ISbomComponent

ISbomComponent exposes the SBOM (Software Bill of Materials) tab of a project to the Advanced Installer COM automation surface.

SBOM generation is an Enterprise (or higher, e.g. Architect) feature. On lower license levels the SbomComponent property is not available, and enabling GenerateSbom requires the appropriate license.

SBOM locations

Several members work with the SBOM location, the place where the generated SBOM is stored. The values returned by SupportedSbomLocations are:

• IncludeInPackage - the SBOM is embedded inside the built package.
• AddAlongsidePackage - the SBOM is written next to the built package.
• IncludeInPackageAndAddAlongside - the SBOM is both embedded in the package and written alongside.

Properties

GenerateSbom - Enables or disables SBOM generation for the package. Returns $true when the package is configured to generate an SBOM at build time. Enabling it requires an Enterprise (or higher) license. Disabling it clears the related configuration: the SBOM location is reset to its default, the custom build component folder is removed, and all external SBOM files are dropped.

SbomLocation - Gets or sets where the generated SBOM is placed, as one of the SupportedSbomLocations values. GenerateSbom must be enabled before setting it, otherwise an error is raised. Passing a value that is not in SupportedSbomLocations raises an error that lists the accepted values.

SupportedSbomLocations - Read-only, Returns an array with the accepted SbomLocation values: IncludeInPackage, AddAlongsidePackage and IncludeInPackageAndAddAlongside. Useful for validating a value before assigning it to SbomLocation.

BuildComponentFolder - Gets or sets the custom folder used to build the SBOM component. Returns an empty string when no custom folder is set. GenerateSbom must be enabled before setting it, otherwise an error is raised. Assigning an empty string clears the custom folder.

ExternalSbomFiles - Returns the paths of the external SBOM files currently associated with the package, or an empty array when SBOM generation is disabled or no external files were added.

NamespaceUriBase - Gets or sets the base URI used as the SPDX document namespace prefix. The value is prepended to a unique suffix by sbom-tool to form the final SPDX document namespace. Returns an empty string when none has been set.

The setter enforces two preconditions:

• GenerateSbom must be $true, otherwise the error "Set GenerateSbom to true before configuring SBOM" is raised.
• A non-empty value must be an absolute http or https URL (e.g. https://your-company.com/your-product); if the value does not meet this requirement the error "Invalid Namespace URI base. Use an absolute http(s) URL, e.g. https://your-company.com/your-product" is raised.

Assigning an empty string clears the previously stored URI base without raising an error.

ParsePackageMetadata - Gets or sets whether sbom-tool scans installed packages and parses their metadata (e.g. NuGet, npm, pip manifests) during SBOM generation. Enabled by default. The setter requires GenerateSbom to be $true; if it is not, the error "Set GenerateSbom to true before configuring SBOM" is raised.

FetchLicenseInfo - Gets or sets whether sbom-tool queries external sources (e.g. ClearlyDefined) to resolve license information for the packages it detects. Disabled by default; enabling it requires outbound network access at build time and may increase build duration. The setter requires GenerateSbom to be $true; if it is not, the error "Set GenerateSbom to true before configuring SBOM" is raised.

Methods

AddExternalSbomFile - Adds an external SBOM file to the package. GenerateSbom must be enabled, otherwise an error is raised. An empty path raises an error. The path must be an SPDX document — it must end with .spdx.json (case-insensitive), otherwise an error is raised; this matches the GUI, which only allows SPDX files to be picked. A path that is already in ExternalSbomFiles is ignored, so no duplicate is created.

RemoveExternalSbomFile - Removes the external SBOM file whose path matches the argument. A path that is not present is silently ignored.

Examples

Example 1: Enable SBOM generation and choose a location

$advinst = New-Object -ComObject "AdvancedInstaller"
$proj    = $advinst.CreateProject($advinst.ProjectTypes.Architect)
$sbom    = $proj.SbomComponent

$sbom.GenerateSbom = $true
$sbom.SbomLocation = "IncludeInPackage"

if ($sbom.GenerateSbom) { "SBOM generation is enabled" }

Example 2: Attach and list external SBOM files

$sbom.AddExternalSbomFile("C:\sbom\third-party.spdx.json")
$sbom.AddExternalSbomFile("C:\sbom\manifest.spdx.json")

foreach ($file in $sbom.ExternalSbomFiles) { $file }

$sbom.RemoveExternalSbomFile("C:\sbom\manifest.spdx.json")

Example 3: Full SBOM configuration

$advinst = New-Object -ComObject "AdvancedInstaller"
$proj    = $advinst.CreateProject($advinst.ProjectTypes.Architect)
$sbom    = $proj.SbomComponent

# Enable SBOM generation and choose where it ends up.
$sbom.GenerateSbom = $true
$sbom.SbomLocation = "IncludeInPackageAndAddAlongside"

# Optionally point to a custom build component folder.
$sbom.BuildComponentFolder = "C:\build\sbom-components"

# Attach external SBOM files.
$sbom.AddExternalSbomFile("C:\sbom\third-party.spdx.json")

$proj.SaveAs("C:\work\projtest.aip")