Skip to main content

vulkro-sf sbom

List the packages the Salesforce project depends on, in a standard file format (SBOM)

Command reference​

Generated from vulkro-sf sbom --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

List the packages the Salesforce project depends on, in a standard file format (SBOM).

vulkro-sf sbom [OPTIONS] [PATH]

Arguments​

ArgumentDescription
[PATH]Path to the SFDX project or retrieved metadata (defaults to the current directory) Default: ..

Options​

FlagDescription
-o, --output <OUTPUT>Write the SBOM JSON to this file instead of stdout.
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf sbom --help
List the packages the Salesforce project depends on, in a standard file format (SBOM).

Generate a CycloneDX 1.6 SBOM for the Salesforce package dependencies.

Enumerates the project's dependency surface and writes a CycloneDX 1.6 JSON Software Bill of Materials that AppExchange and enterprise vendor-risk reviewers ask an ISV to attach to a submission. Four component families are collected:

* static-resource JS libraries (jQuery, Lodash, CryptoJS, Bootstrap) vendored under `**/staticresources/`, with their detected version; * managed-package dependencies declared in `sfdx-project.json` (`packageDirectories[].dependencies`) and `*.installedPackage-meta.xml` metadata; * npm dependencies (LWC test harness / Jest / build tooling); * Maven dependencies (Ant / MDAPI build tooling).

The output is a standard CycloneDX 1.6 document (`bomFormat: "CycloneDX"`, `specVersion: "1.6"`) consumable by Dependency-Track and any SBOM tool. Needs a licence (the 14-day trial or Pro), like every scanning command (the same gate as the AppExchange readiness report).

Exit codes: 0 = SBOM generated; 1 = no licence (stderr ends with `vulkro: license_required`); 2 = error (unscannable path, output not writable).

Usage: vulkro-sf sbom [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the SFDX project or retrieved metadata (defaults to the current directory)
          
          [default: .]

Options:
  -o, --output <OUTPUT>
          Write the SBOM JSON to this file instead of stdout

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on