Introducing Waybill: the most comprehensive SBOM generation tool
Existing SBOM generators have gaps in ecosystem coverage, transitive dependency analysis, and data quality. Waybill gives you the depth and accuracy modern software supply chains actually need.
A good software bill of materials (SBOM) is the foundation of understanding your software supply chain. Not only does an SBOM satisfy customer requests and requirements for the regulations like CRA and FedRAMP, it provides data about the components that go into your software. Unfortunately, building a good SBOM is harder than it sounds. I’ve used dozens of tools and looked at many more, and they all have areas where they shine. They also have areas where they fall short. That’s why I built a new tool that reliably produces accurate, in-depth SBOMs across a variety of software ecosystems. Waybill is open source and available for you to use in an alpha state.
What makes Waybill different?
Waybill came from a simple need: Kusari customers needed to generate SBOMs to feed into the Kusari Trust Fabric. Our platform does a lot to augment, correlate, and otherwise improve the data that comes from the SBOM. But we saw that customer SBOMs often mis-reported dependencies — either by omitting entries that should be included or including entries that don’t belong — and didn’t accurately represent the dependency relationships. Most tools capture direct dependencies very well. Fewer capture transitive dependencies reliably, and almost none of them got the relationships right.
Most SBOM tools were built for “modern” software, and are often tied to a specific ecosystem.
npm sbom, for example, produces a good SBOM, but only if your software exclusively is in Node.js.
If you have a mixed-ecosystem application, software written in C/C++, or want to capture OS package SBOMs, the legacy tools won’t be much help.
I designed Waybill to work well in heterogeneous environments and to capture C/C++ package dependencies, which is important to many industries like medical device manufacturing.
Broad flexibility is what sets Waybill apart. For directory scans, Waybill can generate SBOMs with dependency relationships — crucial for building an accurate graph — for most ecosystems. With the same inputs, Trivy only generated relationship-containing SBOMs for four ecosystems and Syft produced none. Waybill reports npm license data from directory scans — no other tool does this from a directory scan. In addition, Waybill outperforms other tools in terms of SBOM quality: across a variety of ecosystems, Waybill had a mean sbomqs score of 8.04 compared to 5.26 for Syft and 4.06 for Trivy.
Waybill is designed to fit into modern software supply chain security. It includes attestation generation, including capturing version control system metadata for source-based SBOMs. Waybill includes evidence statements with a confidence level for the relationships it finds. And Waybill is the only tool that declares when its tree data is complete versus incomplete.
How Waybill is used
Waybill is now the default tool used for SBOM generation in Kusari products. That means that every internal and customer build generates an SBOM with Waybill. The result is SBOMs that give enough accuracy and completeness to power the visibility and automated vulnerability remediation that Kusari customers depend on to secure their software supply chain.
In addition, the Cloud Native Computing Foundation (CNCF) uses Waybill to generate per-release SBOMs across hundreds of projects — over 16,000 to date. These SBOMs are vital to CNCF’s upcoming obligations as a software steward under the European Union’s Cyber Resilience Act (CRA).
We’re generating hundreds of SBOMs each week with Waybill and now have the data we need to manage license compliance and coordinate vulnerability evaluations across more than 1500 CNCF projects and subprojects. Waybill provides the data quality and flexibility we need at this scale in a way we haven’t been able to get before.
— Mario Fahlandt, CNCF Technical Oversight Committee member
Join us
I created Waybill as an open source project because I believe it’s important that the rest of the software industry has the same high quality SBOMs that Kusari customers get. Software supply chain security is a collective effort — we’re all dependent on each other.
Download the latest build and give Waybill a try. In particular, I’d love to know about the edge cases where Waybill needs improvement. The feedback we got from the CNCF and from internal testing has been key to making rapid improvements.
If you’re interested in contributing, we welcome your help. I wrote Waybill in Rust because it has great tooling for binary introspection and makes it easy to encode the CycloneDX and SPDX SBOM specifications. I also just like the language, to be honest.
Apart from general quality improvements, I’m most excited about improving our runtime SBOM generation based on eBPF tracing and generating in-toto attestations based on the OpenSSF SBOMit specification. As we get the SBOM generation features ready for a 1.0 state, I’d like to see additional tooling for supply chain activities like SBOM comparison.
If any of this sounds interesting to you, check out the GitHub repo. If you want to see how Kusari customers benefit from the depth and accuracy of Waybill for managing software supply chain security, especially in a post-Mythos world, schedule a demo.