Build, firmware and update inputs
Builds, firmware, container images and update packages, read into evidence. This page documents every command in the build-inputs group, in the order sbomflow help build-inputs lists them. Each command's section is generated from the command itself — its summary, description and options from the parser, and its reads, writes, exit codes, examples and see-also from the command catalog — so it says exactly what sbomflow <command> --help says. Every example below is executed offline by the test suite, and every non-zero exit code is either produced by an executed probe or carries a recorded reason why no offline probe can produce it.
See the CLI overview for how the thirteen groups fit together and the command reference for every command's options in one place.
Overview#
Specialist importers exist for CMake, Zephyr, ESP-IDF, containers/OCI, firmware extraction, update managers and more. Run sbomflow help build-inputs for the full list; use only the importers your build actually produces.
Who this is for: firmware engineers, build engineers, container platform teams, platform teams, firmware analysts, update engineers, embedded Linux engineers and vehicle software engineers.
sbomflow cmake-evidence#
Import a CMake File API reply into deterministic build evidence (offline).
Read a CMake build directory's File API reply (.cmake/api/v1/reply) and record
the targets, their sources and their link dependencies as deterministic build
evidence. Nothing is configured or built; a directory with no reply exits 2.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | a CMake build directory's File API reply; nothing is built or configured. |
| Writes | stdout (cmake-build-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 no File API reply there |
| Machine output | machine-native — prints its CMake File API build-evidence document as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | A CMake build dir or its .cmake/api/v1/reply directory. |
--output | OUTPUT | none | any | no | Write cmake-build-evidence.json here (file; default stdout). |
Examples
Read the targets and sources a CMake build declared.
sbomflow cmake-evidence cmake-buildWrite the document to a file.
sbomflow cmake-evidence cmake-build --output cmake-build-evidence.jsonRefuse a directory with no File API reply. Exits 2.
sbomflow cmake-evidence rootfsSee also: sbomflow linker-map-evidence, sbomflow zephyr-evidence, sbomflow esp-idf-evidence, sbomflow help goal firmware.
sbomflow linker-map-evidence#
Parse a GNU ld / LLVM lld map into a deterministic object/section graph (offline).
Parse one GNU ld or LLVM lld linker map into a deterministic graph of the
objects, archives and sections a link pulled in. A file that is neither format
is reported as such rather than guessed.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one GNU ld or LLVM lld linker map. |
| Writes | stdout (linker-map-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 read, including a file that is not a map, which is reported · 2 a missing file |
| Machine output | machine-native — prints its linker-map evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | A linker .map file. |
--output | OUTPUT | none | any | no | Write linker-map-evidence.json here (file; default stdout). |
Examples
Read which objects and archives a GNU ld link pulled in.
sbomflow linker-map-evidence linker-maps/gnu_ld.mapAn LLVM lld map, written to a file.
sbomflow linker-map-evidence linker-maps/llvm_lld.map --output linker-map-evidence.jsonA file that is neither format is reported, not guessed.
sbomflow linker-map-evidence linker-maps/garbage.txtSee also: sbomflow cmake-evidence, sbomflow elf-evidence, sbomflow help goal firmware.
sbomflow zephyr-evidence#
Import a Zephyr west spdx set into deterministic build evidence (offline).
Read the SPDX documents `west spdx` wrote for a Zephyr build and record the
build's components, sources and relationships as deterministic firmware build
evidence. A directory with no Zephyr SPDX documents exits 2.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | a Zephyr build directory's SPDX documents. |
| Writes | stdout (zephyr-build-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 no Zephyr SPDX documents there |
| Machine output | machine-native — prints its Zephyr build-evidence document as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | A Zephyr build dir or its spdx/ directory. |
--output | OUTPUT | none | any | no | Write zephyr-build-evidence.json here (file; default stdout). |
Examples
Read a Zephyr build's SPDX documents into firmware build evidence.
sbomflow zephyr-evidence build --output out/zephyr-build-evidence.jsonPrint the document instead.
sbomflow zephyr-evidence buildRefuse a directory with no Zephyr SPDX documents. Exits 2.
sbomflow zephyr-evidence rootfsSee also: sbomflow cmake-evidence, sbomflow twister-evidence, sbomflow help goal firmware.
sbomflow esp-idf-evidence#
Import ESP-IDF build outputs into deterministic evidence (offline; no secrets copied).
Read an ESP-IDF project's dependencies.lock, sdkconfig and build descriptors
and record its components and configuration as deterministic build evidence.
No secret (a key or a credential in sdkconfig) is copied into the evidence.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | an ESP-IDF project or its build directory: dependencies.lock, sdkconfig and the build's descriptors. |
| Writes | stdout (esp-idf-build-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing directory |
| Machine output | machine-native — prints its ESP-IDF build-evidence document as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | An ESP-IDF project dir or its build/ directory. |
--output | OUTPUT | none | any | no | Write esp-idf-build-evidence.json here (file; default stdout). |
Examples
Read an ESP-IDF project's components and configuration.
sbomflow esp-idf-evidence esp-idf-projectPoint it at the build directory, writing the document to a file.
sbomflow esp-idf-evidence esp-idf-project/build --output esp-idf-build-evidence.jsonSee also: sbomflow cmake-evidence, sbomflow zephyr-evidence, sbomflow help goal firmware.
sbomflow elf-evidence#
Read ELF binaries' declared structure — SONAME, DT_NEEDED, build-id (offline; never executed).
Inventory one ELF binary, or every ELF binary in a tree, reading only its
declared structure: SONAME, DT_NEEDED, build-id, the exploit mitigations its
headers declare, and whether a kernel module ends with the appended-signature
marker (never whether a signature is valid). Nothing is executed; --max-
binaries bounds how many are read.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one binary, or a tree to inventory; nothing is executed. |
| Writes | stdout (elf-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing path |
| Machine output | machine-native — prints its ELF inventory evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | A binary, or a tree to inventory. |
--output | OUTPUT | none | any | no | Write elf-evidence.json here (file; default stdout). |
--max-binaries | MAX_BINARIES | 5000 | any | no | Bound on ELF binaries inventoried in one tree (default: 5000). |
Examples
Inventory the ELF binaries in a root filesystem; this one holds none.
sbomflow elf-evidence rootfsBound the inventory and write the document to a file.
sbomflow elf-evidence rootfs --max-binaries 10 --output elf-evidence.jsonSee also: sbomflow linker-map-evidence, sbomflow syft-scan, sbomflow firmware-extract, sbomflow help goal firmware.
sbomflow oci-evidence#
Discover manifests/platforms/referrers in a local OCI image layout (offline; layers never executed).
Record the manifests, platforms and referrers in a local OCI image layout
directory, by digest. Nothing is pulled and no layer is extracted or executed.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one local OCI image layout directory; nothing is pulled. |
| Writes | oci-layout-evidence.json (on stdout, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 not an OCI image layout |
| Machine output | machine-native — prints its OCI image-layout evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | A local OCI image layout directory. |
--output | OUTPUT | none | any | no | Write oci-layout-evidence.json here (file; default stdout). |
Examples
Record an OCI image layout's manifests and digests.
sbomflow oci-evidence oci-layoutWrite the document to a file.
sbomflow oci-evidence oci-layout --output oci-layout-evidence.jsonRefuse a directory that is not an OCI image layout. Exits 2.
sbomflow oci-evidence rootfsSee also: sbomflow syft-scan, sbomflow analyze, sbomflow help goal firmware.
sbomflow syft-scan#
Optional: discover components via Syft and ingest its CycloneDX output (never required).
Optional: run the local Syft on a path, root filesystem or image archive and
ingest its CycloneDX output as external observations; never required. With no
Syft available the document still prints, recording `available: false`.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | a filesystem path, root filesystem or image archive; it runs the local Syft when there is one. |
| Writes | stdout (syft-result.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 the document was written, including when Syft is not available · 2 usage error |
| Machine output | machine-native — prints the ingested Syft result as JSON on stdout by default, no flag needed; --output writes the same document to a file instead; with Syft absent it still prints the document, recording available: false |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
target | target | none | any | yes | A filesystem path / rootfs / image archive. |
--executable | EXECUTABLE | syft | any | no | syft executable (default: syft). |
--format | FORMAT | cyclonedx-json | any | no | Syft output format (default: cyclonedx-json). |
--output | OUTPUT | none | any | no | Write syft-result.json here (file; default stdout). |
Examples
Scan a root filesystem with Syft; with none installed the document says available: false.
sbomflow syft-scan rootfs --executable no-such-syftAsk for SPDX JSON and write the document to a file.
sbomflow syft-scan rootfs --executable no-such-syft --format spdx-json --output syft-result.jsonSee also: sbomflow elf-evidence, sbomflow oci-evidence, sbomflow analyze.
sbomflow firmware-extract#
Optional binwalk/unblob run: extracted files are never executed, and are deleted with the directory.
Optional: run binwalk or unblob on a local firmware image into a
controlled temporary directory and inventory what it extracted. The
extractor runs as a subprocess with no shell, a sanitized environment, a
timeout and bounded output; extracted files are never executed, and are
deleted with the directory. With the extractor absent the document still
prints, recording that extraction was skipped.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one local firmware image; the extractor runs in a controlled temporary directory, and what it extracts is never executed. |
| Writes | stdout (firmware-extraction.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 the document was written, including when the extractor is not available · 2 a missing image or a refused bound |
| Machine output | machine-native — prints the bounded extraction inventory as JSON on stdout by default, no flag needed; --output writes the same document to a file instead; with the extractor absent it still prints the document, recording that extraction was skipped |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
image | image | none | any | yes | Local firmware image to inspect. |
--adapter | {binwalk,unblob} | none | binwalk, unblob | yes | Which extractor to run on the image. SBOMFlow launches it as a subprocess with no shell, a sanitized environment, a timeout and bounded output, into a controlled temporary directory. It is not an OS or network sandbox: run a hostile image's extractor inside one you manage. |
--executable | EXECUTABLE | none | any | no | Extractor executable (defaults to adapter name). |
--expected-executable-sha256 | SHA256 | none | any | no | Optional pinned extractor SHA-256. |
--timeout | SECONDS | 120 | any | no | Seconds the extractor subprocess may run before it is terminated and the extraction abandoned (default: 120). It does not bound the inventory walk that follows, which is bounded by --max-files/--max-expanded-bytes. |
--max-file-bytes | MAX_FILE_BYTES | 268435456 | any | no | Largest single extracted file to inventory, in bytes (default: 256 MiB). |
--max-expanded-bytes | MAX_EXPANDED_BYTES | 8589934592 | any | no | Total extracted bytes to inventory before stopping, a decompression-bomb bound (default: 8 GiB). |
--max-files | MAX_FILES | 5000000 | any | no | Largest number of extracted files to inventory (default: 5000000). |
--max-ratio | MAX_RATIO | 200.0 | any | no | Largest expanded-to-image size ratio treated as plausible (default: 200.0). |
--max-depth | MAX_DEPTH | 32 | any | no | Deepest nesting level the inventory walk descends (default: 32). |
--output | OUTPUT | none | any | no | Write firmware-extraction.json here (file; default stdout). |
Examples
Inventory what binwalk would extract; with none installed, extraction is recorded as skipped.
sbomflow firmware-extract firmware/firmware.bin --adapter binwalk --executable no-such-binwalkUse unblob with a shorter timeout, writing the document to a file.
sbomflow firmware-extract firmware/firmware.bin --adapter unblob --executable no-such-unblob --timeout 30 --output firmware-extraction.jsonTighten the decompression-bomb bounds.
sbomflow firmware-extract firmware/firmware.bin --adapter binwalk --executable no-such-binwalk --max-expanded-bytes 1000000 --max-files 1000 --max-ratio 50 --max-depth 4See also: sbomflow elf-evidence, sbomflow syft-scan, sbomflow mcuboot-evidence, sbomflow help goal firmware.
sbomflow mcuboot-evidence#
Parse an MCUboot image into deterministic firmware evidence (offline; never executed).
Parse one MCUboot image into deterministic firmware evidence: header, version,
security counter and TLVs. It is read, never executed; `mcuboot-verify` checks
the hash and signature.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one MCUboot image; it is read, never executed. |
| Writes | stdout (mcuboot-image-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 read, including bytes that are not an MCUboot image, which is reported · 2 a missing image |
| Machine output | machine-native — prints its MCUboot image-header evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | An MCUboot image file. |
--output | OUTPUT | none | any | no | Write mcuboot-image-evidence.json here (file; default stdout). |
Examples
Record an MCUboot image's header, version and TLVs.
sbomflow mcuboot-evidence firmware/image.binWrite the document to a file.
sbomflow mcuboot-evidence firmware/image.bin --output mcuboot-image-evidence.jsonSee also: sbomflow mcuboot-verify, sbomflow update-manifest-evidence, sbomflow help goal firmware.
sbomflow update-manifest-evidence#
Parse local TUF metadata or an IETF SUIT CBOR envelope into bounded observations.
Parse local TUF metadata or an IETF SUIT CBOR envelope into bounded
observations of roles, versions, expiries and payload digests. Offline; --as-
of pins the time TUF expiry is judged at.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | TUF metadata (a directory or file) or a SUIT CBOR envelope. |
| Writes | stdout (update-manifest-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing or unrecognised input |
| Machine output | machine-native — prints its TUF/SUIT update-manifest evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | TUF metadata directory/file or SUIT CBOR file. |
--format | {auto,tuf,suit} | auto | auto, tuf, suit | no | Read the input as TUF metadata or a SUIT CBOR envelope; auto detects it from the bytes (default: auto). |
--as-of | AS_OF | none | any | no | Pinned ISO time for TUF expiry observations. |
--output | OUTPUT | none | any | no | Write update-manifest-evidence.json here (file; default stdout). |
Examples
Record a TUF repository's roles, versions and expiries.
sbomflow update-manifest-evidence tufName the format and pin the time expiry is judged at.
sbomflow update-manifest-evidence tuf --format tuf --as-of 2026-07-01T00:00:00ZSee also: sbomflow uptane-evidence, sbomflow mcuboot-evidence, sbomflow help goal firmware.
sbomflow rauc-evidence#
Parse an exact RAUC manifest.raucm artifact (offline; no CMS verification).
Parse one RAUC manifest.raucm artifact, or the directory holding it, and
record the update's images and hashes. It is read, never executed or
extracted, and its CMS signature is not verified.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one RAUC bundle or manifest; it is read, never executed or extracted. |
| Writes | stdout (rauc-update-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing or unrecognised artifact |
| Machine output | machine-native — prints its RAUC bundle evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | The exact artifact to parse; it is read, never executed or extracted. |
--output | OUTPUT | none | any | no | Write rauc-update-evidence.json here (file; default stdout). |
Examples
Record a RAUC update's manifest and images.
sbomflow rauc-evidence vendor-updates/raucWrite the document to a file.
sbomflow rauc-evidence vendor-updates/rauc --output rauc-update-evidence.jsonSee also: sbomflow swupdate-evidence, sbomflow mender-evidence, sbomflow uptane-evidence, sbomflow help goal firmware.
sbomflow swupdate-evidence#
Parse an SWUpdate .swu newc/crc cpio or sw-description artifact.
Parse one SWUpdate artifact, a .swu newc or crc cpio archive or its sw-
description, and record the images and hashes it declares. It is read, never
executed or extracted.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one SWUpdate sw-description or .swu artifact; it is read, never executed or extracted. |
| Writes | stdout (swupdate-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing or unrecognised artifact |
| Machine output | machine-native — prints its SWUpdate artifact evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | The exact artifact to parse; it is read, never executed or extracted. |
--output | OUTPUT | none | any | no | Write swupdate-evidence.json here (file; default stdout). |
Examples
Record an SWUpdate description's images and hashes.
sbomflow swupdate-evidence vendor-updates/swupdate/sw-descriptionWrite the document to a file.
sbomflow swupdate-evidence vendor-updates/swupdate/sw-description --output swupdate-evidence.jsonSee also: sbomflow rauc-evidence, sbomflow mender-evidence, sbomflow help goal firmware.
sbomflow mender-evidence#
Inspect a Mender Artifact tar in memory without extracting or executing it.
Inspect one Mender artifact tar in memory and record its header, payloads and
checksums. Nothing is extracted or executed.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | one Mender artifact; it is read, never executed or extracted. |
| Writes | stdout (mender-update-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing or unrecognised artifact |
| Machine output | machine-native — prints its Mender artifact evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | The exact artifact to parse; it is read, never executed or extracted. |
--output | OUTPUT | none | any | no | Write mender-update-evidence.json here (file; default stdout). |
Examples
Record a Mender artifact's header, payloads and checksums.
sbomflow mender-evidence firmware/gateway.menderWrite the document to a file.
sbomflow mender-evidence firmware/gateway.mender --output mender-update-evidence.jsonSee also: sbomflow rauc-evidence, sbomflow swupdate-evidence, sbomflow help goal firmware.
sbomflow uptane-evidence#
Parse separate Uptane Director/Image repository metadata observations.
Parse Uptane Director and Image repository metadata into separate observations
of roles, versions, targets and expiries. It is read, never executed; --as-of
pins the time expiry is judged at.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | stable |
| Regime | any |
| Reads | Uptane director and image-repository metadata; it is read, never executed. |
| Writes | stdout (uptane-update-evidence.json, or to the file --output names) |
--output names | one file (stdout when omitted) |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 ok · 2 a missing or unrecognised input |
| Machine output | machine-native — prints its Uptane metadata evidence as JSON on stdout by default, no flag needed; --output writes the same document to a file instead |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
path | path | none | any | yes | The exact artifact to parse; it is read, never executed or extracted. |
--as-of | AS_OF | none | any | no | Pinned ISO time for expiry observations. |
--output | OUTPUT | none | any | no | Write uptane-update-evidence.json here (file; default stdout). |
Examples
Record an Uptane deployment's roles and targets.
sbomflow uptane-evidence vendor-updates/uptanePin the time expiry is judged at and write the document to a file.
sbomflow uptane-evidence vendor-updates/uptane --as-of 2026-07-01T00:00:00Z --output uptane-update-evidence.jsonSee also: sbomflow update-manifest-evidence, sbomflow rauc-evidence, sbomflow help goal firmware.
sbomflow build-applicability-evidence#
Sources a build compiled (offline; context).
Record which source files a local build compiled, read from the build's own
records: kbuild .<object>.o.cmd source_ lines (Linux, U-Boot), a CMake File
API reply, or compile_commands.json. Nothing is built or executed. Bind the
document to a component with build_applicability in sbomflow.yaml, and each
finding shows whether a file its CVE record names (programFiles) was among
the compiled sources.| Fact | Value |
|---|---|
| Group | build-inputs — Build, firmware & update inputs |
| Stability | experimental |
| Regime | any |
| Reads | one local build directory's own records (kbuild .o.cmd files, a CMake File API reply or compile_commands.json); nothing is built or executed. |
| Writes | build-applicability.json (the build-applicability document at --output); stdout (what was read, and whether the document is complete) |
--output names | one file |
| Network | offline — This command has no network-capable path. |
| Exit codes | 0 the document was written (complete or not; the summary says which) · 2 a missing or non-directory BUILD_DIR, or no kbuild .o.cmd file, CMake File API reply or compile_commands.json under it; nothing is written |
| Machine output | artifact-suffices — writes the build-applicability document at --output; that file is the machine surface, and analyze reads it through build_applicability in sbomflow.yaml |
Options
| Option | Value | Default | Allowed | Required | Help |
|---|---|---|---|---|---|
-h, --help | (flag) | none | — | no | show this help message and exit |
BUILD_DIR | BUILD_DIR | none | any | yes | The build directory (read-only). Source paths are stated relative to it; a path outside it is refused and counted. |
--output | FILE | none | any | yes | Write the build-applicability document here (file); replaced if present. |
Examples
Record the sources a kernel build compiled, from its .o.cmd files.
sbomflow build-applicability-evidence kbuild-tree --output kernel-applicability.jsonA CMake reply whose sources carry no compile group is recorded as incomplete, never as a clean list.
sbomflow build-applicability-evidence cmake-build --output cmake-applicability.jsonRefuse a directory with no build record. Exits 2.
sbomflow build-applicability-evidence rootfs --output applicability.jsonSee also: sbomflow cmake-evidence, sbomflow analyze, sbomflow help goal firmware.