Automic VaultAutomic Vault

brew

使用 Homebrew, apt, dnf, MacPorts, pacman, zypper, winget 安装 bomber

查看 bomber 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

安装命令安全说明

安装

其他安装命令

macOS

Homebrew已验证 · 100%
brew install bomber

local Homebrew formula metadata

MacPorts已验证 · 94%
sudo port install bomber

MacPorts ports tree · kde/bomber/Portfile · 来源: api.github.com

Linux

Debian apt已验证 · 92%
sudo apt install bomber

Debian stable package indexes · bomber · 来源: deb.debian.org

Fedora dnf已验证 · 92%
sudo dnf install bomber

Fedora Rawhide package metadata · bomber · 来源: dl.fedoraproject.org

Arch Linux pacman已验证 · 92%
sudo pacman -S bomber

Arch Linux sync databases · bomber · 来源: geo.mirror.pkgbuild.com

openSUSE zypper已验证 · 92%
sudo zypper install bomber

openSUSE Tumbleweed package metadata · bomber · 来源: download.opensuse.org

Windows

Windows Package Manager已验证 · 92%
winget install --id KDE.Bomber -e

Windows Package Manager source index · KDE.Bomber · 来源: cdn.winget.microsoft.com

概览

软件包摘要

Scans Software Bill of Materials for security vulnerabilities

命令和别名

  • bomber

历史

项目历史与用法

bomber is a DevSecOps command-line scanner for Software Bill of Materials files. It reads CycloneDX, SPDX, and Syft SBOMs and checks listed components against vulnerability providers.

项目历史

The Git repository begins in July 2022, with the first tagged public release following in August 2022. The README describes the project as a response to a practical SBOM question: after receiving a vendor SBOM for closed-source software, users need a fast way to identify component vulnerabilities and license risk.

The project evolved through v0.3 and v0.4 releases in 2022 and 2023, then v0.5 in 2024. Its README labels the project beta while documenting a broad feature set around providers, output formats, ignore lists, severity filtering, data enrichment, and CI-friendly stdin scanning.

采用历史

bomber belongs to the post-SBOM-surge security tooling ecosystem. The input package metadata lists Homebrew plus Linux distribution packages, MacPorts, Pacman, Ubuntu, and zypper, reflecting adoption as a portable security CLI rather than a library embedded in applications.

使用方式

Typical use is `bomber scan` against one SBOM file or a directory of SBOMs. The README documents OSV as the default no-credential provider, with optional GitHub Advisory Database, Sonatype OSS Index, and Snyk providers, plus stdout, HTML, JSON, and Markdown output modes.

为什么软件包爱好者会关心

bomber is package-nerd relevant because it treats package metadata itself as the object of security analysis. It sits downstream of SBOM generators such as Syft and normalizes vulnerability lookup across package ecosystems and advisory providers.

时间线

  • 2022-07-08: Initial repository commit.
  • 2022-08-22: v0.1.0 tag and initial public version.
  • 2022-09-19: v0.3.0 tag appears during rapid early development.
  • 2023-12-13: v0.4.8 tag appears.
  • 2024-08-15: v0.5.0 tag appears.
  • 2024-09-23: v0.5.1 tag appears.

Related projects

  • CycloneDX, SPDX, and Syft are documented input SBOM formats.
  • OSV, GitHub Advisory Database, Sonatype OSS Index, and Snyk are documented vulnerability providers.
  • Syft is a common companion tool because it can generate an SBOM and pipe it directly into bomber.

安全态势

风险级别：绿色

narrow executable package without higher-risk signals.

风险分类器

绿色 风险 · 低 置信度 · appliance

原因

  • narrow executable package without higher-risk signals

信号

  • metadata:no-higher-risk-signals

安装行为

  • formula 元数据中未记录 Homebrew post-install 钩子。
  • Homebrew bottle 元数据适用于 6 个平台目标。
  • 构建元数据列出 1 个构建依赖。

建议审查

在无人值守的代理使用前，请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

可执行文件

已安装的可执行文件

命令类型暴露范围备注
bombercli全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时，才会提示版本落后。

页面生成时间2026-07-25
管理器版本0.5.1
管理器更新时间2026-06-15
本地数据OK
上游当前
检测到的最新版本v0.5.1

https://github.com/devops-kung-fu/bomber

  • OK没有生成新鲜度警告。

安装元数据

软件包元数据

软件包键brew:bomber
版本0.5.1
软件包管理器Homebrew
软件包管理器页面https://formulae.brew.sh/formula/bomber
主页https://devops-kung-fu.github.io/bomber/
仓库https://github.com/devops-kung-fu/bomber
上游文档https://devops-kung-fu.github.io/bomber
许可证MPL-2.0
源码归档https://github.com/devops-kung-fu/bomber/archive/refs/tags/v0.5.1.tar.gz
最后更新2026-06-15T10:20:11-04:00
Pulseupdated
构建依赖go
Bottle可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install未定义
服务未声明

注册表事实

源数据库详情

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namebomber
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

源数据库匹配

其他软件包管理器记录

匹配项来自外部软件包管理器索引，并与本地 Automic Vault 软件包链接分开显示。

Debian apt95%

bomber 4:25.04.0-1

arcade spaceship game

https://apps.kde.org/bomber/

sudo apt install bomber
  • Section: games
  • Architecture: amd64
  • 16 依赖
  • 1 可选依赖
  • normalized package name match
  • 匹配方式：Bomber
Debian stable package indexes · deb.debian.org · Debian stable package indexes: bomber from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Ubuntu apt95%

bomber 4:23.08.5-0ubuntu3

arcade spaceship game

http://games.kde.org/

sudo apt install bomber
  • Section: universe/games
  • Architecture: amd64
  • 16 依赖
  • 1 可选依赖
  • normalized package name match
  • 匹配方式：Bomber
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: bomber from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
dnf95%

bomber 26.04.2-1.fc45

Arcade bombing game

https://invent.kde.org/games/bomber

sudo dnf install bomber
  • License: LGPL-2.0-or-later AND GFDL-1.2-or-later
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: bomber
  • 17 依赖
  • 3 提供
  • normalized package name match
  • 匹配方式：Bomber
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: bomber from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
pacman95%

bomber 26.04.2-1

A single player arcade game

https://apps.kde.org/bomber/

sudo pacman -S bomber
  • License: GPL-2.0-or-later AND LGPL-2.0-or-later
  • Architecture: x86_64
  • 13 依赖
  • normalized package name match
  • 匹配方式：Bomber
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: bomber from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

bomber 26.04.2-1.1

Game involving the invasion of cities with a plane

https://apps.kde.org/bomber

sudo zypper install bomber
  • License: GPL-2.0-or-later
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: bomber
  • 16 依赖
  • 4 提供
  • normalized package name match
  • 匹配方式：Bomber
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: bomber from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

bomber-lang 26.04.2-1.1

Translations for package bomber

https://apps.kde.org/bomber

sudo zypper install bomber-lang
  • License: GPL-2.0-or-later
  • Category: System/Localization
  • Architecture: noarch
  • Source Package: bomber
  • 1 依赖
  • 3 提供
  • normalized package name match
  • 匹配方式：Bomber
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: bomber-lang from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
MacPorts95%

bomber

sudo port install bomber
  • normalized package name match
  • 匹配方式：Bomber
MacPorts ports tree · api.github.com · MacPorts ports tree: kde/bomber/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
winget95%

KDE.Bomber

winget install --id KDE.Bomber -e
  • normalized package name match
  • 匹配方式：Bomber
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: KDE.Bomber from https://cdn.winget.microsoft.com/cache/source.msix

软件包图谱

链接来自本地软件包关系图、补充数据、依赖边、生态匹配和软件包 hub 归属。

相关工具

  • goBuild dependency declared by Homebrew.

相同工作流

  • cve-bin-toolShares av.db curated category or tags: cli, devsecops, sbom, security, vulnerability-scanner.
  • nucleiShares av.db curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning.
  • osv-scannerShares av.db curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning.
  • safetyShares av.db curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning.
  • chain-benchShares av.db curated category or tags: cli, devsecops, security.
  • chainloop-cliShares av.db curated category or tags: cli, devsecops, sbom, security.

来源线索

由仓库数据生成

此页面由 av-web 从 scripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

使用的来源

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment