ocm get sbom

ocm get sbom

Get an orchestrating SBOM for a component version

Synopsis

Get an orchestrating Software Bill of Materials (SBOM) for a component version.

This command collects the baked SBOM of every resource in the given component version and assembles them into a single hierarchical CycloneDX document, printed to stdout. SBOMs are discovered at build time (by the SBoM/v1 input method or by adding a resource of type ‘sbom’ linked via the ‘ocm.software/sbom’ label) and embedded as local blobs; this command performs a pure local read and never fetches SBOMs from a registry.

Discovered SPDX SBOMs are normalized to CycloneDX so the whole document is a single CycloneDX BOM. Resources without a baked SBOM are skipped with a warning. Where a resource carries per-architecture SBOMs, the one matching the host platform is selected.

Use –output/-o to choose the serialization format (json or yaml). Redirect stdout to write a file.

With –recursive, the orchestration also descends into referenced (child) component versions, nesting their SBOMs under the parent.

ocm get sbom <component-version> [flags]

Examples

 # Orchestrating SBOM for a single component version (CycloneDX JSON)
  ocm get sbom ghcr.io/org/component:v1

  # As YAML
  ocm get sbom ghcr.io/org/component:v1 -o yaml

  # Include referenced child component versions, write to a file
  ocm get sbom ghcr.io/org/component:v1 --recursive > sbom.cdx.json

Options

  -h, --help                 help for sbom
  -o, --output enum          output format of the orchestrating SBOM
                             (must be one of [json yaml]) (default json)
      --recursive int[=-1]   depth of recursion into referenced component versions (0=none, -1=unlimited, >0=levels (not implemented yet))

Options inherited from parent commands

      --config stringArray                 supply configuration by a given configuration file.
                                           By default (without specifying custom locations with this flag), the file will be read from one of the well known locations:
                                           1. The path specified in the OCM_CONFIG environment variable
                                           2. The XDG_CONFIG_HOME directory (if set), or the default XDG home ($HOME/.config), or the user's home directory
                                           - $XDG_CONFIG_HOME/ocm/config
                                           - $XDG_CONFIG_HOME/.ocmconfig
                                           - $HOME/.config/ocm/config
                                           - $HOME/.config/.ocmconfig
                                           - $HOME/.ocm/config
                                           - $HOME/.ocmconfig
                                           3. The current working directory:
                                           - $PWD/.ocm/config
                                           - $PWD/.ocmconfig
                                           4. The directory of the current executable:
                                           - $EXE_DIR/.ocm/config
                                           - $EXE_DIR/.ocmconfig
                                           If multiple configuration files are found, they will be merged in the order they are discovered.
                                           Later entries have higher priority.
                                           Using the option, the specified configuration file(s) will be used instead of the lookup above.
      --logformat enum                     set the log output format that is used to print individual logs
                                              json: Output logs in JSON format, suitable for machine processing
                                              text: Output logs in human-readable text format, suitable for console output
                                           (must be one of [json text]) (default text)
      --loglevel enum                      sets the logging level
                                              debug: Show all logs including detailed debugging information
                                              info:  Show informational messages and above
                                              warn:  Show warnings and errors only (default)
                                              error: Show errors only
                                           (must be one of [debug error info warn]) (default info)
      --logoutput enum                     set the log output destination
                                              stdout: Write logs to standard output
                                              stderr: Write logs to standard error, useful for separating logs from normal output
                                           (must be one of [stderr stdout]) (default stderr)
      --plugin-directory string            default directory path for ocm plugins. (default "$HOME/.config/ocm/plugins")
      --plugin-shutdown-timeout duration   Timeout for plugin shutdown. If a plugin does not shut down within this time, it is forcefully killed (default 10s)
      --temp-folder string                 Specify a custom temporary folder path for filesystem operations.
      --working-directory string           Specify a custom working directory path to load resources from.

SEE ALSO

Prev
ocm get config
Next
ocm get types