Configure, maintain and look things up

Config, schema migration of old output directories, help. This page documents every command in the maintenance group, in the order sbomflow help maintenance lists them. Each command's section is generated from the command itself — its summary, description and options from the parser, and its reads, writes, exit codes, examples and see-also from the command catalog — so it says exactly what sbomflow <command> --help says. Every example below is executed offline by the test suite, and every non-zero exit code is either produced by an executed probe or carries a recorded reason why no offline probe can produce it.

See the CLI overview for how the thirteen groups fit together and the command reference for every command's options in one place.

Overview#

• sbomflow validate-config <file> — check config syntax and keys.
• sbomflow schema list — list SBOMFlow's own output-artifact families.
• sbomflow schema show <family> — show one artifact's fields, offline (add --json for a machine-readable description).
• sbomflow config show <file> — print the merged effective config with each key marked config or default, offline (add --json).

Finding your way: help, topics and the command catalog#

• sbomflow help goals — start from what you came to do rather than from a command name. It lists the goals (an SBOM for a release or a questionnaire, vulnerability triage, a CI release gate, a named sign-off, release history, a handoff to a customer or auditor, runtime and test evidence custody, firmware build evidence, a post-market case, AI evidence) and, under its own heading, the one optional requirement regime available today, the EU CRA.
• sbomflow help goal <id> — one goal: who it is for, what you bring, the exact steps to run in order (with a legend for every stand-in to replace), the outputs, what stays human, the network posture and a docs link. Every step on every goal is executed offline by the test suite against the bundled demo fixture, so a card cannot print a command that does not run. An unknown id exits 2 with [E019] and the closest match. No goal claims conformity or maps to a framework; each says what the commands observe and what a person still decides.
• sbomflow commands — every command path with its group, its one-line summary, its network class and how stable it is, read from one bundled command catalog. --group ID and --keyword WORD narrow the listing (an unknown value exits 2 and suggests the closest match), and --json prints the catalog resolved against the real parser: every command's summary, options with their types, defaults and choices, network gates, keywords, related commands and machine-output verdict. Offline, deterministic, and additive — it replaces no existing surface, and help --json is unchanged.
• sbomflow help [command|topic] — the same help, addressable by name: a command, a group id, a topic word or a catalog keyword, resolved in that order after the reserved words. sbomflow help vex prints the glossary entry exactly as sbomflow explain --explain-terms vex does and the commands that carry the keyword; an unknown word exits 2 with the closest match and runs nothing.
• sbomflow help <command> — for the option-heavy commands (analyze, audit, review, approve) this opens a short overview instead of the whole option list: what the command reads and writes, whether it touches the network, its exit codes, its required inputs, the five-to-seven most common options, and a directory of the remaining options grouped by job.
• sbomflow help <command> <group> — one option group, e.g. sbomflow help audit release-gate-policy. A mistyped group name suggests the closest matches, lists the groups, and runs nothing.
• sbomflow <command> --help (or sbomflow help <command> all) — every option, unchanged. The overview hides nothing: it is a shorter route to the same listing, and every option belongs to exactly one addressable group. Where an overview exists, this page names it above the option groups, so reaching the shorter view never depends on having started at the root.
• Every example a help page prints runs exactly as printed. A line that begins sbomflow is a command: paste it and it executes. Any note about an example sits on the line beneath it, never beside it on the same line, because a gloss beside the command is part of what a reader copies. A drift test walks every rendered help page, extracts every such line, and requires each one to survive the shell unchanged and then be accepted by the real parser — a trailing > file or | jq being the one deliberate exception.
• sbomflow help error [code] — offline explanation of an error code (unknown codes suggest the closest matches); with no code it lists the whole error catalog with each code's exit status.
• sbomflow help warning [code] — offline explanation of a scan-warning code (unknown codes suggest the closest matches); with no code it lists the whole warning catalog grouped by category. Run-independent, unlike sbomflow explain --warning <code>, which reads a specific output directory — so a reviewer holding only a colleague's scan-warnings.json can still look a code up.
• sbomflow help exit [code] — offline explanation of a process exit code, including whether re-running is safe. Mirrors the published exit-code reference and is held in agreement by a drift test.

Long --help pages are sent to a pager only on an interactive terminal; when output is piped or redirected the bytes are unchanged (safe for scripts and CI). Control it with SBOMFLOW_PAGER or PAGER (default less -FRX), or disable paging with NO_PAGER (or SBOMFLOW_NO_PAGER). Errors are never paged.

Who this is for: operators, support engineers, script authors, tool integrators, license administrators and new operators.

sbomflow config#

Inspect the effective product configuration (offline).

Inspect the configuration a run would use. The verb reads one config file and
reports the merged effective values with where each came from; nothing is
written. Name the verb, or the group prints its usage and exits 2.

Options

Examples

Show the merged effective config with each key's origin.

sbomflow config show ./sbomflow.yaml

The same view as JSON.

sbomflow config show ./sbomflow.yaml --json

Name no verb: print the group's usage and exit 2. Exits 2.

sbomflow config

See also: sbomflow config show, sbomflow validate-config, sbomflow init.

sbomflow config show#

Show the merged effective config with per-key origin.

Show the merged effective config for one sbomflow.yaml or .json: every key's
value and its origin, the file or the built-in default. Read-only, and it runs
no analysis.

Options

Examples

Show the merged effective config with each key's origin.

sbomflow config show ./sbomflow.yaml

The same view as JSON.

sbomflow config show ./sbomflow.yaml --json

Name the view explicitly; it is the default and only one.

sbomflow config show ./sbomflow.yaml --effective

See also: sbomflow validate-config, sbomflow init, sbomflow doctor.

sbomflow validate-config#

Validate a sbomflow.yaml/.json config file.

Validate one sbomflow.yaml or .json against the config schema and report each
error and warning with the key it concerns. Read-only; it scans nothing. A
config that is missing or invalid exits 2.

Options

Examples

Validate the project's config.

sbomflow validate-config ./sbomflow.yaml

Validate a freshly scaffolded config.

sbomflow validate-config ./sbomflow.yaml

Refuse a config file that is not there. Exits 2.

sbomflow validate-config missing.yaml

See also: sbomflow config show, sbomflow init, sbomflow doctor, sbomflow validate-graph.

sbomflow schema#

Show the field structure of SBOMFlow's own output artifacts (offline).

Show the field structure of the artifacts SBOMFlow writes, from the schema
registry shipped with it: every family's file name, version, stability and
top-level keys. With no verb it lists the families.

Options

Examples

List every artifact family SBOMFlow writes.

sbomflow schema list

Show one family's documented fields.

sbomflow schema show evidence-pack

With no verb, list the families.

sbomflow schema

See also: sbomflow schema list, sbomflow schema show, sbomflow upgrade inspect.

sbomflow schema list#

List known artifact families.

List every artifact family SBOMFlow writes, with its file name, schema version
and stability class. Read-only and offline.

Options

Examples

List every artifact family, its version and stability.

sbomflow schema list

The same list as JSON.

sbomflow schema list --json

See also: sbomflow schema show, sbomflow upgrade inspect.

sbomflow schema show#

Show one family's schema.

Show one artifact family's documented structure: its file name, version,
stability, top-level keys and the command that produces it. Read-only and
offline.

Options

Examples

Show the evidence pack's documented top-level fields.

sbomflow schema show evidence-pack

The release gate's schema as JSON.

sbomflow schema show release-gate --json

Refuse a family the registry does not know. Exits 2.

sbomflow schema show no-such-family

See also: sbomflow schema list, sbomflow validate.

sbomflow upgrade#

Inspect/plan/migrate-copy/validate old output dirs to the current schemas (offline; never in place).

Bring an older output directory up to the current schemas without touching it:
inspect what it holds, plan which artifacts would migrate, write migrated
copies to a NEW directory, and validate the result. Never in place. Name a
verb, or the group prints its usage and exits 2.

Options

Examples

List an output directory's artifacts with their families and versions.

sbomflow upgrade inspect out

Report which artifacts would migrate, writing nothing.

sbomflow upgrade plan out

Name no verb: print the group's usage and exit 2. Exits 2.

sbomflow upgrade

See also: sbomflow upgrade inspect, sbomflow upgrade plan, sbomflow upgrade migrate-copy, sbomflow schema list.

sbomflow upgrade inspect#

List artifacts + their schema-registry family/version.

List the artifacts one output directory holds, each with the schema-registry
family and version it declares. Read-only; `upgrade plan --json` is the
machine decision surface.

Options

Examples

List the artifacts and their schema families and versions.

sbomflow upgrade inspect out

Inspect the earlier release's pack.

sbomflow upgrade inspect out-prev

See also: sbomflow upgrade plan, sbomflow schema list.

sbomflow upgrade migrate-copy#

Write migrated copies to a NEW directory (never in place).

Write migrated copies of an output directory's artifacts, with an upgrade-
manifest.json, to a NEW directory that must not exist. The source directory is
never modified.

Options

Examples

Write migrated copies to a new directory, leaving the original.

sbomflow upgrade migrate-copy out --dest migrated

Refuse a destination that already exists. Exits 2.

sbomflow upgrade migrate-copy out --dest out

See also: sbomflow upgrade plan, sbomflow upgrade validate.

sbomflow upgrade plan#

Dry-run: report which artifacts would migrate (no writes).

Report which artifacts in one output directory would be migrated to the
current schemas, and how. A dry run: nothing is written.

Options

Examples

Report which artifacts would migrate, writing nothing.

sbomflow upgrade plan out

The plan as JSON.

sbomflow upgrade plan out --json

See also: sbomflow upgrade migrate-copy, sbomflow upgrade inspect.

sbomflow upgrade validate#

Run structural validation on a (migrated) output directory.

Run structural validation on an output directory, typically a migrated copy;
the same checks as the top-level `validate`. A malformed or changed artifact
exits 4.

Options

Examples

Validate a migrated copy.

sbomflow upgrade validate migrated

Refuse a pack whose evidence-pack.json fails its schema. Exits 4.

sbomflow upgrade validate broken-evidence

See also: sbomflow validate, sbomflow upgrade migrate-copy.

sbomflow license#

Read-only, offline entitlement verification; never enforces licensing.

Read-only, offline entitlement verification (no enforcement).
An absent or expired entitlement blocks no command, and installing
one grants no rights.

Terms: an entitlement is not the licence. SBOMFlow is proprietary, and the
licence notice travels with every copy — LICENSE in a source tree,
sbomflow-<version>.dist-info/licenses/LICENSE in an installed wheel.
Evaluation, pilot and design-partner terms are not published; ask
hello@sbomflow.com for them.

Options

Examples

Show an entitlement file's fields, without verifying it.

sbomflow license inspect entitlement.json

Report whether an entitlement is installed for this user.

sbomflow license status

Name no verb: print the group's usage and exit 2. Exits 2.

sbomflow license

See also: sbomflow license inspect, sbomflow license verify, sbomflow license install, sbomflow license status.

sbomflow license inspect#

Show an entitlement file's fields (no verification).

Show an entitlement file's fields as written. Nothing is verified: `license
verify` checks the signature and the validity window.

Options

Examples

Show an entitlement file's fields, without verifying it.

sbomflow license inspect entitlement.json

The same fields as JSON.

sbomflow license inspect entitlement.json --json

See also: sbomflow license verify, sbomflow license status.

sbomflow license install#

Verify a delivered entitlement offline, then file it where SBOMFlow looks for it.

Verify a delivered entitlement, then install it for this user: only the
per-user entitlement file is written, owner-readable and atomically. A
refusal exits 2 and writes nothing.

Verification happens before anything is written, so an unverified, revoked
or unreadable file can never displace the entitlement you already have.
Superseding an installed entitlement with anything other than a clean
renewal needs --replace (or a yes at the prompt). Installing changes no
analysis behaviour: SBOMFlow does not enforce licensing, and the evidence
bytes of a licensed and an unlicensed run are identical.

Options

Examples

Verify a delivered entitlement, then install it for this user.

sbomflow license install entitlement.json --public-key keys/example-signing-key.pub.pem --as-of 2026-07-01T00:00:00Z

The non-secret install result as JSON.

sbomflow license install entitlement.json --public-key keys/example-signing-key.pub.pem --as-of 2026-07-01T00:00:00Z --json

Refuse an entitlement no trusted key verifies; nothing is written. Exits 2.

sbomflow license install entitlement.json

See also: sbomflow license status, sbomflow license verify.

sbomflow license status#

Report the status of an installed entitlement (or that none is installed).

Report the status of the entitlement installed for this user, or of --file:
present, verified, expiring or absent. None installed is reported, not
refused, because nothing is ever enforced.

Options

Examples

Report that no entitlement is installed; nothing is enforced either way.

sbomflow license status

The status as JSON.

sbomflow license status --json

The status of an installed, verified entitlement.

sbomflow license status --public-key keys/example-signing-key.pub.pem --as-of 2026-07-01T00:00:00Z

See also: sbomflow license install, sbomflow license verify, sbomflow doctor.

sbomflow license verify#

Verify an entitlement's signature and validity window, offline.

Verify an entitlement's signature against the public keys you trust (the
optional sign extra), its validity window and an optional signed revocation
list, offline. Verification enforces nothing; an entitlement that does not
verify exits 2.

Options

Examples

Verify an entitlement's signature and window against a trusted key.

sbomflow license verify entitlement.json --public-key keys/example-signing-key.pub.pem --as-of 2026-07-01T00:00:00Z

The result as JSON.

sbomflow license verify entitlement.json --public-key keys/example-signing-key.pub.pem --as-of 2026-07-01T00:00:00Z --json

Refuse an entitlement no trusted key verifies. Exits 2.

sbomflow license verify entitlement.json --as-of 2026-07-01T00:00:00Z

See also: sbomflow license install, sbomflow license inspect.

sbomflow support-bundle#

Package sanitized diagnostics for a bug report (offline, redaction-audited).

Package sanitized diagnostics from an output directory so a bug report is
engineering data instead of a screenshot - without leaking your product or
your machine.

  Includes  tool version, local capability matrix (no paths), config SHAPE
            (keys and types, never values), per-code warning counts,
            artifact base names + schema versions + hashes, phase durations.
  Excludes  source contents, components, findings, any path beyond a base
            name, environment values, reviewer notes, warning message text.
  Budget    25 MiB default (--max-size); over budget, optional sections are
            dropped largest-value-last and listed, never the redaction audit.

Nothing is written unless --yes is given; the inclusion manifest is
printed first. A redaction violation, or a bundle still over budget after
every optional section is dropped, exits 2.

Options

Examples

Print what a support bundle would include, writing nothing.

sbomflow support-bundle out

Preview each section's size.

sbomflow support-bundle out --dry-run

Write support-bundle.zip, with a pinned timestamp.

sbomflow support-bundle out --yes --as-of 2026-07-01T00:00:00Z

Record the config's shape, within a tighter size budget.

sbomflow support-bundle out --config ./sbomflow.yaml --max-size 1000000 --yes

See also: sbomflow doctor, sbomflow bundle, sbomflow help error.

sbomflow commands#

List every command path with its group, summary and network class.

List every command SBOMFlow has, grouped by the job it belongs to.

Each line restates what the parser and the catalog already record: the
one-line summary, the group, the network class and the stability. It
reaches no verdict and asserts nothing about your product.

Options

Examples

List every command, grouped by job.

sbomflow commands

Only one group's commands.

sbomflow commands --group build-inputs

Commands tagged with a keyword.

sbomflow commands --keyword scanner

The whole catalog, with every option, as JSON.

sbomflow commands --json

See also: sbomflow help, sbomflow examples, sbomflow help topics.

sbomflow help#

Show the command groups, one group, command, topic or keyword, or explain a code (offline).

Print help offline: the command groups, one group, one command, a topic word
or a catalog keyword, or `help error`, `help exit` and `help warning` with a
code for its stable explanation. `help --json` prints the per-command network-
behaviour registry.

Options

Examples

Print the command groups and where every other help page is.

sbomflow help

Explain one command.

sbomflow help audit

Explain one exit code, offline.

sbomflow help exit 2

Print the per-command network-behaviour registry as JSON.

sbomflow help --json

List the goals, each a job with the offline steps that reach it.

sbomflow help goals

Print one goal's card: who it is for, its steps in order, its outputs and what stays human.

sbomflow help goal cra

See also: sbomflow commands, sbomflow examples, sbomflow help topics, sbomflow help error.

sbomflow component-support#

Save component lifecycle snapshots for the offline run (fetch is opt-in network).

Save the lifecycle product documents that component_support.snapshots reads
offline. `fetch` is the one explicit network step for this data; analyze,
audit and batch-run never fetch it. Name a verb, or the group prints its usage
and exits 2.

Options

Examples

An output that already holds a release is not a new or empty directory: refused before anything is fetched. Exits 2.

sbomflow component-support fetch --product python --output out

See also: sbomflow component-support fetch, sbomflow validate-config, sbomflow help network.

sbomflow component-support fetch#

Save lifecycle product documents from endoflife.date as a snapshot directory (network).

Ask the endoflife.date API v1 for each named product and save each document it
returns, unchanged, as DIR/<product>.json, with component-support-fetch.json
beside them recording per file the URL, the retrieval time, the SHA-256 and
the source's MIT licence notice. A document is written only when the offline
snapshot reader reads it; anything else (an HTTP error, a failed or refused
connection, a body over the size cap, a document of the wrong shape) is listed
as not written and counted. Requests are sequential; a 429 stops the run and
nothing is retried. Name the saved files under component_support.snapshots in
sbomflow.yaml and the offline run reads them.

Options

Examples

A name the lifecycle API does not spell (it is lowercase): refused before anything is fetched. Exits 2.

sbomflow component-support fetch --product Python --output lifecycle

The same product named twice: refused, so the snapshot holds each product once. Exits 2.

sbomflow component-support fetch --product python --product python --output lifecycle

See also: sbomflow component-support, sbomflow vulndb update, sbomflow help network.