Generate SBOM

Commands

git-pkgs sbom

git-pkgs sbom --format=spdx

• --format=FORMAT

  - output format:

  cyclonedx

  (default),

  spdx

• --output=FILE

  - write to file instead of stdout

• --json

  - JSON output (default for both formats)

When to use

• When compliance requires an SBOM (EO 14028, EU CRA)
• When sharing a software inventory with customers or auditors
• When feeding into vulnerability scanning or composition analysis tools
• When documenting what ships in a release