BOMTOOL(1) General Commands Manual BOMTOOL(1)

# [NAME](#NAME)

`bomtool` — a tool for generating SPDX-based software bills of material

# [SYNOPSIS](#SYNOPSIS)

`bomtool` \[`options`] `module ...`

# [DESCRIPTION](#DESCRIPTION)

`bomtool` is a program which generates a textual SPDX 2.0 software bill of materials (SBOM) for a given set of pkg-config modules. The output of this tool can then be translated into other SBOM formats as necessary.

The `options` are as follows:

[`--about`](#about)

Print the version number, the Copyright notice, and the license of the `bomtool` program to standard output and exit. Most other options and all command line arguments are ignored.

[`--version`](#version)

Print the version number of the `bomtool` program to standard output and exit. Most other options and all command line arguments are ignored.

[`--define-variable`](#define-variable)=`varname`=`value`

Define `varname` as `value`. Variables are used in query output, and some modules' results may change based on the presence of a variable definition.

[`--creation-time`](#creation-time) `time`

Use `time` as the value of the `Created` field in the generated SBOM instead of the current time. SPDX recommends using an ISO 8601-formatted time, which is: YYYY-MM-DDThh:mm:ssZ. This takes precedence over the `SOURCE_DATE_EPOCH` environment variable.

[`--output`](#output) `file`

Write the generated SBOM to `file` instead of standard output.

# [ENVIRONMENT](#ENVIRONMENT)

[`PKG_CONFIG_DEBUG_SPEW`](#PKG_CONFIG_DEBUG_SPEW)

If set, print debugging messages to stderr.

[`PKG_CONFIG_IGNORE_CONFLICTS`](#PKG_CONFIG_IGNORE_CONFLICTS)

If set, ignore `Conflicts` rules in modules. Has the same effect as the `--ignore-conflicts` option in [pkgconf(1)](/man/os/pkgconf/pkgconf.1)

[`PKG_CONFIG_LIBDIR`](#PKG_CONFIG_LIBDIR)

A colon-separated list of low-priority directories where [pc(5)](/man/os/pkgconf/pc.5) files are looked up. The module search path is constructed by appending this list to `PKG_CONFIG_PATH`, which enjoys higher priority. If `PKG_CONFIG_LIBDIR` is not defined, the default list compiled into the `bomtool` program from the `PKG_DEFAULT_PATH` preprocessor macro is appended instead. If `PKG_CONFIG_LIBDIR` is defined but empty, nothing is appended.

[`PKG_CONFIG_MAXIMUM_TRAVERSE_DEPTH`](#PKG_CONFIG_MAXIMUM_TRAVERSE_DEPTH)

Impose a limit on the allowed depth in the dependency graph.

[`PKG_CONFIG_PATH`](#PKG_CONFIG_PATH)

A colon-separated list of high-priority directories where [pc(5)](/man/os/pkgconf/pc.5) files are looked up.

[`PKG_CONFIG_PRELOADED_FILES`](#PKG_CONFIG_PRELOADED_FILES)

Colon-separated list of [pc(5)](/man/os/pkgconf/pc.5) files which are loaded before any other pkg-config files. These packages are given highest priority over any other [pc(5)](/man/os/pkgconf/pc.5) files that would otherwise provide a given package.

[`SOURCE_DATE_EPOCH`](#SOURCE_DATE_EPOCH)

If set, and the `--creation-time` option is not given, the `Created` field in the generated SBOM is derived from this UNIX timestamp instead of the current time, allowing for reproducible SBOM generation.

# [EXIT STATUS](#EXIT_STATUS)

The `bomtool` utility exits 0 on success, and >0 if an error occurs.

# [EXAMPLES](#EXAMPLES)

Generating an SBOM for the package named foo:

`$ bomtool foo`

`SPDXVersion: SPDX-2.2`

`DataLicense: CC0-1.0`

`SPDXID: SPDXRef-DOCUMENT`

`DocumentName: SBOM-SPDX-fooC641.2.3`

`DocumentNamespace: https://spdx.org/spdxdocs/bomtool`

`Creator: Tool: bomtool`

`[...]`

# [SEE ALSO](#SEE_ALSO)

[pc(5)](/man/os/pkgconf/pc.5), [pkgconf(1)](/man/os/pkgconf/pkgconf.1)

June 24, 2026 Linux 4.19.0-gvisor

---

Document: bomtool(1) from pkgconf 3.0.7-r0 (Chainguard OS)
Source: https://github.com/pkgconf/pkgconf