Izumi: An LLM-Powered SBOM Generator Built Out of Frustration

If you've ever stared at hundreds of SCA matches wondering which ones actually matter, this tool was built for you. I recently released Izumi — an SBOM generation tool, and here's the story behind it. SBOM stands for Software Bill of Materials — a document that describes which OSS libraries and other components are included in a given software product. It is becoming an essential part of software license management and supply chain security. In Europe, regulations such as the Cyber Resilience Act (CRA) will make SBOM creation mandatory by 2027. The problem with existing tools I work as an embedded software engineer, and our field is no exception when it comes to preparing for these requirements. When I had the opportunity to create an SBOM at work, I researched the available OSS tools and found that most of them assumed a package manager-based development environment. Tools that worked easily with C/C++ projects — especially in embedded software development contexts — were surprisingly