cudabom proves which NVIDIA CUDA software is actually inside an artifact (Python wheels, shared libraries, executables, and container images) and turns that evidence into security-grade SBOM, advisory, and VEX data.

It specializes in CUDA component identity (cudart, cuBLAS/cuBLASLt, cuDNN, NCCL, and more), including statically linked and vendored/renamed copies, using an explicit evidence model with EXACT / LIKELY / UNKNOWN confidence. It correlates findings against NVIDIA's machine-readable CSAF security bulletins and enriches existing Syft/Trivy/PEP 770 SBOMs rather than replacing them.

cudabom never runs code on a GPU and never executes what it scans, so it runs on any CI runner. Outputs a terminal table, native JSON, CycloneDX 1.6, CycloneDX VEX, SARIF 2.1.0, and Markdown.

cudabom is an independent project and is not an NVIDIA product. Releases are Sigstore-signed with SLSA Build Level 3 provenance.