# Install cdxgen with Homebrew, Nix, winget Creates CycloneDX Software Bill-of-Materials (SBOM) for projects. Version 12.7.0 via Homebrew; verified 2026-07-05. ## Install ```sh sudo av install brew:cdxgen ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install cdxgen ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#cdxgen ``` Evidence: nixpkgs package indexes: pkgs/by-name/cd/cdxgen/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ### Windows - winget (92%): ```sh winget install --id CycloneDX.cdxgen -e ``` Evidence: Windows Package Manager source index: CycloneDX.cdxgen from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:cdxgen - **Package manager:** Homebrew - **Package manager page:** - **Version:** 12.7.0 - **Source summary:** Creates CycloneDX Software Bill-of-Materials (SBOM) for projects - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-07-05T00:14:30+09:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - cbom (cli) - cdx-audit (cli) - cdx-convert (cli) - cdx-sign (cli) - cdx-validate (cli) - cdx-verify (cli) - cdxgen (cli) - cdxgen-secure (cli) - cdxi (cli) - evinse (cli) - hbom (cli) - obom (cli) - saasbom (cli) - spdxgen (cli) - cbom (alias) - cdx-audit (alias) - cdx-convert (alias) - cdx-sign (alias) - cdx-validate (alias) - cdx-verify (alias) - cdxgen (alias) - cdxgen-secure (alias) - cdxi (alias) - evinse (alias) - hbom (alias) - obom (alias) - saasbom (alias) - spdxgen (alias) ## Dependencies - dotnet - node - ruby - sourcekitten - trivy ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 12.7.0 - Package-manager updated: 2026-07-05 - Local data: ok - Upstream repository: https://github.com/CycloneDX/cdxgen - info: No cached GitHub release or tag data was available. ## Project history and usage CycloneDX Generator, usually called cdxgen, is a CLI, library, REPL, and server for generating CycloneDX and SPDX software bill of materials documents from source trees, container images, binaries, hosts, and related inputs. ### Project history The GitHub API records the cdxgen repository as created on 2019-12-30. Its package metadata identifies @cyclonedx/cdxgen as the npm package and points to the official GitHub repository, while the README now presents cdxgen as a broader BOM toolkit covering SBOM, CBOM, OBOM, SaaSBOM, HBOM, AI-BOM, and validation/signing workflows. The project grew from a CycloneDX SBOM generator into a multi-command supply-chain analysis suite with commands such as cdxgen, cdx-validate, cdx-convert, cdx-sign, cdx-verify, cdx-audit, evinse, hbom, obom, cbom, saasbom, aibom, and spdxgen. ### Adoption history cdxgen's adoption tracks the rise of SBOM requirements in software supply-chain security. The README positions it for developers, AppSec, compliance teams, SOC analysts, hardware teams, and AI platform teams, and the supplied package-manager metadata shows Homebrew, Nix, and winget packaging in addition to npm and GitHub release binaries. ### How it is used The common developer path is cdxgen -o bom.json . for a local project, with additional modes for containers, git URLs, purls, hosts, AI assets, and validation/conversion/signing. The README emphasizes CI/CD use and standalone binaries for several commands. ### Why package nerds care cdxgen is package-nerd significant because it turns package graphs into standardized artifacts that other tools can consume. It sits at the intersection of language package managers, container metadata, CycloneDX, SPDX, Dependency-Track-style workflows, and modern compliance demands. ### Timeline - 2019: GitHub API records the cdxgen repository as created on 2019-12-30. - 2024: Git tags include the v10 series, showing the project had reached a mature major-version cadence. - 2026: Homebrew formula packages cdxgen 12.7.0, and the README documents CycloneDX 1.5-1.7 plus SPDX 3.0.1 support. ### Related projects - CycloneDX is the primary BOM specification cdxgen emits. - OWASP Dependency-Track and depscan are adjacent downstream/security workflows referenced by the project documentation. - SPDX is supported as an export format through cdxgen and cdx-convert. ### Sources - - - - - - - - ## Security Notes No matching local secret-handling manifest was found for cdxgen. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: .cdxgenrc, .cdxgen.json, .cdxgen.yml, .cdxgen.yaml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** cdxgen - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - cdxgen: normalized package name match | nixpkgs package indexes: pkgs/by-name/cd/cdxgen/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - winget - CycloneDX.cdxgen: normalized package name match | Windows Package Manager source index: CycloneDX.cdxgen from https://cdn.winget.microsoft.com/cache/source.msix ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [dotnet](https://www.automicvault.com/pkg/brew/dotnet/) - Runtime dependency declared by Homebrew. - [node](https://www.automicvault.com/pkg/brew/node/) - Runtime dependency declared by Homebrew. - [ruby](https://www.automicvault.com/pkg/brew/ruby/) - Runtime dependency declared by Homebrew. - [sourcekitten](https://www.automicvault.com/pkg/brew/sourcekitten/) - Runtime dependency declared by Homebrew. - [trivy](https://www.automicvault.com/pkg/brew/trivy/) - Runtime dependency declared by Homebrew. - [cyclonedx-gomod](https://www.automicvault.com/pkg/brew/cyclonedx-gomod/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [cyclonedx-python](https://www.automicvault.com/pkg/brew/cyclonedx-python/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [chainloop-cli](https://www.automicvault.com/pkg/brew/chainloop-cli/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [sbom-tool](https://www.automicvault.com/pkg/brew/sbom-tool/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [syft](https://www.automicvault.com/pkg/brew/syft/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [tern](https://www.automicvault.com/pkg/brew/tern/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [bom](https://www.automicvault.com/pkg/brew/bom/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [cargo-audit](https://www.automicvault.com/pkg/brew/cargo-audit/) - Shares av.db curated category or tags: cli, security, software-supply-chain. ## Combined YAML source View the package source record on GitHub. [combined/cdxgen.yml](https://github.com/automic-vault/db/blob/main/combined/cdxgen.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph