bomctl is format-agnostic Software Bill of Materials (SBOM) tooling, which is intended to bridge the gap between SBOM generation and SBOM analysis tools. It focuses on supporting more complex SBOM operations by being opinionated on only supporting the NTIA minimum fields or other fields supported by protobom.

• Work with multiple SBOMs in tree structures (through external references)
• Fetch and push SBOMs using HTTPS, OCI, and GIT protocols
• Leverage a .netrc file to handle authentication
• Manipulate SBOMs with commands like diff, split, and redact
• Manage SBOMs using a persistent database cache
• Interface with OpenSSF projects and services like GUAC and Sigstore

• #bomctl on OpenSSF Slack
• OpenSSF Security Tooling Working Group Meeting - Every two weeks on Friday, 8am Pacific
• SBOM Tooling Working Meeting - Every Monday, 2pm Pacific

Ability to retrieve an SBOM via several protocols:

• HTTP/S
• Git

and from various locations:

• Local Filesystem
• OCI

This includes recursive loading of external references in an SBOM to other SBOMs and placing them into the persistent cache. If SBOMs are access controlled, a user's .netrc file to authenticate.

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD