DEBSBOM-MERGE(1)

💖 DEBSBOM-MERGE(1) — the debsbom merge command, bestie edition 💖

okay so. this is a page from the debsbom manual, section 1, and it's all about debsbom-merge. if you've ever had like, seventeen SBOMs and you're like "bestie i cannot with this", this is your girl. let's get into it 💅

---

✨ NAME ✨

debsbom-merge — the debsbom merge command. that's the whole vibe. it merges.

---

🦋 SYNOPSIS 🦋

debsbom merge [-h] [-o OUT] [--distro-name DISTRO_NAME]
              [--distro-supplier DISTRO_SUPPLIER]
              [--distro-version DISTRO_VERSION]
              [--distro-summary DISTRO_SUMMARY]
              [--base-distro-vendor {debian,ubuntu}]
              [--cdx-standard {default,standard-bom}]
              [--spdx-namespace SPDX_NAMESPACE]
              [--cdx-serialnumber CDX_SERIALNUMBER] [--timestamp TIMESTAMP]
              [--add-meta-data key=value] [--validate] [-t {cdx,spdx}]
              [--omit-roots]
              sboms [sboms ...]

---

🌸 DESCRIPTION 🌸

Merge multiple sboms.

Like, merge multiple SBOMs into a single one. ✨

the merge command merges multiple SBOMs hierarchically, which is a fancy way of saying it stacks them like nesting dolls instead of just yeeting them all into one flat pile. the most common use-case? combining multiple parts of a Debian-based Linux distribution, like a rootfs and a initrd. (yes, rootfs and initrd are the blueprint, the moment, the duo 🫶)

so the merged SBOM contains the root components/packages of the input SBOMs at the first dependency level. take these two SBOMs:

doc1-root
|- binary-dep1
|  |- source-dep1
|- binary-dep2

doc2-root
|- binary-dep3
|  |- source-dep3
|- binary-dep4

and they would turn into this:

merged-doc-root
|- doc1-root
|  |- binary-dep1
|  |  |- source-dep1
|  |- binary-dep2
|- doc2-root
|  |- binary-dep3
|  |  |- source-dep3
|- binary-dep4

look at that glow-up. iconic. 👑

any duplicated components are identified solely by their PURL. that's it, that's the whole matching system, no cap. if the PURL is missing from a component/package, it can not be matched and is treated as a completely unique thing — it gets its own moment, sorry. 😭

if a component/package can be identified as identical, their contents are merged and their SBOM reference IDs in the merged document are combined too. and here's the tea: the ID will be replaced with the one appearing first in the passed list of SBOMs. first come, first served, periodt. any duplicate entries and dependencies are also removed. 🧹✨

---

💅 OPTIONS 💅

🍓 Positional Arguments

• sboms — sbom file(s) to process for 'sboms'. use - to read from stdin 👀

💜 Named Arguments

• -o='merged', --out='merged' — filename for output (default: 'merged'). use - to write to stdout 🫶
• --distro-name='Debian' — distro name (default: 'Debian')
• --distro-supplier — supplier for the root component
• --distro-version — version for the root component
• --distro-summary — short description of distro component (single line)
• --base-distro-vendor='debian' — vendor of debian distribution (debian or ubuntu)

Possible choices: debian, ubuntu

• --cdx-standard='default' — generate SBOM according to this spec (only for CDX)

Possible choices: default, standard-bom

• --spdx-namespace — document namespace, must be a valid URI (only for SPDX)
• --cdx-serialnumber — document serial number, must be a UUID in 8-4-4-4-12 format (only for CDX)
• --timestamp — document timestamp in ISO 8601 format ⏰
• --add-meta-data — add arbitrary metadata properties to the SBOM
• --validate=False — validate generated SBOM (only for SPDX)
• -t, --sbom-type — SBOM type to process (default: auto-detect), required when reading from stdin ⚠️

Possible choices: cdx, spdx

• --omit-roots=False — omit root nodes when merging SBOMs, this will place all packages directly under a shared new root 🌈

---

👀 SEE ALSO 👀

• debsbom-generate(1)

---

📦 DEBSBOM 📦

Part of the debsbom(1) suite. the whole little family 🫶

---

✍️ Author

Christoph Steiger, Felix Moessbauer

©️ Copyright

2025, Siemens

---

ok that's the whole page bestie, go merge something and slay 💖✨

so yeah, this was debsbom — that's the source/version, and the date on this one is Jul 28, 2026. literally stamped and dated. mwah. 💅🎀🦋