/usr/bin/sbomcheck

usage: sbomcheck [-h] [-s {spdx2,spdx3}] [-c {bsi,fsct3-min,ntia}] [-k] [-r TYPE] [-o PATH] [-v]
                 [--debug] [-q] [-V]
                 [PATH]

Check if an SPDX SBOM complies with a compliance standard.

positional arguments:
  PATH                  Filepath for SBOM input

options:
  -h, --help            show this help message and exit
  -s {spdx2,spdx3}, --sbom-spec {spdx2,spdx3}
                        SBOM specification of the input file; see below for details [default:
                        spdx2]
  -c {bsi,fsct3-min,ntia}, --comply {bsi,fsct3-min,ntia}
                        Compliance standards to check against; see below for details [default:
                        ntia]
  -k, --skip-validation
                        Skip validation
  -r TYPE, --output TYPE
                        Report output type; see below for details [default: print]
  -o PATH, --output-file PATH
                        Filepath for report output; if omitted, prints to console
  -v, --verbose         Increase log verbosity: -v = info, -vv = debug
  --debug               Set log verbosity to debug (same as -vv)
  -q, --quiet           Quiet logs: show errors only
  -V, --version         Display version of sbomcheck

choices:
  SBOM specifications (for --sbom-spec):
    spdx2       Software Package Data Exchange (SPDX) 2.x
    spdx3       System Package Data Exchange (SPDX) 3.x

  Compliance standards (for --comply):
    bsi         BSI TR-03183-2 v2.1.0 Cyber Resilience Requirements for Manufacturers and Products
    fsct3-min   2024 CISA Framing Software Component Transparency (minimum expectation)
    ntia        2021 NTIA SBOM Minimum Elements

  Report output types (for --output):
    html        Report in HTML format
    json        Report in JSON format
    none        No report
    print       Report in regular text format

Examples:
  sbomcheck sbom.spdx
  sbomcheck -s spdx3 -c fsct3-min -v sbom.json
  sbomcheck sbom.yaml --output json --output-file report.json