Man page - debsbom-trace-path(1)

Packages contas this manual

Manual

DEBSBOM-TRACE-PATH(1) debsbom DEBSBOM-TRACE-PATH(1)

debsbom-trace-path - debsbom trace-path command

debsbom trace-path [-h] [-t {cdx,spdx}] [--format {text,json,ref,dot}]


                   [--mode {shortest,all-shortest,all}]


                   [bomin] source


Trace path between components

Processes an SBOM and a package identifier and emits paths from this package to the root. The textual outputs (text and ref) are not considered stable and should not be parsed. The JSON output is in json-lines format, whereby each line adheres to the schema-download.json schema.

When the application is run with JSON output enabled (via the --json flag), status messages are emitted as single-line JSON objects to standard output. Each line represents a single path from the package to the root.

The schema for these JSON objects is as follows:

{


  "$schema": "https://json-schema.org/draft/2020-12/schema",


  "$id": "https://github.com/siemens/debsbom/blob/main/src/debsbom/schema/schema-trace-path.json",


  "title": "Trace Path Result",


  "description": "List of components on a path between a source and a destination component",


  "type": "array",


  "items": {


    "type": "object",


    "required": ["name", "ref"],


    "properties": {


      "name": {


        "type": "string",


        "description": "Name of the component"


      },


      "ref": {


        "type": "string",


        "description": "Reference identifier for the component"


      },


      "version": {


        "type": ["string", "null"],


        "description": "Version of the component"


      },


      "maintainer": {


        "type": ["string", "null"],


        "description": "Maintainer of the component"


      },


      "purl": {


        "type": ["string", "null"],


        "description": "Package URL of the component"


      }


    }


  }
}


Positional Arguments

sbom file(s) to process for 'bomin'. Use '-' to read from stdin
source node (PURL)

Named Arguments

SBOM type to process (default: auto-detect), required when reading from stdin

Possible choices: cdx, spdx

path output format (default: 'text')

Possible choices: text, json, ref, dot

Possible choices: shortest, all-shortest, all

debsbom-generate(1)

Part of the debsbom(1) suite.

Christoph Steiger, Felix Moessbauer

2025, Siemens

March 24, 2026