cdxgen mit Homebrew, Nix, winget installieren

Projektlinks

• Homepage
• Upstream-Dokumentation
• Paketmanager-Seite

Befehle und Aliase

• cbom
• cdx-audit
• cdx-convert
• cdx-sign
• cdx-validate
• cdx-verify
• cdxgen
• cdxgen-secure
• cdxi
• evinse
• hbom
• obom
• saasbom
• spdxgen

Projektgeschichte

The GitHub API records the cdxgen repository as created on 2019-12-30. Its package metadata identifies @cyclonedx/cdxgen as the npm package and points to the official GitHub repository, while the README now presents cdxgen as a broader BOM toolkit covering SBOM, CBOM, OBOM, SaaSBOM, HBOM, AI-BOM, and validation/signing workflows.

The project grew from a CycloneDX SBOM generator into a multi-command supply-chain analysis suite with commands such as cdxgen, cdx-validate, cdx-convert, cdx-sign, cdx-verify, cdx-audit, evinse, hbom, obom, cbom, saasbom, aibom, and spdxgen.

Adoptionsgeschichte

cdxgen's adoption tracks the rise of SBOM requirements in software supply-chain security. The README positions it for developers, AppSec, compliance teams, SOC analysts, hardware teams, and AI platform teams, and the supplied package-manager metadata shows Homebrew, Nix, and winget packaging in addition to npm and GitHub release binaries.

Wie es verwendet wird

The common developer path is cdxgen -o bom.json . for a local project, with additional modes for containers, git URLs, purls, hosts, AI assets, and validation/conversion/signing. The README emphasizes CI/CD use and standalone binaries for several commands.

Warum Paket-Nerds sich dafür interessieren

cdxgen is package-nerd significant because it turns package graphs into standardized artifacts that other tools can consume. It sits at the intersection of language package managers, container metadata, CycloneDX, SPDX, Dependency-Track-style workflows, and modern compliance demands.

Zeitleiste

• 2019: GitHub API records the cdxgen repository as created on 2019-12-30.
• 2024: Git tags include the v10 series, showing the project had reached a mature major-version cadence.
• 2026: Homebrew formula packages cdxgen 12.7.0, and the README documents CycloneDX 1.5-1.7 plus SPDX 3.0.1 support.

Related projects

• CycloneDX is the primary BOM specification cdxgen emits.
• OWASP Dependency-Track and depscan are adjacent downstream/security workflows referenced by the project documentation.
• SPDX is supported as an export format through cdxgen and cdx-convert.

Quellen

• https://api.github.com/repos/cdxgen/cdxgen
• https://github.com/cdxgen/cdxgen
• https://github.com/CycloneDX/cdxgen
• https://cdxgen.github.io/cdxgen
• https://github.com/cdxgen/cdxgen#readme
• https://formulae.brew.sh/api/formula/cdxgen.json
• https://api.github.com/repos/CycloneDX/cdxgen
• https://raw.githubusercontent.com/CycloneDX/cdxgen/master/package.json