Scroll to navigation

DEBSBOM-TRACE-PATH(1) debsbom DEBSBOM-TRACE-PATH(1)

NAME

debsbom-trace-path - debsbom trace-path command

SYNOPSIS

debsbom trace-path [-h] [-t {cdx,spdx}] [--format {text,json,ref,dot}]


                   [--mode {shortest,all-shortest,all}]


                   [bomin] source


DESCRIPTION

Trace path between components

Processes an SBOM and a package identifier and emits paths from this package to the root. The textual outputs (text and ref) are not considered stable and should not be parsed. The JSON output is in json-lines format, whereby each line adheres to the schema-download.json schema.

JSON Output Schema

When the application is run with JSON output enabled (via the --json flag), status messages are emitted as single-line JSON objects to standard output. Each line represents a single path from the package to the root.

The schema for these JSON objects is as follows:

{


  "$schema": "https://json-schema.org/draft/2020-12/schema",


  "$id": "https://raw.githubusercontent.com/siemens/debsbom/refs/heads/main/src/debsbom/schema/schema-trace-path.json",


  "title": "Trace Path Result",


  "description": "List of components on a path between a source and a destination component",


  "type": "array",


  "items": {


    "type": "object",


    "required": [


      "name",


      "ref"


    ],


    "properties": {


      "name": {


        "type": "string",


        "description": "Name of the component"


      },


      "ref": {


        "type": "string",


        "description": "Reference identifier for the component"


      },


      "version": {


        "type": [


          "string",


          "null"


        ],


        "description": "Version of the component"


      },


      "maintainer": {


        "type": [


          "string",


          "null"


        ],


        "description": "Maintainer of the component"


      },


      "purl": {


        "type": [


          "string",


          "null"


        ],


        "description": "Package URL of the component"


      }


    }


  }
}


OPTIONS

Positional Arguments

sbom file(s) to process for 'bomin'. Use '-' to read from stdin
source node (PURL)

Named Arguments

SBOM type to process (default: auto-detect), required when reading from stdin

Possible choices: cdx, spdx

path output format (default: 'text')

Possible choices: text, json, ref, dot

Possible choices: shortest, all-shortest, all

SEE ALSO

debsbom-generate(1)

DEBSBOM

Part of the debsbom(1) suite.

Author

Christoph Steiger, Felix Moessbauer

Copyright

2025, Siemens

April 14, 2026