Each Cirrus Link module now ships with a Software Bill of Materials (SBOM) bundled directly inside the .modl file. The SBOM is a complete, machine-readable inventory of the third-party components     

  included in the module, provided in the industry-standard CycloneDX format (JSON, schema 1.6).                                                                                                          

  The SBOM supports your supply-chain security and compliance workflows  vulnerability scanning, license review, and audit, without needing to install or run the module.

Because it's packaged inside  

  the signed .modl, it's covered by the module's code signature and travels with the module wherever it goes.                                                                                             

  To retrieve it, treat the .modl as a standard archive and extract the SBOM from its root:                                                                                                               

  unzip -j MyModule-signed.modl "*-SBOM.json"                                                                                                                                                             

  The file is named <ModuleName>-SBOM.json and can be loaded into any CycloneDX-compatible tool (e.g. Dependency-Track, Grype, or cyclonedx CLI).