Skip to main content

vulkro sbom

Pro

vulkro sbom is part of Pro: SBOM (sbom), the bill of materials, in every format an auditor asks for. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Emit a Software Bill of Materials for the project. Same data as vulkro scan <path> --format cyclonedx, but a focused subcommand for the "I just need the SBOM" use case. Produce the inventory once with sbom, then match it against advisories whenever the CVE bundle updates with vulkro match-cve.

Usage​

vulkro sbom [PATH] --format cyclonedx > sbom.json
ArgumentDescriptionDefault
PATHPath to the project root..

Flags​

FlagDescription
--format <FORMAT>Output format (default cyclonedx).
FormatMeaning
cyclonedxCycloneDX 1.6 JSON SBOM (library components). Default.
cyclonedx-1.7CycloneDX 1.7 JSON SBOM; same shape, newer specVersion.
spdxSPDX 2.3 JSON SBOM.
spdx3SPDX 3.0.1 JSON-LD SBOM (@context + @graph).
cbomCycloneDX 1.6 CBOM: one cryptographic-asset component per detected weak algorithm (MD5, SHA-1, ECB, RC4, DES, static IV, insecure RNG), with file:line occurrences.
cbom-1.7CycloneDX 1.7 CBOM with a richer post-quantum descriptor.
openvexOpenVEX 0.2.0 exploitability statements per dependency CVE, not_affected backed by reachability analysis.
cyclonedx-vexCycloneDX 1.6 VEX (the same verdicts as openvex).

The 1.6 / 2.3 formats stay the defaults; 1.7 / 3.0.1 are additive opt-ins.

Exit codes​

  • 0 on success.
  • 2 on IO failure.

Examples​

# CycloneDX 1.6 (default).
vulkro sbom . > sbom.cdx.json

# SPDX 2.3, then match against the local CVE bundle.
vulkro sbom . --format spdx > sbom.spdx.json
vulkro match-cve --sbom sbom.spdx.json --format table

Command reference​

Generated from vulkro help sbom on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] List every package the project depends on, in a standard file format (SBOM).

[Pro] Emit a Software Bill of Materials for the project. Same data as `vulkro scan <path> --format cyclonedx`, but a focused subcommand for the "I just need the SBOM" use case.

Exit code: 0 on success, 2 on IO failure.

Usage: vulkro sbom [OPTIONS] [PATH]

Arguments:
  [PATH]
          [default: .]

Options:
      --format <FORMAT>
          Output format. `cyclonedx` (CycloneDX 1.6 JSON SBOM, default), `cyclonedx-1.7` (CycloneDX 1.7), `spdx` (SPDX 2.3 JSON SBOM), `spdx3` (SPDX 3.0.1 JSON-LD), `cbom` (CycloneDX 1.6 CBOM listing detected weak crypto algorithms with file:line occurrences; same emitter as `vulkro scan --format cbom`), or `cbom-1.7` (CycloneDX 1.7 CBOM with a richer post-quantum descriptor). The 1.6 / 2.3 formats stay the defaults; 1.7 / 3.0.1 are additive opt-ins

          Possible values:
          - cyclonedx:     CycloneDX 1.6 JSON SBOM (library components only). Default
          - cyclonedx-1.7: CycloneDX 1.7 JSON SBOM. Same shape, newer `specVersion`
          - spdx:          SPDX 2.3 JSON SBOM
          - spdx3:         SPDX 3.0.1 JSON-LD SBOM (`@context` + `@graph`)
          - cbom:          CycloneDX 1.6 CBOM: one `cryptographic-asset` component per detected weak algorithm (MD5, SHA-1, ECB, RC4, DES, static IV, insecure RNG), with file:line occurrences inlined under `evidence.occurrences`. Same emitter as `vulkro scan --format cbom`
          - openvex:       OpenVEX 0.2.0 exploitability statements for each dependency CVE, `not_affected` backed by reachability analysis
          - cyclonedx-vex: CycloneDX 1.6 VEX (the same verdicts as `openvex`)
          - cbom-1.7:      CycloneDX 1.7 CBOM: same grouping as `cbom` plus a richer post-quantum descriptor. Same emitter as `vulkro scan --format cbom-1.7`
          
          [default: cyclonedx]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -h, --help
          Print help (see a summary with '-h')
Last updated on