# cdxgen mit Homebrew, Nix, winget installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für cdxgen in AI-Agent-Workflows.

## Installation

```sh
sudo av install brew:cdxgen
```

Weitere Installationsbefehle:

### macOS

- Homebrew (100%):

```sh
brew install cdxgen
```

  Evidenz: local Homebrew formula metadata

### Linux

- Nix (92%):

```sh
nix profile install nixpkgs#cdxgen
```

  Evidenz: nixpkgs package indexes: pkgs/by-name/cd/cdxgen/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

### Windows

- winget (92%):

```sh
winget install --id CycloneDX.cdxgen -e
```

  Evidenz: Windows Package Manager source index: CycloneDX.cdxgen from https://cdn.winget.microsoft.com/cache/source.msix

## Paketfakten

- **Paketschlüssel:** brew:cdxgen
- **Paketmanager:** Homebrew
- **Version:** 12.8.2
- **Quellzusammenfassung:** Creates CycloneDX Software Bill-of-Materials (SBOM) for projects
- **Homepage:** <https://github.com/CycloneDX/cdxgen>
- **Zuletzt aktualisiert:** 2026-07-27T12:16:43-04:00
- **Generiert:** 2026-08-03T19:37:03+00:00

## Executables

- aibom (Alias)
- cbom (Alias)
- cdx-audit (Alias)
- cdx-convert (Alias)
- cdx-sign (Alias)
- cdx-validate (Alias)
- cdx-verify (Alias)
- cdxgen (Alias)
- cdxgen-secure (Alias)
- cdxi (Alias)
- evinse (Alias)
- hbom (Alias)
- obom (Alias)
- saasbom (Alias)
- spdxgen (Alias)
- tracebom (Alias)

## Installationsverhalten

- Bottle: nicht verfügbar

## Version und Aktualität

- Seite generiert: 2026-08-03
- Manager-Version: 12.8.2
## Projektgeschichte und Nutzung

CycloneDX Generator, usually called cdxgen, is a CLI, library, REPL, and server for generating CycloneDX and SPDX software bill of materials documents from source trees, container images, binaries, hosts, and related inputs.

### Projektgeschichte

The GitHub API records the cdxgen repository as created on 2019-12-30. Its package metadata identifies @cyclonedx/cdxgen as the npm package and points to the official GitHub repository, while the README now presents cdxgen as a broader BOM toolkit covering SBOM, CBOM, OBOM, SaaSBOM, HBOM, AI-BOM, and validation/signing workflows.

The project grew from a CycloneDX SBOM generator into a multi-command supply-chain analysis suite with commands such as cdxgen, cdx-validate, cdx-convert, cdx-sign, cdx-verify, cdx-audit, evinse, hbom, obom, cbom, saasbom, aibom, and spdxgen.

### Adoptionsgeschichte

cdxgen's adoption tracks the rise of SBOM requirements in software supply-chain security. The README positions it for developers, AppSec, compliance teams, SOC analysts, hardware teams, and AI platform teams, and the supplied package-manager metadata shows Homebrew, Nix, and winget packaging in addition to npm and GitHub release binaries.

### Wie es verwendet wird

The common developer path is cdxgen -o bom.json . for a local project, with additional modes for containers, git URLs, purls, hosts, AI assets, and validation/conversion/signing. The README emphasizes CI/CD use and standalone binaries for several commands.

### Warum Paket-Nerds sich dafür interessieren

cdxgen is package-nerd significant because it turns package graphs into standardized artifacts that other tools can consume. It sits at the intersection of language package managers, container metadata, CycloneDX, SPDX, Dependency-Track-style workflows, and modern compliance demands.

### Zeitleiste

- 2019: GitHub API records the cdxgen repository as created on 2019-12-30.
- 2024: Git tags include the v10 series, showing the project had reached a mature major-version cadence.
- 2026: Homebrew formula packages cdxgen 12.7.0, and the README documents CycloneDX 1.5-1.7 plus SPDX 3.0.1 support.

### Related projects

- CycloneDX is the primary BOM specification cdxgen emits.
- OWASP Dependency-Track and depscan are adjacent downstream/security workflows referenced by the project documentation.
- SPDX is supported as an export format through cdxgen and cdx-convert.

### Quellen

- <https://api.github.com/repos/cdxgen/cdxgen>
- <https://github.com/cdxgen/cdxgen>
- <https://github.com/CycloneDX/cdxgen>
- <https://cdxgen.github.io/cdxgen>
- <https://github.com/cdxgen/cdxgen#readme>
- <https://formulae.brew.sh/api/formula/cdxgen.json>
- <https://api.github.com/repos/CycloneDX/cdxgen>
- <https://raw.githubusercontent.com/CycloneDX/cdxgen/master/package.json>


## Sicherheitshinweise

Für cdxgen wurde kein passendes lokales Secret-Handling-Manifest gefunden. Nucleus-Paketmetadaten bleiben hier veröffentlicht, damit künftige Abdeckung eine stabile Paket-URL hat.



## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: .cdxgenrc, .cdxgen.json, .cdxgen.yml, .cdxgen.yaml
## Andere Paketmanager-Einträge

- Nix - cdxgen: normalized package name match | nixpkgs package indexes: pkgs/by-name/cd/cdxgen/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- winget - CycloneDX.cdxgen: normalized package name match | Windows Package Manager source index: CycloneDX.cdxgen from https://cdn.winget.microsoft.com/cache/source.msix


## Combined YAML source

View the package source record on GitHub. [combined/cdxgen.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cdxgen.yml)


## Quellen

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph