SBOM Format Selection: CycloneDX, SPDX, and SWID A source-grounded comparison for choosing a machine-processable software bill of materials format for vulnerability operations, compliance exchange, and installed-asset inventory.