sbom

sbom creates a CycloneDX 1.6 document that describes all locked dependencies. It does not evaluate licence policy.

licence_audit sbom                     # pretty JSON to stdout
licence_audit sbom --output=sbom.json  # compact JSON to a file
licence_audit sbom --offline           # skip Hex fetch, omit licence fields
licence_audit sbom --reproducible      # reproducible output
licence_audit sbom --vulns             # embed OSV vulnerabilities

Document contents

For each locked dependency, sbom creates a component with this information: a package URL, a SHA-256 hash for Hex packages, the package description, declared licences, and external references. The package URL is pkg:hex/... for Hex and pkg:github/owner/repo@<commit> for GitHub git dependencies. The external references can identify the tarball, source, home page, and documentation. Data from gleam.toml supplies information for the root component. A dependencies graph represents the dependency tree.

Each licence has the property acknowledgement: "declared" because the data comes from package metadata, not a source scan. If a package declares multiple licences, sbom creates one entry for each licence. Hex does not specify an AND or OR relationship. Therefore, sbom does not create an SPDX expression.

Supported sources

sbom supports only hex and GitHub git sources. It fails on a dependency source that it cannot convert to a valid purl. Unsupported sources include path dependencies and non-GitHub git dependencies. --offline skips licence requests but continues to validate purls. The vulns command has different behavior: it identifies and skips unsupported sources.

Embedded vulnerabilities

--vulns queries OSV.dev and adds the results to the CycloneDX vulnerabilities array. Each advisory has an id, an OSV source link, ratings, and an affects list. The list refers to affected components by bom-ref or purl. Tools such as Dependency-Track can read the resultant VEX-style document. Advisory data changes over time. Therefore, you cannot use --vulns with --offline or --reproducible.

Reproducible output

By default, sbom uses a random serialNumber and the current time for timestamp. Thus, the output from two runs is different. With --reproducible, the command reads Hex metadata from each checksum-verified package archive and Git metadata from the archive at the locked commit. It omits mutable Hex publisher data, uses a content hash for serialNumber, and gets the timestamp from SOURCE_DATE_EPOCH, or uses the Unix epoch if the variable is not set. The same project files, lockfile, tool version, options, and timestamp produce byte-identical output.

Flags