Scroll to navigation

DEBSBOM-GENERATE(1) debsbom DEBSBOM-GENERATE(1)

NAME

debsbom-generate - debsbom generate command

SYNOPSIS

debsbom generate [-h] [-o OUT] [--distro-name DISTRO_NAME]


                 [--distro-supplier DISTRO_SUPPLIER]


                 [--distro-version DISTRO_VERSION]


                 [--base-distro-vendor {debian,ubuntu}]


                 [--cdx-standard {default,standard-bom}]


                 [--spdx-namespace SPDX_NAMESPACE]


                 [--cdx-serialnumber CDX_SERIALNUMBER] [--timestamp TIMESTAMP]


                 [--add-meta-data key=value] [--validate] [-t {cdx,spdx}]


                 [-r ROOT] [--from-pkglist] [--distro-arch DISTRO_ARCH]


                 [--with-licenses]


DESCRIPTION

Generate a sbom for a debian system

The command creates comprehensive SBOMs that include all installed software packages and their dependencies. This command can be executed in an air-gapped environment.

OPTIONS

Named Arguments

filename for output (default: 'sbom'). Use '-' to write to stdout
distro name (default: 'Debian')
supplier for the root component
version for the root component
vendor of debian distribution (debian or ubuntu)

Possible choices: debian, ubuntu

generate SBOM according to this spec (only for CDX)

Possible choices: default, standard-bom

document namespace, must be a valid URI (only for SPDX)
document serial number, must be a UUID in 8-4-4-4-12 format (only for CDX)
document timestamp in ISO 8601 format
add arbitrary metadata properties to the SBOM
validate generated SBOM (only for SPDX)
SBOM type to generate, can be passed multiple times (default: all)

Possible choices: cdx, spdx

root directory to look for dpkg status file and apt cache
create SBOM from a package list passed via stdin
native dpkg architecture of the distro ('auto')
parse and include license information

SEE ALSO

debsbom-decisions(1)

DEBSBOM

Part of the debsbom(1) suite.

Author

Christoph Steiger, Felix Moessbauer

Copyright

2025, Siemens

March 20, 2026