# Should I create a template, or just post-process to get an SPDX SBOM containing PURLs only?

**URL:** https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558
**Category:** Syft
**Created:** [September 11, 2025, 4:23pm UTC](https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558 "2025-09-11T16:23:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![eherget](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/eherget/32/354_2.png) [@eherget](https://anchorecommunity.discourse.group/u/eherget)
#### Post date: [September 11, 2025, 4:23pm UTC](https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558/1 "2025-09-11T16:23:06Z")

</div>

I would like to have syft generate SPDX SBOMs containing PURLs only, no CPEs. My thought is that using a template would be the “clean” way to do it. The alternative is to generate an SPDX SBOM, then post-process the output and strip out CPEs, leaving only PURLs. I would like some guidance on which approach I should take. If someone has already done the same thing using a template, I’d like to get a copy of the template.

Thanks in advance!

---

<div class="post-metadata">

### Author: ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)
#### Post date: [September 11, 2025, 7:06pm UTC](https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558/2 "2025-09-11T19:06:35Z")

</div>

Is it just CPEs you want to rip out, or something more?  
Making an SBOM small is great, but making it compliant is even better! 🙂

I don’t think there’s a template yet, unless someone speaks up below ⬇

---

<div class="post-metadata">

### Author: ![eherget](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/eherget/32/354_2.png) [@eherget](https://anchorecommunity.discourse.group/u/eherget)
#### Post date: [September 11, 2025, 7:48pm UTC](https://anchorecommunity.discourse.group/t/should-i-create-a-template-or-just-post-process-to-get-an-spdx-sbom-containing-purls-only/558/3 "2025-09-11T19:48:24Z")

</div>

I would like the SBOM to also be compliant (part of “clean” in my mind)! The project I’m working on is focused on PURLs so removing CPEs greatly reduces the size.
