DEBSBOM-REPACK(1)

💖 DEBSBOM-REPACK(1) 💖

okay bestie, sit down, hydrate, and let me tell you about debsbom-repack — it's the repack command from the debsbom suite, and it's literally out here giving main character energy ✨

---

✨ NAME ✨

debsbom-repack — the debsbom repack command 🎀

---

🌸 SYNOPSIS 🌸

debsbom repack [-h] [-t {cdx,spdx}] [--compress {no,bzip2,gzip,xz,zstd,lz4}]
               [--apply-patches] [--mtime MTIME] [--dldir DLDIR]
               [--outdir OUTDIR]
               [--format {standard-bom,standard-bom-package}] [--copy]
               [--validate] [--sources] [--binaries]
               bomin bomout

---

🦋 DESCRIPTION 🦋

Repack sources and sbom 💅

So what it does is: it takes the files you already downloaded and repacks them into one uniform source archive, merging all the referenced source packages into a single archive and optionally applying patches. obsessed. The layout of that source archive is controlled by the format argument. And here's the cute part — if an input SBOM is provided and data is being passed via stdin, then only the packages passed via stdin get resolved and updated in the final SBOM. selective, iconic, we love to see it ✨

Note: ngl bestie, the files have to be downloaded first, and they need to already be sitting in the directory specified by dldir. no downloads = no repack, that's the vibe check 😭

---

👑 OPTIONS 👑

🍓 Positional Arguments

• bomin — the sbom file(s) to process for 'bomin'. Use - to read from stdin 🫶
• bomout — sbom output file. Use - to write to stdout 💫

🌈 Named Arguments

• -t, --sbom-type — SBOM type to process (default: auto-detect), and it's required when reading from stdin. Possible choices: cdx, spdx
• --compress='gzip' — compress merged tarballs (default: gzip). Possible choices: no, bzip2, gzip, xz, zstd, lz4
• --apply-patches=False — apply debian patches 🩹
• --mtime — set mtime for creating tar archives in ISO 8601 format. If this option is not set, the timestamp from the most recent changelog entry is used for reproducible builds. so like, reproducible by default, fr fr 🕰️
• --dldir='downloads' — download directory from 'download'
• --outdir='packed' — directory to repack into (default: 'packed')
• --format='standard-bom-package' — Possible choices: standard-bom, standard-bom-package
• --copy=False — copy artifacts into deploy tree instead of symlinking 🔀
• --validate=False — validate generated SBOM (only for SPDX) 👀
• --sources=False — operate only on source packages (skip binaries)
• --binaries=False — operate only on binary packages (skip sources)

---

💜 SEE ALSO 💜

debsbom-generate(1), debsbom-download(1)

---

🧚 DEBSBOM 🧚

Part of the debsbom(1) suite. 💖

✍️ Author

Christoph Steiger, Felix Moessbauer

©️ Copyright

2025, Siemens

---

mwah 💋 that's the whole page bestie. this one lives in debsbom, dated Jul 28, 2026 — go forth and repack, you absolute legend 👑✨