macOS
Homebrewverified · 100%
brew install bomctllocal Homebrew formula metadata
brew / rank 11921
Install bomctl with Homebrew, apk, zypper
Format-agnostic SBOM tooling for the stages between SBOM generation and analysis. Version 0.4.3 via Homebrew; verified 2026-07-26. Also installable with apk: sudo apk add bomctl.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add bomctlAlpine Linux edge package indexes · bomctl · source: dl-cdn.alpinelinux.org
openSUSE zypperverified · 92%
sudo zypper install bomctlopenSUSE Tumbleweed package metadata · bomctl · source: download.opensuse.org
overview
Package summary
Format-agnostic SBOM tooling for the stages between SBOM generation and analysis
Project links
Commands and aliases
- bomctl
history
Project history and usage
bomctl is experimental, format-agnostic SBOM tooling intended to bridge the gap between SBOM generation and SBOM analysis tools.
Project history
The GitHub repository was created in January 2024. The README identifies bomctl as an OpenSSF Sandbox project under active development and says it builds on protobom for an SBOM-agnostic component graph.
Adoption history
The project documents installation through a Homebrew tap, container images on Docker Hub, and source builds, and the supplied package facts show availability through Homebrew, apk, and zypper.
How it is used
Users fetch, import, list, alias, merge, tag, export, and push SBOMs. bomctl stores SBOMs in a persistent cache and can fetch over HTTPS, OCI, Git, GitHub, and GitLab.
Why package nerds care
bomctl is interesting to package and supply-chain users because it treats SBOMs as package-like artifacts that can be cached, transformed, pushed, and moved between SPDX, CycloneDX, and related ecosystems.
Timeline
- 2024: GitHub repository created.
- 2024: v0.1.0-alpha appears in GitHub releases.
- 2025: v0.4.3 appears in GitHub releases.
Related projects
- protobom, OpenSSF, SPDX, CycloneDX, GUAC, Sigstore
Sources
security posture
No protected-tool coverage found yet
No matching local secret-handling manifest was found for bomctl. Nucleus package metadata is still published here so future coverage has a stable package URL.
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.netrc
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
bomctl | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version0.4.3
manager updated2026-07-26
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:bomctl |
|---|---|
| Version | 0.4.3 |
| Package manager | Homebrew |
| Homepage | https://github.com/bomctl/bomctl |
| Repository | https://github.com/bomctl/bomctl |
| Last updated | 2026-07-26T10:56:34+02:00 |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
apk95%
bomctl 0.1.9-r17
Format agnostic SBOM tooling
https://github.com/bomctl/bomctl
sudo apk add bomctl- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
apk95%
bomctl-bash-completion 0.1.9-r17
Bash completions for bomctl
https://github.com/bomctl/bomctl
sudo apk add bomctl-bash-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- normalized package name match
- Matched by: Bomctl
apk95%
bomctl-fish-completion 0.1.9-r17
Fish completions for bomctl
https://github.com/bomctl/bomctl
sudo apk add bomctl-fish-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- normalized package name match
- Matched by: Bomctl
apk95%
bomctl-zsh-completion 0.1.9-r17
Zsh completions for bomctl
https://github.com/bomctl/bomctl
sudo apk add bomctl-zsh-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl 0.4.3-1.7
Format agnostic SBOM tooling
https://github.com/bomctl/bomctl
sudo zypper install bomctl- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl-bash-completion 0.4.3-1.7
Bash Completion for bomctl
https://github.com/bomctl/bomctl
sudo zypper install bomctl-bash-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: bomctl
- 2 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl-fish-completion 0.4.3-1.7
Fish Completion for bomctl
https://github.com/bomctl/bomctl
sudo zypper install bomctl-fish-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl-zsh-completion 0.4.3-1.7
Zsh Completion for bomctl
https://github.com/bomctl/bomctl
sudo zypper install bomctl-zsh-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation