Exporting an SBOM | Cefense docs

cf sbom exports the component inventory recorded by a scan, in CycloneDX or SPDX.

Enable the check first

There is nothing to export until a scan records componentsbash

cf settings checks sbom --add
cf scan --wait
cf sbom

Exporting

Both formats, to stdout or a filebash

cf sbom
cf sbom --format spdx
cf sbom --output sbom.json
cf sbom --scan <scan-id>

Flag	Values	Default
`--format`	`cyclonedx`, `spdx`	`cyclonedx`
`--output <file>`	a file path	write to stdout
`--scan <id>`	a scan id	the newest scan that has components

Without --output the document goes to stdout, which is what you want in a pipeline. With it, the file is written and only the path is reported. See Component inventory and SBOM.

Have a correction or need help?

Email the docs team