SBOM Diff Check vs. cyclonedx-cli diff
cyclonedx-cli is the official CycloneDX project's command-line tool, and its
diff subcommand compares two CycloneDX documents. It is a real, maintained tool for a real slice
of this job -- and it only reads CycloneDX, needs an install, and needs one extra flag before it lists which
packages actually changed. This page reads CycloneDX or SPDX, mixed formats included, with nothing to
install and nothing to remember.
What each tool is for
cyclonedx-cli (github.com/CycloneDX/cyclonedx-cli) is an Apache-2.0 licensed
binary maintained under OWASP CycloneDX, installed with brew install
cyclonedx/cyclonedx/cyclonedx-cli, the cyclonedx/cyclonedx-cli Docker image, or a
release download for your platform. Its diff subcommand, per its own documented options,
takes <from-file> <to-file> with --from-format/--to-format
of autodetect, json, protobuf, or xml -- CycloneDX's own
formats, not SPDX -- and needs the --component-versions flag to report which component
versions were added, removed, or modified; without it you get a different, lower-level document diff. It
also carries convert, merge, and validate subcommands this page has no equivalent of, because those are
CycloneDX document operations rather than a before/after package comparison.
This tool reads only each component's name and version, from CycloneDX or SPDX JSON -- including one of each, no conversion step -- and always reports the added, removed, and version-changed packages, in your browser, with nothing to install and no flag to get right.
| Question | Where to answer it |
|---|---|
Both my SBOMs are CycloneDX, and this needs to run inside a pipeline that already calls cyclonedx-cli for other operations. | cyclonedx-cli diff --component-versions -- one more subcommand on a binary you already have installed. |
| One of my two files is SPDX, or came from a tool that emits SPDX by default. | This page -- cyclonedx-cli diff does not accept SPDX input; you would need to convert first. |
| I want a quick answer with nothing to install, from a shared link or a support ticket. | This page -- paste both files, get the list, nothing to set up. |
| I want CycloneDX-native operations beyond diffing -- convert, merge, validate a document against the spec. | cyclonedx-cli -- this page does exactly one thing and has no equivalent for the rest. |
| Is anything I paste or pass uploaded anywhere? | Neither tool uploads anything on its own -- this page reads both files in your browser and makes no network call of its own; cyclonedx-cli runs locally as a CLI. |
The two are complementary rather than competing: a CycloneDX-only pipeline that already shells out to cyclonedx-cli loses nothing by keeping it for the diff step too. This page exists for the case it does not cover well -- SPDX input, or no CLI install at all.
Common questions
Should I use this page or cyclonedx-cli's diff command?
Depends what you are diffing and where. cyclonedx-cli is the official CycloneDX project's command-line tool (Apache-2.0, maintained under OWASP CycloneDX), installed via Homebrew, a Docker image, or a downloaded release binary, and its diff subcommand compares two CycloneDX documents in JSON, XML, or protobuf. If both of your SBOMs are already CycloneDX and you want the comparison wired into a pipeline that already runs the CLI for other CycloneDX operations (convert, merge, validate), use cyclonedx-cli. If one of your two files is SPDX -- or you just want a quick answer with nothing to install -- this page reads CycloneDX or SPDX directly, including one of each, entirely in your browser.
Does cyclonedx-cli's diff command read SPDX SBOMs?
Not directly. Per its own documented options, diff accepts --from-format and --to-format values of autodetect, json, protobuf, or xml -- there is no spdxjson option there, unlike cyclonedx-cli's separate convert command, which does read SPDX JSON. Comparing an SPDX build against a CycloneDX build with cyclonedx-cli means converting the SPDX file to CycloneDX first as an extra step. This page compares CycloneDX and SPDX directly, in any combination, with no conversion.
Do I need to install anything to run cyclonedx-cli's diff command?
Yes. cyclonedx-cli is a standalone binary you get via brew install cyclonedx/cyclonedx/cyclonedx-cli, a Docker image (cyclonedx/cyclonedx-cli), or a release download for your platform -- there is no browser version. That is a reasonable cost for a tool meant to live in CI. This page needs nothing installed: paste both files and read the result in the same tab, or use the matching zero-dependency Python CLI linked from the tool page if you want the same logic in your own pipeline.
Does cyclonedx-cli diff list added, removed, and changed packages by default?
Only with a flag. Per its documented options, the base diff output compares the two documents; getting a components-level report of what was added, removed, or modified needs the --component-versions flag on the same invocation. Skip it and you get a lower-level document diff instead of the added/removed/changed list most people are actually asking for. This page always shows that list -- there is no equivalent flag to remember.
Is this page affiliated with CycloneDX, OWASP, or the cyclonedx-cli maintainers?
No. This site is not affiliated with, endorsed by, or sponsored by CycloneDX, the OWASP Foundation, or the cyclonedx-cli maintainers. CycloneDX and cyclonedx-cli are named here only to describe what this checker is and is not, using facts drawn from the cyclonedx-cli project's own public documentation and source repository at github.com/CycloneDX/cyclonedx-cli.