vulkro sbom

Writes a Software Bill of Materials (SBOM) for the project, or checks an existing SBOM for missing fields.

vulkro sbom . > sbom.cdx.json                    # CycloneDX 1.6
vulkro sbom . --format spdx > sbom.spdx.json     # SPDX 2.3
vulkro sbom --check sbom.cdx.json                # completeness check

Match the SBOM against vulnerability data later with vulkro match-cve.

Flags

Flag	Description
--format <FORMAT>	Output format (table below). Default cyclonedx.
--check <FILE>	Check an existing CycloneDX or SPDX JSON file instead of generating one. Names each missing field with a fix.
--profile <PROFILE>	Field set for --check: ntia (default) or cert-in (adds the CERT-In v2.0 fields as recommendations).

Format	Output
cyclonedx	CycloneDX 1.6 SBOM (default).
cyclonedx-1.7	CycloneDX 1.7 SBOM.
spdx	SPDX 2.3 SBOM.
spdx3	SPDX 3.0.1 JSON-LD SBOM.
cbom, cbom-1.7	Cryptographic BOM: each weak algorithm found, with file and line.
aibom	AI BOM: AI SDKs, model names, model files and MCP servers, with file and line.
openvex	OpenVEX 0.2.0 statements per dependency CVE, with not_affected backed by reachability.
cyclonedx-vex	The same verdicts as CycloneDX 1.6 VEX.

Exit codes

0 SBOM written, or --check found no required gaps. 1 --check found required gaps. 2 IO or parse failure.

See also: vulkro cra-bundle, Output formats.