# Install cyclonedx-gomod with Homebrew, Nix Creates CycloneDX Software Bill of Materials (SBOM) from Go modules. Version 1.10.0 via Homebrew; verified 2026-06-20. ## Install ```sh sudo av install brew:cyclonedx-gomod ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install cyclonedx-gomod ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#cyclonedx-gomod ``` Evidence: nixpkgs package indexes: pkgs/by-name/cy/cyclonedx-gomod/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:cyclonedx-gomod - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.10.0 - **Source summary:** Creates CycloneDX Software Bill of Materials (SBOM) from Go modules - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-06-20T16:39:02Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - cyclonedx-gomod (cli) - cyclonedx-gomod (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.10.0 - Package-manager updated: 2026-06-20 - Local data: ok - Upstream repository: https://github.com/CycloneDX/cyclonedx-gomod - info: No cached GitHub release or tag data was available. ## Project history and usage cyclonedx-gomod is the CycloneDX command-line generator for Go modules, applications, and Go binaries. ### Project history The repository was created in March 2021, during the period when CycloneDX was moving from its original SBOM format toward richer supply-chain metadata. Its early releases established the Go-specific generator role, while later versions tracked newer CycloneDX specification versions and Go build-model details. ### Adoption history The official CycloneDX tool center lists CycloneDX for Go modules as an open-source command-line utility and Go library, and the README documents Homebrew, GitHub release binaries, and go install as installation paths. That combination made it a natural fit for CI, GoReleaser, and distribution workflows. ### How it is used cyclonedx-gomod offers app, mod, and bin subcommands so users can choose between SBOMs for built applications, whole modules, or existing Go binaries. It accounts for Go build constraints such as GOARCH, GOOS, CGO_ENABLED, and GOFLAGS when producing application SBOMs. ### Why package nerds care For package managers and release engineers, cyclonedx-gomod is interesting because Go's module graph, build tags, and embedded module metadata affect what should appear in an SBOM; the tool encodes those Go-specific rules instead of treating Go projects as generic source trees. ### Timeline - 2021: Repository created and v0.1.0 released. - 2024: Releases tracked CycloneDX 1.6-era output support. - 2026: v1.10.0 release line remained active. ### Related projects - Related CycloneDX tools include cyclonedx-cli for BOM manipulation and cyclonedx-python for Python environments and manifests. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** cyclonedx-gomod - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - cyclonedx-gomod: normalized package name match | nixpkgs package indexes: pkgs/by-name/cy/cyclonedx-gomod/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://www.automicvault.com/pkg/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [cargo-cyclonedx](https://www.automicvault.com/pkg/brew/cargo-cyclonedx/) - Shares the same upstream homepage. - [cyclonedx-cli](https://www.automicvault.com/pkg/brew/cyclonedx-cli/) - Shares the same upstream homepage. - [cyclonedx-python](https://www.automicvault.com/pkg/brew/cyclonedx-python/) - Shares the same upstream homepage. - [sbom-tool](https://www.automicvault.com/pkg/brew/sbom-tool/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [tern](https://www.automicvault.com/pkg/brew/tern/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [cdxgen](https://www.automicvault.com/pkg/brew/cdxgen/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [chainloop-cli](https://www.automicvault.com/pkg/brew/chainloop-cli/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [syft](https://www.automicvault.com/pkg/brew/syft/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [bom](https://www.automicvault.com/pkg/brew/bom/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. ## Combined YAML source View the package source record on GitHub. [combined/cyclonedx-gomod.yml](https://github.com/automic-vault/db/blob/main/combined/cyclonedx-gomod.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph