<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Analyzing Software Bill of Materials — API Reference

## Syft CLI

```bash
# Generate SBOM from directory
syft packages dir:. -o cyclonedx-json

# Generate SBOM from container image
syft packages docker:app:latest -o spdx-json

# Multiple output formats
syft packages dir:. -o cyclonedx-json=sbom.cdx.json -o spdx-json=sbom.spdx.json

# Table view for quick inspection
syft packages dir:. -o table
```

## Grype (Vulnerability Correlation)

```bash
# Scan SBOM for vulnerabilities
grype sbom:sbom.cdx.json --output json

# Fail on severity threshold
grype sbom:sbom.cdx.json --fail-on critical

# Only show fixed vulnerabilities
grype sbom:sbom.cdx.json --only-fixed

# Filter by severity
grype sbom:sbom.cdx.json --output json | jq '.matches[] | select(.vulnerability.severity == "Critical")'
```

## OSV-Scanner

```bash
# Scan SBOM against OSV database
osv-scanner --sbom=sbom.cdx.json --format json

# Scan lockfiles directly
osv-scanner --lockfile=package-lock.json
osv-scanner --lockfile=requirements.txt
```

## CycloneDX CLI

```bash
# Validate SBOM
cyclonedx validate --input-file sbom.cdx.json --input-format json

# Convert between formats
cyclonedx convert --input-file sbom.cdx.json --output-file sbom.cdx.xml

# Merge multiple SBOMs
cyclonedx merge --input-files sbom1.json sbom2.json --output-file merged.json

# Diff two SBOMs
cyclonedx diff sbom-v1.json sbom-v2.json --output-format json
```

## NTIA Minimum SBOM Elements

| Element | CycloneDX Field | SPDX Field |
|---------|----------------|------------|
| Supplier Name | `components[].supplier` | `packages[].supplier` |
| Component Name | `components[].name` | `packages[].name` |
| Version | `components[].version` | `packages[].versionInfo` |
| Unique Identifier | `components[].purl` | `packages[].externalRefs[].referenceLocator` |
| Dependency Relationship | `dependencies[]` | `relationships[]` |
| Author of SBOM | `metadata.authors` | `creationInfo.creators` |
| Timestamp | `metadata.timestamp` | `creationInfo.created` |

## jq Recipes for SBOM Analysis

```bash
# Count components by type
jq '[.components[].type] | group_by(.) | map({type: .[0], count: length})' sbom.cdx.json

# List all PURLs
jq -r '.components[].purl // empty' sbom.cdx.json

# Find components without licenses
jq '.components[] | select(.licenses == null or (.licenses | length) == 0) | .name' sbom.cdx.json

# Extract dependency tree
jq '.dependencies[] | select(.dependsOn | length > 0)' sbom.cdx.json
```
