macOS
Homebrewverified · 100%
brew install bomprovider-native install command
brew / rank 7587
Install bom with Homebrew
Utility to generate SPDX-compliant Bill of Materials manifests. Version 0.7.1 via Homebrew; verified 2026-07-26.
install
Additional install commands
overview
Package summary
Utility to generate SPDX-compliant Bill of Materials manifests
Project links
Commands and aliases
- bom
history
Project history and usage
bom is the Kubernetes SIGs SBOM multitool for creating, viewing, and transforming Software Bills of Materials, especially SPDX documents.
Project history
The official README says bom was created as part of the effort to create an SBOM for the Kubernetes project. It later became a general-purpose CLI that can generate SPDX packages from directories, container images, single files, archives, and other sources.
The project is associated with the Linux Foundation's Automating Compliance Tooling Technical Advisory Council, placing it in the supply-chain compliance tooling ecosystem rather than only in Kubernetes internals.
Adoption history
bom's adoption follows the post-SolarWinds supply-chain tooling wave: SBOMs became expected release artifacts, and Kubernetes needed tooling that could fit CI, container images, Go dependency analysis, SPDX output, and in-toto provenance workflows. The input package facts list Homebrew, Nix, Scoop, and zypper packaging.
How it is used
Common usage is `bom generate` against a directory, file list, archive, or image, then `bom document` to inspect or query the resulting SPDX document. The README also documents license classification, `.gitignore` support, Go dependency analysis, and provenance export.
Why package nerds care
bom is package-nerd significant because it is tooling about packages themselves: it turns source trees, images, and dependencies into machine-readable supply-chain metadata. It sits where package management, compliance, SPDX, Kubernetes release engineering, and container provenance meet.
Timeline
- 2021: bom appears in Kubernetes SIG tooling around the Kubernetes SBOM effort.
- 2020s: bom grows into a general-purpose SPDX SBOM generator for files, directories, archives, container images, and Go dependencies.
- 2020s: The project is incubated under the Linux Foundation Automating Compliance Tooling TAC.
Related projects
- Related projects include Kubernetes, SPDX, in-toto, Syft, CycloneDX tooling, cosign, and other software supply-chain inventory tools.
Sources
- https://github.com/kubernetes-sigs/bom#readme
- https://kubernetes-sigs.github.io/bom
- input.source_facts.package-manager
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
bom | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version0.7.1
manager updated2026-07-26
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:bom |
|---|---|
| Version | 0.7.1 |
| Package manager | Homebrew |
| Homepage | https://kubernetes-sigs.github.io/bom/ |
| Repository | https://github.com/kubernetes-sigs/bom |
| Last updated | 2026-07-26T10:56:34+02:00 |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- curated package history
- pkgdb category and tag curation