# `generate` command

The command creates comprehensive SBOMs that include all installed software packages and their dependencies (binary, source package and built-using). These SBOM outputs are designed to serve as reliable input for vulnerability management systems and license compliance checks.

Note

This command can be executed in an air-gapped environment.

Generate SBOMs from the dpkg package list

    usage: debsbom generate [-h] [-o OUT] [--distro-name DISTRO_NAME]
                            [--distro-supplier DISTRO_SUPPLIER]
                            [--distro-version DISTRO_VERSION]
                            [--distro-summary DISTRO_SUMMARY]
                            [--base-distro-vendor {debian,ubuntu}]
                            [--cdx-standard {default,standard-bom}]
                            [--spdx-namespace SPDX_NAMESPACE]
                            [--cdx-serialnumber CDX_SERIALNUMBER]
                            [--timestamp TIMESTAMP] [--add-meta-data key=value]
                            [--validate] [-t {cdx,spdx}] [-r ROOT]
                            [--from-pkglist] [--distro-arch DISTRO_ARCH]
                            [--with-licenses]
                            [--recommends-deps | --no-recommends-deps]
                            [--suggests-deps | --no-suggests-deps]

## Named Arguments

`-o, --out`

  filename for output (default: ‘sbom’). Use ‘-’ to write to stdout

  Default: `'sbom'`

`--distro-name`

  distro name (default: ‘Debian’)

  Default: `'Debian'`

`--distro-supplier`

  supplier for the root component

`--distro-version`

  version for the root component

`--distro-summary`

  short description of distro component (single line)

`--base-distro-vendor`

  Possible choices: debian, ubuntu

  vendor of debian distribution (debian or ubuntu)

  Default: `'debian'`

`--cdx-standard`

  Possible choices: default, standard-bom

  generate SBOM according to this spec (only for CDX)

  Default: `'default'`

`--spdx-namespace`

  document namespace, must be a valid URI (only for SPDX)

`--cdx-serialnumber`

  document serial number, must be a UUID in 8-4-4-4-12 format (only for CDX)

`--timestamp`

  document timestamp in ISO 8601 format

`--add-meta-data`

  add arbitrary metadata properties to the SBOM

`--validate`

  validate generated SBOM (only for SPDX)

  Default: `False`

`-t, --sbom-type`

  Possible choices: cdx, spdx

  SBOM type to generate, can be passed multiple times (default: all)

`-r, --root`

  root directory to look for dpkg status file and apt cache

  Default: `'/'`

`--from-pkglist`

  create SBOM from a package list passed via stdin

  Default: `False`

`--distro-arch`

  native dpkg architecture of the distro (‘auto’)

  Default: `'auto'`

`--with-licenses`

  parse and include license information

  Default: `False`

`--recommends-deps, --no-recommends-deps`

  track recommended package dependencies (default: True)

  Default: `True`

`--suggests-deps, --no-suggests-deps`

  track suggested package dependencies (default: False)

  Default: `False`