mpm sbom - Export installed packages to a SBOM document.
mpm sbom [OPTIONS] [EXPORT_PATH]
Export list of installed packages to a SPDX or CycloneDX file.
With --query, restrict the export to installed packages
whose ID or name matches it (fuzzy by default, verbatim with
--exact).
- [EXPORT_PATH]
- --spdx /
--cyclonedx
- SBOM standard to export to.
- --format
[json|xml|yaml|tag|rdf]
- File format of the export. Defaults to JSON for <stdout>. If not
provided, will be autodetected from file extension.
- --overwrite /
--force / --replace
- Allow the target file to be silently wiped out if it already exists.
- --bundled /
--minimal
- Bundled mode (the default) queries each manager for richer metadata
(license, supplier, homepage, checksums, declared dependencies) and merges
per-package upstream SBOM documents into the aggregate when the manager
publishes them (like Homebrew's HOMEBREW_SBOM=1 per-formula files).
Minimal mode lists installed packages with the bare inventory data (name,
version, purl) and skips the metadata extractors entirely. Bundled mode is
slower because it may shell out or read on-disk SBOM files per package;
pick --minimal for fast inventory snapshots.
- --query
QUERY
- Only export installed packages whose ID or name matches QUERY. Fuzzy by
default (case-insensitive, tokenized); see --exact.
- --exact /
--fuzzy
- With --query, require a verbatim match on the package ID or name instead
of the default fuzzy match. No effect without --query.
- -h / --help
- Show this message and exit.
- SBOM_SPDX
- SBOM standard to export to.
- SBOM_EXPORT_FORMAT
- File format of the export. Defaults to JSON for <stdout>. If not
provided, will be autodetected from file extension.
- SBOM_OVERWRITE
- Allow the target file to be silently wiped out if it already exists.
- SBOM_BUNDLED
- Bundled mode (the default) queries each manager for richer metadata
(license, supplier, homepage, checksums, declared dependencies) and merges
per-package upstream SBOM documents into the aggregate when the manager
publishes them (like Homebrew's HOMEBREW_SBOM=1 per-formula files).
Minimal mode lists installed packages with the bare inventory data (name,
version, purl) and skips the metadata extractors entirely. Bundled mode is
slower because it may shell out or read on-disk SBOM files per package;
pick --minimal for fast inventory snapshots.
- SBOM_QUERY
- Only export installed packages whose ID or name matches QUERY. Fuzzy by
default (case-insensitive, tokenized); see --exact.
- SBOM_EXACT
- With --query, require a verbatim match on the package ID or name instead
of the default fuzzy match. No effect without --query.
- SBOM_HELP
- Show this message and exit.
- 0
- Success.
- 1
- A runtime error, or an aborted prompt (Ctrl-C, a declined
confirmation).
- 2
- A usage error: unknown option, invalid value, missing operand, or an
unparsable configuration file.