With public launch · Q3 2026
SBOM generation
The deep dive on how crawin reads your manifests, lock files, and container layers, then produces CycloneDX 1.6 and SPDX 3.0 outputs your auditor and your CI both accept.
What this page will cover
- Supported ecosystems: npm, pypi, cargo, go modules, maven, gradle, composer, rubygems, cocoapods, swift, nuget, hex, pub, apt — 14 in total
- Container SBOM via layer-level resolution (Docker, OCI, distroless)
- cosign signing and SLSA L3 attestation included
- Side-by-side CycloneDX vs SPDX with the same data
- CI examples: GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins