Overview¶

bomify builds OCI packages from CycloneDX SBOMs. It orchestrates; plugins (bomify-plugin-<kind>) do the type-specific work of fetching, publishing, scanning, and signing.

It mirrors Docker and Podman:

A package is built from an SBOM the way an image is built from a Dockerfile, and a tag names one.
bomify package works much like docker image.
Docker's layers are bomify's components, each pulled, cached, and reused independently by content hash.

Pre-alpha

Flags, the data directory layout, and the plugin contracts may change without notice.

New here?

Install bomify and its plugins, then build a package.

Getting started
Looking for a flag?

The reference for every command.

Usage
Building a plugin?

Extend bomify with your own plugin.

Building a plugin