218  cdxgen(1) - Kailash Tool Reference

218.1 cdxgen

cdxgen - CycloneDX cdxgen — creates CycloneDX SBOMs for source trees and images across languages.

Layer DEFENCE
Category d-04-provenance-signing-trust
Safety class safe
Licence Apache-2.0
Upstream github.com/CycloneDX/cdxgen

218.1.1 NAME

cdxgen - CycloneDX cdxgen — creates CycloneDX SBOMs for source trees and images across languages.

218.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

VERSION="v13.4.0"
ASSET="cdx-audit-linux-amd64"
BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"

curl -fsSLO "${BASE_URL}/${ASSET}"
curl -fsSLO "${BASE_URL}/${ASSET}.sha256"
sha256sum -c "${ASSET}.sha256"
chmod +x "${ASSET}"
./"${ASSET}" --help
VERSION="v13.4.0"
ASSET="cdx-audit-darwin-arm64"
BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"

curl -fsSLO "${BASE_URL}/${ASSET}"
curl -fsSLO "${BASE_URL}/${ASSET}.sha256"
shasum -a 256 -c "${ASSET}.sha256"
chmod +x "${ASSET}"
./"${ASSET}" --help

218.1.3 DESCRIPTION (upstream)

cdxgen is a CLI tool, library, REPL, and server to create, validate, sign, and verify software BOMs. It generates CycloneDX JSON BOMs and supports SPDX 3.0.1 JSON-LD export. CycloneDX is a full-stack BOM specification that is easily created, human and machine-readable, and simple to parse. The tool generates BOMs targeting CycloneDX specification versions 1.6, 1.7, and 2.0, and the output can be downgraded to 1.4 or 1.5 for legacy consumers. Supported BOM formats: - Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems. - Software (SBOM) - For many languages and container images. - Cry

218.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (6 matches, e.g. environment variable, environment variable). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

218.1.5 SEE ALSO

ref: pin - verified 2026-10-14