# 使用 Homebrew, Nix, winget 安装 cdxgen

查看 cdxgen 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:cdxgen
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install cdxgen
```

  证据: local Homebrew formula metadata

### Linux

- Nix (92%):

```sh
nix profile install nixpkgs#cdxgen
```

  证据: nixpkgs package indexes: pkgs/by-name/cd/cdxgen/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

### Windows

- winget (92%):

```sh
winget install --id CycloneDX.cdxgen -e
```

  证据: Windows Package Manager source index: CycloneDX.cdxgen from https://cdn.winget.microsoft.com/cache/source.msix

## 软件包事实

- **软件包键:** brew:cdxgen
- **软件包管理器:** Homebrew
- **版本:** 12.8.2
- **来源摘要:** Creates CycloneDX Software Bill-of-Materials (SBOM) for projects
- **主页:** <https://github.com/CycloneDX/cdxgen>
- **最后更新:** 2026-07-27T12:16:43-04:00
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- aibom (别名)
- cbom (别名)
- cdx-audit (别名)
- cdx-convert (别名)
- cdx-sign (别名)
- cdx-validate (别名)
- cdx-verify (别名)
- cdxgen (别名)
- cdxgen-secure (别名)
- cdxi (别名)
- evinse (别名)
- hbom (别名)
- obom (别名)
- saasbom (别名)
- spdxgen (别名)
- tracebom (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 12.8.2
## 项目历史与用法

CycloneDX Generator, usually called cdxgen, is a CLI, library, REPL, and server for generating CycloneDX and SPDX software bill of materials documents from source trees, container images, binaries, hosts, and related inputs.

### 项目历史

The GitHub API records the cdxgen repository as created on 2019-12-30. Its package metadata identifies @cyclonedx/cdxgen as the npm package and points to the official GitHub repository, while the README now presents cdxgen as a broader BOM toolkit covering SBOM, CBOM, OBOM, SaaSBOM, HBOM, AI-BOM, and validation/signing workflows.

The project grew from a CycloneDX SBOM generator into a multi-command supply-chain analysis suite with commands such as cdxgen, cdx-validate, cdx-convert, cdx-sign, cdx-verify, cdx-audit, evinse, hbom, obom, cbom, saasbom, aibom, and spdxgen.

### 采用历史

cdxgen's adoption tracks the rise of SBOM requirements in software supply-chain security. The README positions it for developers, AppSec, compliance teams, SOC analysts, hardware teams, and AI platform teams, and the supplied package-manager metadata shows Homebrew, Nix, and winget packaging in addition to npm and GitHub release binaries.

### 使用方式

The common developer path is cdxgen -o bom.json . for a local project, with additional modes for containers, git URLs, purls, hosts, AI assets, and validation/conversion/signing. The README emphasizes CI/CD use and standalone binaries for several commands.

### 为什么软件包爱好者会关心

cdxgen is package-nerd significant because it turns package graphs into standardized artifacts that other tools can consume. It sits at the intersection of language package managers, container metadata, CycloneDX, SPDX, Dependency-Track-style workflows, and modern compliance demands.

### 时间线

- 2019: GitHub API records the cdxgen repository as created on 2019-12-30.
- 2024: Git tags include the v10 series, showing the project had reached a mature major-version cadence.
- 2026: Homebrew formula packages cdxgen 12.7.0, and the README documents CycloneDX 1.5-1.7 plus SPDX 3.0.1 support.

### Related projects

- CycloneDX is the primary BOM specification cdxgen emits.
- OWASP Dependency-Track and depscan are adjacent downstream/security workflows referenced by the project documentation.
- SPDX is supported as an export format through cdxgen and cdx-convert.

### 来源

- <https://api.github.com/repos/cdxgen/cdxgen>
- <https://github.com/cdxgen/cdxgen>
- <https://github.com/CycloneDX/cdxgen>
- <https://cdxgen.github.io/cdxgen>
- <https://github.com/cdxgen/cdxgen#readme>
- <https://formulae.brew.sh/api/formula/cdxgen.json>
- <https://api.github.com/repos/CycloneDX/cdxgen>
- <https://raw.githubusercontent.com/CycloneDX/cdxgen/master/package.json>


## 安全说明

没有找到 cdxgen 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。



## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: .cdxgenrc, .cdxgen.json, .cdxgen.yml, .cdxgen.yaml
## 其他软件包管理器记录

- Nix - cdxgen: normalized package name match | nixpkgs package indexes: pkgs/by-name/cd/cdxgen/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- winget - CycloneDX.cdxgen: normalized package name match | Windows Package Manager source index: CycloneDX.cdxgen from https://cdn.winget.microsoft.com/cache/source.msix


## Combined YAML source

View the package source record on GitHub. [combined/cdxgen.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cdxgen.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph