DEBSBOM-TRACE-PATH(1)

💖 DEBSBOM-TRACE-PATH 💖

okay so real talk, bestie, this is the manual page for debsbom-trace-path, which lives in the debsbom section. it's a whole command and honestly it ate. let's get into it 💅

---

✨ NAME ✨

debsbom-trace-path — it's literally the debsbom trace-path command, no cap. that's the whole name. iconic of her tbh 🎀

---

🌸 SYNOPSIS 🌸

debsbom trace-path [-h] [-t {cdx,spdx}] [--format {text,json,ref,dot}]
                   [--mode {shortest,all-shortest,all}]
                   [bomin] source

look at that shape. chefs kiss. 🫶

---

🦋 DESCRIPTION 🦋

Trace path between components — that's the mission, periodt.

So here's the vibe: she processes an SBOM and a package identifier, and then she emits paths from this package to the root. like she's showing you the whole ancestry chain, main character energy 🌈

⚠️ okay IMPORTANT, listen up: the textual outputs — that's text and ref — are not considered stable and you should not parse them. do not do it. i'm begging. they will change on you and break your little script and you'll be crying 😭

The JSON output though? that one's in json-lines format, where each line adheres to the schema-download.json schema. so one line, one thing. cute, clean, parseable. slay ✨

🫶 JSON Output Schema 🫶

When the application is run with JSON output enabled (via the --json flag), status messages get emitted as single-line JSON objects to standard output. Each line represents a single path from the package to the root. yes bestie, one line = one path 💫

The schema for these JSON objects is as follows:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/siemens/debsbom/refs/heads/main/src/debsbom/schema/schema-trace-path.json",
  "title": "Trace Path Result",
  "description": "List of components on a path between a source and a destination component",
  "type": "array",
  "items": {
    "type": "object",
    "required": [
      "name",
      "ref"
    ],
    "properties": {
      "name": {
        "type": "string",
        "description": "Name of the component"
      },
      "ref": {
        "type": "string",
        "description": "Reference identifier for the component"
      },
      "version": {
        "type": [
          "string",
          "null"
        ],
        "description": "Version of the component"
      },
      "maintainer": {
        "type": [
          "string",
          "null"
        ],
        "description": "Maintainer of the component"
      },
      "purl": {
        "type": [
          "string",
          "null"
        ],
        "description": "Package URL of the component"
      }
    }
  }
}

as you can see, name and ref are required (she's not optional about those, bestie), and version, maintainer and purl are string or null — they can show up or they can ghost, both are valid 🌸

---

👑 OPTIONS 👑

💜 Positional Arguments

• bomin — sbom file(s) to process for bomin. and yes, use - to read from stdin. the little dash. she's feeding herself from the pipe 🫶
• source — the source node (PURL). this is where the tracing starts, the origin story fr 💫

💜 Named Arguments

• -t, --sbom-type — SBOM type to process. default is auto-detect, and heads up: it's required when reading from stdin (because she can't auto-detect a vibe from a pipe, rude but fair). Possible choices: cdx, spdx
• --format='text' — path output format. default is 'text'. Possible choices: text, json, ref, dot
• --mode='shortest' — this one's a lil mysterious, no description given, just the options. so i present them to you with no elaboration whatsoever, respectfully 🙈 Possible choices: shortest, all-shortest, all

💀 and remember: if you picked text or ref up there, those outputs are not stable and you should not parse them. the manpage said it, i said it, we're all saying it. do not. 🔥

---

🌈 SEE ALSO 🌈

• debsbom-generate(1)

go read that one too, she's also serving 💅

---

🎀 DEBSBOM 🎀

Part of the debsbom(1) suite. she's not alone, she's got a whole fam 🫶

🧚 Author

Christoph Steiger, Felix Moessbauer

🧚 Copyright

2025, Siemens

---

okay bestie that's the whole page, you're fully caught up 💖 so much love to the debsbom girlies for this one. this page is part of debsbom, and if you're reading a copy it's the version dated Jul 28, 2026 — go forth and trace those paths, you absolute icon 👑✨🍓