SPDX (Linux Foundation; ISO/IEC 5962:2021 for version 2.2.1; version 3.0 adds profiles for security, AI and build) and CycloneDX (OWASP; ECMA-424; versions 1.6 and 1.7 add cryptography and attestation features) are the two formats; both identify packages with purls and CPEs and carry hashes. Generators (Syft, Trivy, cdxgen, build plugins) produce SBOMs from source, lockfiles, binaries or images.
An SBOM is only trustworthy when it is generated by the build and signed, typically as an in-toto attestation, and its quality depends on the generator's coverage. Regulations push adoption: US Executive Order 14028 (2021) for federal suppliers, and the EU Cyber Resilience Act (Regulation (EU) 2024/2847), whose Annex I requires manufacturers to draw up an SBOM covering at least top-level dependencies for products placed on the market from 11 December 2027.