<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SBOM Generation — API Reference

## Syft CLI

```bash
# From directory
syft packages dir:. -o cyclonedx-json
syft packages dir:. -o spdx-json

# From container
syft packages docker:app:latest -o cyclonedx-json

# From registry
syft packages registry:ghcr.io/org/app:v1 -o cyclonedx-json

# Multiple outputs
syft packages dir:. -o cyclonedx-json=sbom.cdx.json -o spdx-json=sbom.spdx.json

# Table format
syft packages dir:. -o table
```

## Grype (SBOM Scanning)

```bash
# Scan SBOM
grype sbom:sbom.cdx.json --output json

# Fail on severity
grype sbom:sbom.cdx.json --fail-on critical

# Only fixed vulns
grype sbom:sbom.cdx.json --only-fixed
```

## Cosign Attestation

```bash
# Sign image
cosign sign --key cosign.key app:latest

# Attest SBOM
cosign attest --predicate sbom.cdx.json --type cyclonedx app:latest

# Verify signature
cosign verify --key cosign.pub app:latest

# Verify attestation
cosign verify-attestation --key cosign.pub --type cyclonedx app:latest
```

## CycloneDX CLI

```bash
# Validate
cyclonedx validate --input-file sbom.cdx.json --input-format json

# Convert formats
cyclonedx convert --input-file sbom.cdx.json --output-file sbom.cdx.xml

# Merge SBOMs
cyclonedx merge --input-files sbom1.json sbom2.json --output-file merged.json
```

## NTIA Minimum SBOM Elements

| Element | Description |
|---------|-------------|
| Supplier Name | Entity that creates/distributes component |
| Component Name | Package/library name |
| Version | Version identifier |
| Unique Identifier | PURL or CPE |
| Dependency Relationship | Direct vs transitive |
| Author of SBOM | Entity that generated the SBOM |
| Timestamp | When SBOM was generated |
