BOMTOOL(1)

💖 BOMTOOL 💖

okay bestie, so this is the manual page for bomtool — it lives in the General Commands Manual section of the manual, and it's about to become your new fave. sit down, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

bomtool — a tool for generating SPDX-based software bills of material

---

🦋 SYNOPSIS 🦋

bomtool [options] module ...

---

🌸 DESCRIPTION 🌸

so like, bomtool is a program which generates a textual SPDX 2.0 software bill of materials (SBOM) for a given set of pkg-config modules. the output of this tool can then be translated into other SBOM formats as necessary. it's giving ✨supply chain transparency✨, no cap.

The options are as follows:

• --about — Print the version number, the Copyright notice, and the license of the bomtool program to standard output and exit. Most other options and all command line arguments are ignored. she said "not today, I'm doing my own thing 💅"
• --version — Print the version number of the bomtool program to standard output and exit. Most other options and all command line arguments are ignored. same energy, smaller fit.
• --define-variable=varname=value — Define varname as value. Variables are used in query output, and some modules' results may change based on the presence of a variable definition. lowkey powerful.
• --creation-time time — Use time as the value of the Created field in the generated SBOM instead of the current time. SPDX recommends using an ISO 8601-formatted time, which is: YYYY-MM-DDThh:mm:ssZ. This takes precedence over the SOURCE_DATE_EPOCH environment variable. main character time stamp, honestly.
• --output file — Write the generated SBOM to file instead of standard output. redirecting but make it ~intentional~ 🎀

---

🌈 ENVIRONMENT 🌈

• PKG_CONFIG_DEBUG_SPEW — If set, print debugging messages to stderr. she's loud and she's proud 🗣️
• PKG_CONFIG_IGNORE_CONFLICTS — If set, ignore Conflicts rules in modules. Has the same effect as the --ignore-conflicts option in pkgconf(1).
• PKG_CONFIG_LIBDIR — A colon-separated list of low-priority directories where pc(5) files are looked up. The module search path is constructed by appending this list to PKG_CONFIG_PATH, which enjoys higher priority. If PKG_CONFIG_LIBDIR is not defined, the default list compiled into the bomtool program from the PKG_DEFAULT_PATH preprocessor macro is appended instead. If PKG_CONFIG_LIBDIR is defined but empty, nothing is appended. (yes, empty and unset are two different girls 🙈)
• PKG_CONFIG_MAXIMUM_TRAVERSE_DEPTH — Impose a limit on the allowed depth in the dependency graph. bestie said "know your limits".
• PKG_CONFIG_PATH — A colon-separated list of high-priority directories where pc(5) files are looked up.
• PKG_CONFIG_PRELOADED_FILES — Colon-separated list of pc(5) files which are loaded before any other pkg-config files. These packages are given highest priority over any other pc(5) files that would otherwise provide a given package. front of the line privileges, periodt.
• SOURCE_DATE_EPOCH — If set, and the --creation-time option is not given, the Created field in the generated SBOM is derived from this UNIX timestamp instead of the current time, allowing for reproducible SBOM generation. iconic reproducible-queen behaviour 🔥

---

👑 EXIT STATUS 👑

The bomtool utility exits 0 on success, and >0 if an error occurs.

---

🧚 EXAMPLES 🧚

Generating an SBOM for the package named foo:

$ bomtool foo
SPDXVersion: SPDX-2.2
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: SBOM-SPDX-fooC641.2.3
DocumentNamespace: https://spdx.org/spdxdocs/bomtool
Creator: Tool: bomtool
[...]

look at her go. ate and left no crumbs 💅✨

---

💜 SEE ALSO 💜

pc(5), pkgconf(1)

---

fr fr, that's the whole page. go generate some SBOMs, bestie, you got this 🫶

this cutie dropped from Debian, dated June 24, 2026 — mwah, love that for her 💖🎀