cudabom

cudabom proves which NVIDIA CUDA software is actually inside an artifact
(Python wheels, shared libraries, executables, and container images) and
turns that evidence into security-grade SBOM, advisory, and VEX data.

It specializes in CUDA component identity (cudart, cuBLAS/cuBLASLt, cuDNN,
NCCL, and more), including statically linked and vendored/renamed copies,
using an explicit evidence model with EXACT / LIKELY / UNKNOWN confidence. It
correlates findings against NVIDIA's machine-readable CSAF security bulletins
and enriches existing Syft/Trivy/PEP 770 SBOMs rather than replacing them.

cudabom never runs code on a GPU and never executes what it scans, so it runs
on any CI runner. Outputs a terminal table, native JSON, CycloneDX 1.6,
CycloneDX VEX, SARIF 2.1.0, and Markdown.

cudabom is an independent project and is not an NVIDIA product. Releases are
Sigstore-signed with SLSA Build Level 3 provenance.