alert or changes a release gate. Treat it as the record of the diligence you asked for, and read it with your component review.

Related

• Review a component
• Check SBOM quality
• Share an SBOM with a customer
• Known limitations