If you're still emailing spreadsheets of dependencies to auditors or running manual SBOM scans before each release, you're wasting valuable engineering time that could be used for shipping features. The EU Cyber Resilience Act and similar regulations are here to stay, and your current SBOM workflow won't scale when you reach 50 microservices.
BOMHort offers a different approach: a Kubernetes-native platform that handles SBOM ingestion, deduplication, vulnerability tracking, and visualization without needing an external service. It joined the OpenSSF Sandbox, meaning it's developed under vendor-neutral governance and won't be paywalled next quarter.
Here's how to get it running in your cluster and actually use it.
What You Need Before Starting
You'll need:
- A Kubernetes cluster (1.24 or later recommended)
kubectlconfigured with cluster admin access- Helm 3.x installed
- At least 4GB of free memory for the initial deployment
- Your CI/CD pipeline already generating SBOMs in SPDX or CycloneDX format
- Network access to the OSV database (api.osv.dev) for vulnerability lookups
If you're not generating SBOMs yet, fix that first. Most build tools have plugins: syft for container images, cyclonedx-maven-plugin for Java projects, cargo-sbom for Rust. Get those running in your pipelines before you try to centralize the output.
Step-by-Step Implementation
1. Install BOMHort via Helm
Add the BOMHort Helm repository and install the chart:
helm repo add bomhort https://bomhort.io/charts
helm repo update
helm install bomhort bomhort/bomhort \
--namespace sbom-system \
--create-namespace
This deploys the core components: the ingestion API, the deduplication engine (using SHA256 hashing), the queue processor for batch vulnerability lookups, and the web UI.
2. Configure ingestion endpoints
BOMHort exposes an HTTP API for SBOM uploads. You'll need to configure your CI/CD to POST SBOMs after each build:
kubectl get svc -n sbom-system bomhort-api
Note the ClusterIP or create an Ingress if you're pushing from external CI runners. For GitHub Actions:
- name: Upload SBOM
run: |
curl -X POST \
-H "Content-Type: application/json" \
-d @sbom.spdx.json \
http://bomhort-api.sbom-system.svc.cluster.local/api/v1/sboms
BOMHort accepts SPDX, CycloneDX, and in-toto attestation envelopes. It'll deduplicate identical components across SBOMs automatically, so you're not storing 50 copies of the same Express.js version.
3. Set up the vulnerability refresh schedule
BOMHort runs daily CVE refreshers against the OSV database. You don't need to re-scan entire SBOMs when a new vulnerability drops. Configure the refresh interval:
kubectl edit configmap -n sbom-system bomhort-config
Set vulnerability.refresh.cron to your preferred schedule (default is 0 2 * * * for 2 AM daily). The batch lookup system queries OSV for all tracked components, not just changed ones, so you'll catch newly disclosed vulnerabilities without manual intervention.
4. Connect the web UI to your SSO
The visualization dashboard supports OIDC. If you're using Okta, Auth0, or Keycloak:
auth:
oidc:
issuerUrl: https://your-idp.com
clientId: bomhort-client
clientSecret: <stored in secret>
Apply this through the Helm values file and upgrade the release. Don't expose the UI publicly without authentication, your SBOM data reveals your entire dependency tree.
5. Tag SBOMs with metadata
You'll want to query SBOMs by service, environment, or compliance scope. Add labels when uploading:
curl -X POST \
-H "Content-Type: application/json" \
-H "X-BOMHort-Labels: service=payment-api,env=production,scope=pci" \
-d @sbom.spdx.json \
http://bomhort-api/api/v1/sboms
This lets you filter the UI to "show me all production services in PCI scope with high-severity vulnerabilities."
Validation: How to Verify It Works
Upload a test SBOM with a known vulnerable component. If you don't have one handy, generate an SBOM for a Node.js project using an old version of lodash (anything before 4.17.21 has CVE-2021-23337).
Check the UI within 5 minutes. You should see:
- The SBOM listed with correct metadata
- Lodash identified as a component
- CVE-2021-23337 flagged with severity and remediation version
Query the API directly to confirm deduplication is working:
curl http://bomhort-api/api/v1/components?name=lodash
You should see a single entry for each unique version of lodash across all uploaded SBOMs, not duplicate entries.
Test the queue-based scaling by uploading 10 SBOMs simultaneously. Check pod metrics:
kubectl top pods -n sbom-system
The queue processor should scale horizontally if you configured HPA. If it doesn't, you're processing serially and you'll have bottlenecks at 100+ services.
Maintenance and Ongoing Tasks
Weekly: Review the vulnerability dashboard for new CVEs. BOMHort's daily refresh means you'll see newly disclosed issues without manual scans, but someone needs to triage and assign remediation work.
Monthly: Audit the license compliance view. BOMHort tracks SPDX license identifiers, so you can catch GPL dependencies before they ship to customers. Export the report and send it to legal if you're in a regulated industry.
Quarterly: Clean up stale SBOMs. If a service is deprecated, delete its SBOMs to reduce storage and improve query performance:
curl -X DELETE http://bomhort-api/api/v1/sboms?service=old-payment-api
After major releases: Verify your CI/CD is still uploading SBOMs. It's easy to break the integration when you refactor build pipelines. Set up a Prometheus alert if no SBOMs are received in 24 hours.
When regulations change: The EU Cyber Resilience Act requires SBOMs for certain product categories. If your scope expands, update your labeling strategy to track which services fall under which regulations. BOMHort's metadata system lets you pivot quickly without rebuilding your entire tracking process.
The OpenSSF governance model means BOMHort won't disappear behind a paywall or get acquired and shut down. You're betting on a community-maintained tool, which comes with different risks than commercial software, but also different benefits. Contribute fixes upstream if you hit bugs, you'll get them merged faster than filing support tickets.
