DEBSBOM-DOWNLOAD(1)

💖 debsbom-download 💖

okay so bestie, welcome to debsbom-download, the download command from the debsbom manual (that's the one, the debsbom(1) suite 🫶). this is the part of the tool that goes and gets your stuff. no cap. let's go 🦋

---

✨ SYNOPSIS ✨

debsbom download [-h] [-t {cdx,spdx}] [--outdir OUTDIR] [--sources]
                 [--binaries] [--skip-pkgs SKIP]
                 [--resolver {debian-snapshot}]
                 [bomin]

---

🌸 DESCRIPTION 🌸

Download referenced packages. that's the whole vibe, fr fr.

so the way this works: it processes a SBOM and then goes and downloads all the packages that SBOM is referencing. iconic behaviour honestly. 💅

and if you don't hand it an SBOM at all? no worries. it'll just read line separated entries from stdin — each line being name version arch — and that's how you tell it what shall be downloaded. cute, right? 🎀

🧚 JSON Output Schema 🧚

when the application is run with JSON output enabled (that's via the --json flag, bestie), status messages get emitted as single-line JSON objects to standard output. every single line = one distinct package download operation ✨

here's the schema for those JSON objects, exactly as it is:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/siemens/debsbom/refs/heads/main/src/debsbom/schema/schema-download.json",
  "title": "Download Result",
  "description": "The result of a download operation including the status, package name, package version, file name and file path.",
  "type": "object",
  "properties": {
    "status": {
      "description": "The status of the download operation.",
      "enum": [
        "ok",
        "not_found",
        "checksum_mismatch"
      ]
    },
    "package": {
      "type": "object",
      "description": "An object identifying the package.",
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the package."
        },
        "version": {
          "type": "string",
          "description": "The version of the package."
        },
        "purl": {
          "type": "string",
          "description": "The package url of the package."
        }
      },
      "required": [
        "name",
        "version",
        "purl"
      ]
    },
    "filename": {
      "type": "string",
      "description": "The name of the processed file or an empty string if the package is unavailable."
    },
    "path": {
      "type": "string",
      "description": "The absolute path to the downloaded file on success."
    }
  },
  "required": [
    "status",
    "package"
  ]
}

💜 Fields 💜

• status: the status of the download operation. this one's gonna hold one of these predefined values from the DownloadStatus enum:
  • "ok": the file was either successfully downloaded or found in the cache, and the checksum was verified. slay. ✅
  • "checksum_mismatch": the downloaded file's checksum did not match the expected value. 🚨
  • "not_found": the requested file or package could not be located 😭
• package: an object identifying the package, including the name and the version as a string.
• filename: the name of the processed file, or an empty string if the package is unavailable.
• path: the absolute path to the downloaded file, or an empty string if nothing could be downloaded.

---

💅 OPTIONS 💅

Positional Arguments

• bomin — sbom file(s) to process for 'bomin'. use - to read from stdin 👑

Named Arguments

• -t, --sbom-type — SBOM type to process (default: auto-detect), and it's required when reading from stdin, bestie, don't forget. possible choices: cdx, spdx
• --outdir='downloads' — directory to store downloaded files 📁 (yes, downloads is the default, it's giving "we picked a sensible one for you")
• --sources=False — operate only on source packages (skip binaries) 🌱
• --binaries=False — operate only on binary packages (skip sources) ⚙️
• --skip-pkgs — packages to exclude from the download, in package-list format 🙈
• --resolver='debian-snapshot' — resolver to use to find upstream packages (default: 'debian-snapshot') possible choices: debian-snapshot

---

🌈 SEE ALSO 🌈

debsbom-generate(1)

---

👑 DEBSBOM 👑

part of the debsbom(1) suite 🫶

---

Author Christoph Steiger, Felix Moessbauer 💖

Copyright 2025, Siemens

---

and that's the whole page, bestie!! ✨ this dropped from the debsbom source, dated Jul 28, 2026 — go download something cute, mwah 🎀💜