bom mit Homebrew installieren

Projektlinks

• Homepage
• Repository

Befehle und Aliase

• bom

Projektgeschichte

The official README says bom was created as part of the effort to create an SBOM for the Kubernetes project. It later became a general-purpose CLI that can generate SPDX packages from directories, container images, single files, archives, and other sources.

The project is associated with the Linux Foundation's Automating Compliance Tooling Technical Advisory Council, placing it in the supply-chain compliance tooling ecosystem rather than only in Kubernetes internals.

Adoptionsgeschichte

bom's adoption follows the post-SolarWinds supply-chain tooling wave: SBOMs became expected release artifacts, and Kubernetes needed tooling that could fit CI, container images, Go dependency analysis, SPDX output, and in-toto provenance workflows. The input package facts list Homebrew, Nix, Scoop, and zypper packaging.

Wie es verwendet wird

Common usage is `bom generate` against a directory, file list, archive, or image, then `bom document` to inspect or query the resulting SPDX document. The README also documents license classification, `.gitignore` support, Go dependency analysis, and provenance export.

Warum Paket-Nerds sich dafür interessieren

bom is package-nerd significant because it is tooling about packages themselves: it turns source trees, images, and dependencies into machine-readable supply-chain metadata. It sits where package management, compliance, SPDX, Kubernetes release engineering, and container provenance meet.

Zeitleiste

• 2021: bom appears in Kubernetes SIG tooling around the Kubernetes SBOM effort.
• 2020s: bom grows into a general-purpose SPDX SBOM generator for files, directories, archives, container images, and Go dependencies.
• 2020s: The project is incubated under the Linux Foundation Automating Compliance Tooling TAC.

Related projects

• Related projects include Kubernetes, SPDX, in-toto, Syft, CycloneDX tooling, cosign, and other software supply-chain inventory tools.

Quellen

• https://github.com/kubernetes-sigs/bom#readme
• https://kubernetes-sigs.github.io/bom
• input.source_facts.package-manager