Rio takes the CycloneDX SBOM your build writes, fixes it up, checks it, delivers it to Dependency-Track or an OCI registry, and keeps a receipt of what happened.

Your build writes target/bom.json. Add a rio.yaml to the project root:

version: 1
artifacts:
  - id: payments-api
    sbom: target/bom.json

enrichment:                        # what the SBOM generator doesn't know
  subject:
    supplier: {name: Example Payments GmbH}
    securityContact: mailto:[email protected]
    links:
      - label: Fact sheet
        url: https://ea.example.com/factsheet/Application/payments-api

delivery:
  targets:
    security:
      type: dependency-track
      url: https://dtrack.example.com
      apiKeyEnv: DTRACK_API_KEY
      autoCreate: true
      tags: [owner:payments]       # route findings to the owning team

Run Rio from the project root, in CI or on your machine:

$ export DTRACK_API_KEY=...        # from your secret store
$ rio
run run-27130d3b98f3aca30c764753c3cb7207: success
receipt: /src/payments-api/target/rio/runs/run-27130d3b98f3aca30c764753c3cb7207/record.json

Rio raised the SBOM from CycloneDX 1.4 to 1.6, added the supplier, security contact and fact-sheet link, checked that every component has a name, version and package URL, uploaded it, and read the project back to confirm the tag. The run directory holds the result:

target/rio/runs/run-27130d3b98f3aca30c764753c3cb7207/
├── payments-api.cdx.json   the SBOM, exactly as delivered
└── record.json             what changed, what was checked, what Dependency-Track confirmed

See the whole run: record.json · the delivered SBOM · HTML report · console output. It is Rio v0.10.0 on synthetic data, delivering to a synthetic Dependency-Track receiver; run it yourself, no server needed.

brew install rebaze/tap/rio

Or curl -sSL https://raw.githubusercontent.com/rebaze/rio/main/install.sh | sh, or download a release binary for Linux, macOS or Windows. Rio is a single binary with no runtime dependencies. Releases are signed, and the macOS binaries are notarized. More install options.

Exit code 0 is success, 1 a failed check (nothing was delivered), 2 a configuration or input error, and 3 to 5 a delivery that failed, was rejected or has an unknown outcome. All commands and exit codes.

• Normalizes. Raises older SBOMs to CycloneDX 1.6 (or 1.5) and keeps the dependency graph intact.
• Enriches. Adds supplier, manufacturer, security contact, issue tracker, release notes and labelled links from rio.yaml, and build and source facts from a context file. Each added value records where it came from. Enrichment
• Checks. Refuses to deliver when a component lacks a name, version or package URL, or the SBOM misses what you require, such as a security contact or the BSI TR-03183-2 profile. Each failure says how to fix it.
• Delivers. To Dependency-Track, with project tags, parent and latest-version flag, or to an OCI registry, standalone or attached to an image. Rio sends exactly the bytes it checked.
• Keeps a receipt. Digests of every input and output, each change, the check results and what the server answered. A lost response stays recorded as unknown; Rio never retries it blindly. Reading a receipt
• Covers multi-module builds. artifactSets picks up every module's SBOM and fails when one is missing.

Rio doesn't generate SBOMs or scan for vulnerabilities: it works on the SBOM your build already produces, and it uses the network only to deliver.

Paste this into your project's agent session:

Integrate Rio into this project. Read
https://raw.githubusercontent.com/rebaze/rio/main/docs/agent-integration.md
first. Inspect our build and existing configuration, ask only about unresolved
decisions, then configure and validate Rio. Report anything still needed.

Maintained by rebaze, licensed under Apache-2.0. Roadmap, scope and contributing · Report an issue