bomctl is format-agnostic Software Bill of Materials (SBOM) tooling, which is intended to bridge the gap between SBOM generation and SBOM analysis tools. It focuses on supporting more complex SBOM operations by being opinionated on only supporting the NTIA minimum fields or other fields supported by protobom.

• Work with multiple SBOMs in tree structures (through external references)
• Fetch and push SBOMs using HTTPS, OCI, and GIT protocols
• Leverage a .netrc file to handle authentication
• Manipulate SBOMs with commands like diff, split, and redact
• Manage SBOMs using a persistent database cache
• Interface with OpenSSF projects and services like GUAC and Sigstore

• #bomctl on OpenSSF Slack
• OpenSSF Security Tooling Working Group Meeting - Every two weeks on Friday, 8am Pacific
• SBOM Tooling Working Meeting - Every Monday, 2pm Pacific

brew tap bomctl/bomctl && brew install bomctl

Container images for bomctl can be found on Docker Hub.

docker run bomctl/bomctl:latest --help

Ability to retrieve an SBOM via several protocols:

• HTTP/S
• Git

and from various locations:

• Local Filesystem
• OCI

This includes recursive loading of external references in an SBOM to other SBOMs and placing them into the persistent cache. If SBOMs are access controlled, a user's .netrc file to authenticate.

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

Container images for bomctl can be found here and are signed using keyless signing with cosign.

You can then verify this container image with cosign.

cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/bomctl/bomctl/\.github/. '  bomctl/bomctl:latest

bomctl releases can be found here and are signed using keyless signing with cosign.

You can then verify this artifact with cosign.

cosign verify-blob --certificate ${artifact}-keyless.pem --signature ${artifact}-keyless.sig --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/bomctl/bomctl/\.github/. '  ${artifact}

If the result is Verified OK, the verification is successful.

You can also look up the entry in the public Rekor instance using a sha256 hash.

shasum -a 256 bomctl_SNAPSHOT-3f16bdb_checksums.txt |awk '{print $1}'

The printed hash can be used to look up the entry at https://search.sigstore.dev/.