DEBSBOM-SEC-SCAN(1)

💖 debsbom-sec-scan(1) 💖

okay bestie, listen up — this is the debsbom-sec-scan page from the debsbom manual, and it's literally the vibe check for your SBOM. let's get into it ✨

---

🌸 NAME 🌸

debsbom-sec-scan — the debsbom sec-scan command. that's it, that's the name, slay 💅

---

🦋 SYNOPSIS 🦋

debsbom sec-scan [-h] [-t {cdx,spdx}] [--author AUTHOR]
                 [--default-product {component,distribution}]
                 [--product PRODUCT] [--db DB] [--distro DISTRO] [--update-db]
                 [--filter FILTER] [-f {text,json,sarif,vex}]
                 [--min-urgency {high,medium,low,unimportant,end-of-life,not-yet-assigned}]
                 [--tracker TRACKER] [--with-paths-to-root]
                 [bomin]

it's giving very "one long line but make it fashion" 🎀

---

🌈 DESCRIPTION 🌈

Check sbom for security vulnerabilities. yes queen, that's the whole mission statement.

it scans packages from an SBOM for security vulnerabilities. like, it looks at everything you shipped and goes "hmm, any of this problematic?" and then tells you. no cap 🔥

💜 JSON Output Schema 💜

so when the application is run with JSON output enabled (via the --json flag), status messages get emitted as single-line JSON objects to standard output. each line is one distinct scan result (for example, a vulnerability affecting a package). one line, one result, no overlapping, periodt.

the schema for these JSON objects is as follows — and bestie, this is exact, do not freestyle it:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/siemens/debsbom/refs/heads/main/src/debsbom/schema/schema-sec-scan.json",
  "title": "Security Scan Result",
  "definitions": {
    "vulnerability": {
      "type": "object",
      "required": [
        "id",
        "status",
        "urgency",
        "tracker"
      ],
      "properties": {
        "id": {
          "type": "string",
          "description": "Vulnerability identifier (CVE or temporary ID)"
        },
        "status": {
          "type": "string",
          "enum": [
            "resolved",
            "undetermined",
            "open"
          ],
          "description": "Current vulnerability status"
        },
        "urgency": {
          "type": "string",
          "enum": [
            "high",
            "medium",
            "low",
            "unimportant",
            "end-of-life",
            "not-yet-assigned"
          ],
          "description": "Urgency level"
        },
        "fixed-in": {
          "type": [
            "string"
          ],
          "description": "Version in which the vulnerability is fixed"
        },
        "desc": {
          "type": [
            "string"
          ],
          "description": "Vulnerability description"
        },
        "tracker": {
          "type": [
            "string"
          ],
          "format": "uri",
          "description": "URL to the vulnerability tracker entry"
        },
        "debianbug": {
          "type": "integer",
          "description": "Debian bug id"
        },
        "bugreport": {
          "type": [
            "string"
          ],
          "format": "uri",
          "description": "URL to the debian bug tracker entry"
        },
        "nodsa": {
          "type": [
            "string"
          ],
          "description": "Reason why no DSA is issued"
        }
      },
      "additionalProperties": false
    },
    "pathsToRoot": {
      "type": "object",
      "properties": {
        "allShortest": {
          "type": "array",
          "items": {
            "$ref": "schema-trace-path.json"
          }
        }
      }
    }
  },
  "type": "object",
  "required": [
    "package",
    "purl",
    "vulnerability"
  ],
  "properties": {
    "package": {
      "type": "string",
      "description": "Package name and version"
    },
    "purl": {
      "type": "string",
      "description": "Package URL (PURL) identifier"
    },
    "vulnerability": {
      "$ref": "#/definitions/vulnerability"
    },
    "pathsToRoot": {
      "$ref": "#/definitions/pathsToRoot"
    }
  },
  "additionalProperties": false
}

---

✨ OPTIONS ✨

🎀 Positional Arguments 🎀

• bomin — the sbom file(s) to process for 'bomin'. and yes, you can pass '-' to read from stdin, iconic behavior honestly 🫶

💅 Named Arguments 💅

• -t, --sbom-type — which SBOM type to process (default is auto-detect). heads up: this one is required when you're reading from stdin, so don't forget it.

possible choices: cdx, spdx

• --author — the author of the document (-f vex only, so it does literally nothing otherwise)
• --default-product='component' — controls whether the component or the distribution gets used as the product in VEX statements (-f vex only, default is 'component')

possible choices: component, distribution

• --product — the product to use in VEX statements. this one overwrites the behavior of --default-product (-f vex only)
• --db=~/.cache/debsbom/security-tracker.json — path to the Debian security tracker JSON database (default: ~/.cache/debsbom/security-tracker.json)
• --distro='trixie' — the Debian distribution to check (default: 'trixie')
• --update-db=False — downloads the security tracker database (from --tracker) and stores it at the path specified by --db
• --filter — limits the search to a specific package name. tunnel vision, but make it intentional
• -f='text', --format='text' — the output format (default: 'text')

possible choices: text, json, sarif, vex

• --min-urgency='not-yet-assigned' — filters CVEs by urgency (default: 'not-yet-assigned')

possible choices: high, medium, low, unimportant, end-of-life, not-yet-assigned

• --tracker='https://security-tracker.debian.org/tracker' — URL of the upstream debian security tracker (default: 'https://security-tracker.debian.org/tracker')
• --with-paths-to-root=False — emits the path from component to root for each affected package (-f json only)

---

👑 SEE ALSO 👑

• debsbom-generate(1)

---

💖 DEBSBOM 💖

part of the debsbom(1) suite. family reunion energy 🧚

Author

Christoph Steiger, Felix Moessbauer

Copyright

2025, Siemens

---

and that's the whole page, bestie 🌟 this came from the debsbom source, and the version/date stamped on it is Jul 28, 2026 — so you know exactly when this particular lore dropped. go scan something, stay safe out there 💜🌸