Man page - debsbom-generate(1)

Packages contas this manual

Manual

DEBSBOM-GENERATE(1) debsbom DEBSBOM-GENERATE(1)

debsbom-generate - debsbom generate command

debsbom generate [-h] [-o OUT] [--distro-name DISTRO_NAME]


                 [--distro-supplier DISTRO_SUPPLIER]


                 [--distro-version DISTRO_VERSION]


                 [--base-distro-vendor {debian,ubuntu}]


                 [--cdx-standard {default,standard-bom}]


                 [--spdx-namespace SPDX_NAMESPACE]


                 [--cdx-serialnumber CDX_SERIALNUMBER] [--timestamp TIMESTAMP]


                 [--add-meta-data key=value] [--validate] [-t {cdx,spdx}]


                 [-r ROOT] [--from-pkglist] [--distro-arch DISTRO_ARCH]


                 [--with-licenses]


Generate a sbom for a debian system

The command creates comprehensive SBOMs that include all installed software packages and their dependencies. This command can be executed in an air-gapped environment.

Named Arguments

filename for output (default: 'sbom'). Use '-' to write to stdout
distro name (default: 'Debian')
supplier for the root component
version for the root component
vendor of debian distribution (debian or ubuntu)

Possible choices: debian, ubuntu

generate SBOM according to this spec (only for CDX)

Possible choices: default, standard-bom

document namespace, must be a valid URI (only for SPDX)
document serial number, must be a UUID in 8-4-4-4-12 format (only for CDX)
document timestamp in ISO 8601 format
add arbitrary metadata properties to the SBOM
validate generated SBOM (only for SPDX)
SBOM type to generate, can be passed multiple times (default: all)

Possible choices: cdx, spdx

root directory to look for dpkg status file and apt cache
create SBOM from a package list passed via stdin
native dpkg architecture of the distro ('auto')
parse and include license information

debsbom-decisions(1)

Part of the debsbom(1) suite.

Christoph Steiger, Felix Moessbauer

2025, Siemens

March 24, 2026