sbomlyze
v0.5.3 GitHub ★ 24
Get started

Install sbomlyze

One static Go binary, no runtime dependencies. Release archives are published with GitHub artifact attestations from v0.3.7 onward.

Homebrew Recommended
brew install rezmoss/sbomlyze/sbomlyze
Go install
go install github.com/rezmoss/sbomlyze/cmd/sbomlyze@latest
Installer script
# Install to ./bin
curl -sSfL https://raw.githubusercontent.com/rezmoss/sbomlyze/main/install.sh | sh

# Install to /usr/local/bin (requires sudo)
curl -sSfL https://raw.githubusercontent.com/rezmoss/sbomlyze/main/install.sh | sudo sh -s -- -b /usr/local/bin

# Install a specific version
curl -sSfL https://raw.githubusercontent.com/rezmoss/sbomlyze/main/install.sh | sh -s -- -v 0.4.0
-b <dir>Installation directory (default ./bin)
-dEnable debug output
-v <ver>Install a specific version (default latest)
The installer always verifies the release checksum. When a compatible GitHub CLI is installed, it also verifies the release’s build provenance and fails closed if that verification does not succeed.
Verify a binary release
gh attestation verify \
  ./sbomlyze_0.4.0_Linux_x86_64.tar.gz \
  --repo rezmoss/sbomlyze \
  --signer-workflow \
    rezmoss/sbomlyze/.github/workflows/release.yml
Build from source
git clone https://github.com/rezmoss/sbomlyze.git
cd sbomlyze
go build -o sbomlyze ./cmd/sbomlyze
macOS quarantine
xattr -d com.apple.quarantine ./sbomlyze
chmod +x ./sbomlyze
Not published
Unsigned apt, rpm, and apk repository instructions have been removed until the repositories support package-manager-native signature verification.

First run

# Generate two SBOMs and compare them
syft nginx:1.25-alpine -o json > nginx-125.json
syft nginx:1.26-alpine -o json > nginx-126.json
sbomlyze nginx-125.json nginx-126.json

# Or analyse and score straight from a pipe
syft alpine:latest -o cyclonedx-json | sbomlyze - --compliance