mpm sbom - Export installed packages to a SBOM document.
mpm sbom [OPTIONS] [EXPORT_PATH]
Export list of installed packages to a SPDX or CycloneDX file.
- [EXPORT_PATH]
- --spdx /
--cyclonedx
- SBOM standard to export to.
- --format
[json|xml|yaml|tag|rdf]
- File format of the export. Defaults to JSON for <stdout>. If not
provided, will be autodetected from file extension.
- --overwrite /
--force / --replace
- Allow the target file to be silently wiped out if it already exists.
- --bundled /
--minimal
- Bundled mode (the default) queries each manager for richer metadata
(license, supplier, homepage, checksums, declared dependencies) and merges
per-package upstream SBOM documents into the aggregate when the manager
publishes them (like Homebrew's HOMEBREW_SBOM=1 per-formula files).
Minimal mode lists installed packages with the bare inventory data (name,
version, purl) and skips the metadata extractors entirely. Bundled mode is
slower because it may shell out or read on-disk SBOM files per package;
pick --minimal for fast inventory snapshots.
- -h / --help
- Show this message and exit.
- SBOM_SPDX
- SBOM standard to export to.
- SBOM_EXPORT_FORMAT
- File format of the export. Defaults to JSON for <stdout>. If not
provided, will be autodetected from file extension.
- SBOM_OVERWRITE
- Allow the target file to be silently wiped out if it already exists.
- SBOM_BUNDLED
- Bundled mode (the default) queries each manager for richer metadata
(license, supplier, homepage, checksums, declared dependencies) and merges
per-package upstream SBOM documents into the aggregate when the manager
publishes them (like Homebrew's HOMEBREW_SBOM=1 per-formula files).
Minimal mode lists installed packages with the bare inventory data (name,
version, purl) and skips the metadata extractors entirely. Bundled mode is
slower because it may shell out or read on-disk SBOM files per package;
pick --minimal for fast inventory snapshots.
- SBOM_HELP
- Show this message and exit.
- 0
- Success.
- 1
- A runtime error, or an aborted prompt (Ctrl-C, a declined
confirmation).
- 2
- A usage error: unknown option, invalid value, missing operand, or an
unparsable configuration file.