macOS
Homebrewverified · 100%
brew install bomctllocal Homebrew formula metadata
brew
Install bomctl with Homebrew, apk, zypper
Format-agnostic SBOM tooling for the stages between SBOM generation and analysis. Version 0.4.3 via Homebrew; verified 2026-07-05. Also installable with apk: sudo apk add bomctl.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add bomctlAlpine Linux edge package indexes · bomctl · source: dl-cdn.alpinelinux.org
openSUSE zypperverified · 92%
sudo zypper install bomctlopenSUSE Tumbleweed package metadata · bomctl · source: download.opensuse.org
overview
Package summary
Format-agnostic SBOM tooling for the stages between SBOM generation and analysis
Project links
Commands and aliases
- bomctl
history
Project history and usage
bomctl is experimental, format-agnostic SBOM tooling intended to bridge the gap between SBOM generation and SBOM analysis tools.
Project history
The GitHub repository was created in January 2024. The README identifies bomctl as an OpenSSF Sandbox project under active development and says it builds on protobom for an SBOM-agnostic component graph.
Adoption history
The project documents installation through a Homebrew tap, container images on Docker Hub, and source builds, and the supplied package facts show availability through Homebrew, apk, and zypper.
How it is used
Users fetch, import, list, alias, merge, tag, export, and push SBOMs. bomctl stores SBOMs in a persistent cache and can fetch over HTTPS, OCI, Git, GitHub, and GitLab.
Why package nerds care
bomctl is interesting to package and supply-chain users because it treats SBOMs as package-like artifacts that can be cached, transformed, pushed, and moved between SPDX, CycloneDX, and related ecosystems.
Timeline
- 2024: GitHub repository created.
- 2024: v0.1.0-alpha appears in GitHub releases.
- 2025: v0.4.3 appears in GitHub releases.
Related projects
- protobom, OpenSSF, SPDX, CycloneDX, GUAC, Sigstore
Sources
security posture
No protected-tool coverage found yet
No matching local secret-handling manifest was found for bomctl. Nucleus package metadata is still published here so future coverage has a stable package URL.
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Build metadata lists 1 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.netrc
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
bomctl | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-25
manager version0.4.3
manager updated2026-07-05
local dataok
upstreamcurrent
latest detectedv0.4.3
https://github.com/bomctl/bomctl
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:bomctl |
|---|---|
| Version | 0.4.3 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/bomctl |
| Homepage | https://github.com/bomctl/bomctl |
| Repository | https://github.com/bomctl/bomctl |
| Upstream docs | https://github.com/bomctl/bomctl#readme |
| License | Apache-2.0 |
| Source archive | https://github.com/bomctl/bomctl/archive/refs/tags/v0.4.3.tar.gz |
| Last updated | 2026-07-05T10:30:30Z |
| Pulse | updated |
| Build dependencies | go |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | bomctl |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
apk95%
bomctl 0.1.9-r16
Format agnostic SBOM tooling
https://github.com/bomctl/bomctl
sudo apk add bomctl- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
apk95%
bomctl-bash-completion 0.1.9-r16
Bash completions for bomctl
https://github.com/bomctl/bomctl
sudo apk add bomctl-bash-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- normalized package name match
- Matched by: Bomctl
apk95%
bomctl-fish-completion 0.1.9-r16
Fish completions for bomctl
https://github.com/bomctl/bomctl
sudo apk add bomctl-fish-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- normalized package name match
- Matched by: Bomctl
apk95%
bomctl-zsh-completion 0.1.9-r16
Zsh completions for bomctl
https://github.com/bomctl/bomctl
sudo apk add bomctl-zsh-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: bomctl
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl 0.4.3-1.4
Format agnostic SBOM tooling
https://github.com/bomctl/bomctl
sudo zypper install bomctl- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl-bash-completion 0.4.3-1.4
Bash Completion for bomctl
https://github.com/bomctl/bomctl
sudo zypper install bomctl-bash-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: bomctl
- 2 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl-fish-completion 0.4.3-1.4
Fish Completion for bomctl
https://github.com/bomctl/bomctl
sudo zypper install bomctl-fish-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
zypper95%
bomctl-zsh-completion 0.4.3-1.4
Zsh Completion for bomctl
https://github.com/bomctl/bomctl
sudo zypper install bomctl-zsh-completion- License: Apache-2.0
- Category: System/Shells
- Architecture: noarch
- Source Package: bomctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bomctl
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment