# `source-merge` command

Processes an SBOM and merges the .orig and .debian tarballs. The tarballs have to be downloaded first.

    usage: debsbom source-merge [-h] [-t {cdx,spdx}]
                                [--compress {no,bzip2,gzip,xz,zstd,lz4}]
                                [--apply-patches] [--mtime MTIME]
                                [--pkgdir PKGDIR] [--outdir OUTDIR]
                                [bomin]

## Positional Arguments

`bomin`

  sbom file(s) to process for ‘bomin’. Use ‘-’ to read from stdin

## Named Arguments

`-t, --sbom-type`

  Possible choices: cdx, spdx

  SBOM type to process (default: auto-detect), required when reading from stdin

`--compress`

  Possible choices: no, bzip2, gzip, xz, zstd, lz4

  compress merged tarballs (default: gzip)

  Default: `'gzip'`

`--apply-patches`

  apply debian patches

  Default: `False`

`--mtime`

  set mtime for creating tar archives in ISO 8601 format. If this option is not set, the timestamp from the most recent changelog entry is used for reproducible builds.

`--pkgdir`

  directory with downloaded packages

  Default: `'downloads/sources'`

`--outdir`

  directory to store the merged files

  Default: `'downloads/sources'`