### Clone and Install cdxgen Development Environment

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/GETTING_STARTED.md

Steps to clone the `CycloneDX/cdxgen` repository, enable pnpm using corepack, install project dependencies with strict build configuration, and run initial tests to set up the local development environment.

```bash
git clone https://github.com/CycloneDX/cdxgen
cd cdxgen

corepack enable pnpm
pnpm install --config.strict-dep-builds=true
pnpm test
```

--------------------------------

### Example Output of Lima VM Start Process

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This snippet shows the typical console output when starting a Lima virtual machine. It details the steps involved, including image downloads, cache usage, host agent initialization, QEMU startup, and SSH port assignment.

```shell
❯ limactl start --name=cdxgen contrib/lima/cdxgen-opensuse.yaml --tty=false
INFO[0000] Terminal is not available, proceeding without opening an editor
INFO[0000] Starting the instance "cdxgen" with VM driver "qemu"
INFO[0000] QEMU binary "/usr/local/bin/qemu-system-x86_64" seems properly signed with the "com.apple.security.hypervisor" entitlement
INFO[0000] Attempting to download the image              arch=x86_64 digest= location="https://download.opensuse.org/distribution/leap/15.6/appliances/openSUSE-Leap-15.6-Minimal-VM.x86_64-Cloud.qcow2"
INFO[0000] Using cache "/Users/user/Library/Caches/lima/download/by-url-sha256/df847b33b9afd652992e2d5ad084eaf97a93ee54f6957c288a643f3c11fdde1c/data"
INFO[0000] Attempting to download the nerdctl archive    arch=x86_64 digest="sha256:2c841e097fcfb5a1760bd354b3778cb695b44cd01f9f271c17507dc4a0b25606" location="https://github.com/containerd/nerdctl/releases/download/v1.7.6/nerdctl-full-1.7.6-linux-amd64.tar.gz"
INFO[0000] Using cache "/Users/user/Library/Caches/lima/download/by-url-sha256/b86908f1f5ea2af45aec405f0fd389eba1999b51e3972ca78215ace94d2da2a6/data"
INFO[0001] [hostagent] hostagent socket created at /Users/user/.lima/cdxgen/ha.sock
INFO[0001] [hostagent] Using system firmware ("/usr/local/share/qemu/edk2-x86_64-code.fd")
INFO[0001] [hostagent] Starting QEMU (hint: to watch the boot progress, see "/Users/user/.lima/cdxgen/serial*.log")
INFO[0002] SSH Local Port: 61020
INFO[0001] [hostagent] Waiting for the essential requirement 1 of 4: "ssh"
```

--------------------------------

### Initialize devenv Shell and Run Tests

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/GETTING_STARTED.md

Instructions to initialize the devenv shell, which sets up the development environment, and then execute project tests. This assumes devenv has been previously installed.

```shell
devenv shell
pnpm test
```

--------------------------------

### Install cdxgen via npm

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

This command installs the cdxgen tool globally using npm, making it available from the command line for all users.

```shell
sudo npm install -g @cyclonedx/cdxgen
```

--------------------------------

### Monitor OpenSUSE VM Installation Log

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command allows monitoring the installation progress within the 'cdxgen' OpenSUSE VM by tailing its cloud-init output log file. Useful for troubleshooting setup issues.

```shell
limactl shell cdxgen sudo tail -f /var/log/cloud-init-output.log
```

--------------------------------

### Start Ubuntu Lima VM for cdxgen

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command starts a Lima virtual machine named 'cdxgen' configured with Ubuntu. This is an alternative to the OpenSUSE VM setup.

```shell
limactl start --name=cdxgen contrib/lima/cdxgen-ubuntu.yaml --tty=false
```

--------------------------------

### Run Common devenv Development Tasks

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/GETTING_STARTED.md

Examples of using `devenv tasks run` to execute predefined development tasks, such as preparing a pull request, checking for outdated dependencies, setting up a Deno-based environment, running Deno-specific checks, and compiling a SEA binary for macOS.

```shell
# Prepare to contribute a PR
devenv tasks run pr:prepare

# Check for outdated dependencies
devenv tasks run pnpm:outdated

# Prepare a deno-based environment
devenv tasks run deno:prepare

# Check if cdxgen and evinse command can work
devenv tasks run deno:checks

# Create SEA binary
devenv tasks run deno:compile:macos
```

--------------------------------

### Example: Submit SBOM to Dependency Track

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

This command demonstrates how to generate a Java SBOM and submit it to a specified Dependency Track server using the provided URL, API key, and project group.

```shell
cdxgen -t java -o bom.json --server-url https://deptrack.server.com --api-key "token" --project-group ...
```

--------------------------------

### cdxgen REPL Sample SBOM Operations

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Demonstrates common cdxgen REPL commands for creating, printing, searching, querying, sorting, and updating SBOMs, including examples for filtering components by name, scope, supplier, and properties.

```shell
.create /mnt/work/vuln-spring
.print
.search spring
.query components[name ~> /spring/ and scope = "required"]
// Supplier names
.query $distinct(components.supplier.name)

# Check obom metadata for windows os
.query metadata.component[purl ~> /Windows/]

# check if docker is installed in the c drive
.query components[name ~> /Docker/ and properties.value ~> "C:\\"]

# check if docker is running, exposing a pipe
.query components[name ~> /docker/ and properties[value = "pipes_snapshot"]]

.sort name
.sort components^(>name)
.update \| components[name ~> /spring/] \| {'publisher': "foo"} \|
```

--------------------------------

### Setup Podman for Rootless or Remote Mode

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

These commands enable and start the Podman socket for API access, which is necessary for cdxgen to interact with Podman in rootless or remote configurations on Linux.

```bash
systemctl --user enable --now podman.socket
systemctl --user start podman.socket
podman system service -t 0 &
```

--------------------------------

### Install cdxgen via Homebrew

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

For macOS and Linux users, cdxgen can be conveniently installed using Homebrew, a popular package manager.

```bash
brew install cdxgen
```

--------------------------------

### Monitor Ubuntu VM Installation Log

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command allows monitoring the installation progress within the 'cdxgen-ubuntu' VM by tailing its cloud-init output log file. Useful for troubleshooting setup issues specific to the Ubuntu VM.

```shell
limactl shell cdxgen-ubuntu sudo tail -f /var/log/cloud-init-output.log
```

--------------------------------

### Install Essential System and Development Packages

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/cloud-init.txt

Specifies a comprehensive list of packages to be installed on the system via APT, including Docker components, development tools (GCC, Python, Java), system utilities (jq, ufw, fail2ban), and essential libraries. This cloud-config section prepares the system for various development and operational tasks.

```YAML
  - binfmt-support
  - docker-ce
  -
```

--------------------------------

### Install Lima on Linux

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

These commands download and extract the Lima binary for Linux. Ensure `qemu`, `qemu-img`, and `qemu-x86` packages are installed beforehand.

```shell
curl -LO https://github.com/lima-vm/lima/releases/download/v0.22.0/lima-0.22.0-Linux-x86_64.tar.gz
sudo tar -C /usr/local -xf lima-0.22.0-Linux-x86_64.tar.gz
```

--------------------------------

### Start cdxgen REPL Server

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Initiates the cdxgen REPL server, providing an interactive environment for managing Software Bill of Materials (SBOMs).

```shell
cdxi
```

--------------------------------

### Clone cdxgen and Start OpenSUSE Lima VM

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This sequence of commands clones the cdxgen repository, navigates into it, and then starts a Lima virtual machine named 'cdxgen' using the OpenSUSE configuration. This process might take several minutes to complete.

```shell
git clone https://github.com/CycloneDX/cdxgen.git
cd cdxgen

# The below command might take several minutes

limactl start --name=cdxgen contrib/lima/cdxgen-opensuse.yaml --tty=false
```

--------------------------------

### Integrate cdxgen Library in Node.js

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

This Node.js example demonstrates how to import `createBom` and `submitBom` from `@cyclonedx/cdxgen`. It shows creating a BOM from a file path and submitting it to a Dependency-Track server.

```javascript
import { createBom, submitBom } from "@cyclonedx/cdxgen";
// bomNSData would contain bomJson
const bomNSData = await createBom(filePath, options);
// Submission to dependency track server
const dbody = await submitBom(args, bomNSData.bomJson);
```

--------------------------------

### Activate Language-Specific devenv Profiles

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/GETTING_STARTED.md

Commands to activate various language-specific development environments (Deno, Ruby, .NET, Android, Flutter) using devenv profiles, allowing developers to switch contexts easily.

```shell
# deno environment
devenv --option config.profile:string deno shell

# Ruby environment
devenv --option config.profile:string ruby shell

# dotnet environment
devenv --option config.profile:string dotnet shell

# android environment
devenv --option config.profile:string android shell

# flutter environment
devenv --option config.profile:string flutter shell
```

--------------------------------

### Start Ubuntu Lima VM with Custom Settings on Mac

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command starts an Ubuntu Lima VM with specific resource allocations and features optimized for recent Mac systems. It configures CPU, disk, memory, VM type, Rosetta emulation, and mount type.

```shell
limactl start --name=cdxgen-ubuntu contrib/lima/cdxgen-ubuntu.yaml --tty=false --cpus 10 --disk 320 --memory 32 --vm-type vz --rosetta --mount-type virtiofs
```

--------------------------------

### Run cdxgen SBOM Server using Docker

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Alternatively, run the cdxgen SBOM server using its Docker container image. This command maps port 9090, mounts the current directory, and sets the server host to 0.0.0.0.

```bash
docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app --server --server-host 0.0.0.0
```

--------------------------------

### Start AArch64 Lima VM for cdxgen

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command starts an AArch64 (ARM64) version of the cdxgen Lima VM. This process may take longer and might require a specific BIOS file to be present in the user's QEMU directory.

```shell
limactl start --name=cdxgen-aarch64 --arch=aarch64 contrib/lima/cdxgen-opensuse.yaml --tty=false
```

--------------------------------

### Installing and Testing cdxgen Main Branch Globally

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/README.md

Shows how to install the cdxgen main branch globally using `pnpm` and verify the installation by checking the help output.

```shell
corepack pnpm bin -g
corepack pnpm setup
corepack pnpm add -g --allow-build @appthreat/sqlite3 https://github.com/CycloneDX/cdxgen
cdxgen --help
```

--------------------------------

### Automated Environment Provisioning Script for cdxgenofficial

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/cloud-init.txt

This script performs a series of system configurations and software installations. It includes adding a user to the Docker group, optimizing system swap, disabling non-essential systemd services, configuring the UFW firewall, hardening SSH daemon settings, installing the Swift toolchain with GPG verification, setting up Node.js from NodeSource, and deploying the Nydus image service static binaries. This script is designed for a Linux (Ubuntu) environment.

```bash
adduser ubuntu docker
sysctl vm.swappiness=0
echo "vm.swappiness = 0" | tee -a /etc/sysctl.conf
systemctl disable man-db.timer man-db.service --now
systemctl disable apport.service apport-autoreport.service  --now
systemctl disable apt-daily.service apt-daily.timer --now
systemctl disable apt-daily-upgrade.service apt-daily-upgrade.timer --now
systemctl disable unattended-upgrades.service --now
systemctl disable motd-news.service motd-news.timer --now
systemctl disable bluetooth.target --now
systemctl disable ua-messaging.service ua-messaging.timer --now
systemctl enable fail2ban
ufw allow OpenSSH
ufw enable
sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)KbdInteractiveAuthentication/s/^.*$/KbdInteractiveAuthentication no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)ChallengeResponseAuthentication/s/^.*$/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 3/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
sed -i '$a AllowUsers ubuntu' /etc/ssh/sshd_config
export SWIFT_SIGNING_KEY=52BB7E3DE28A71BE22EC05FFEF80A866B47A981F
export SWIFT_PLATFORM=ubuntu24.04
export SWIFT_BRANCH=swift-6.1-release
export SWIFT_VERSION=swift-6.1-RELEASE
export SWIFT_WEBROOT=https://download.swift.org
export OS_ARCH_SUFFIX='-aarch64'
export SWIFT_WEBDIR="$SWIFT_WEBROOT/$SWIFT_BRANCH/$(echo $SWIFT_PLATFORM | tr -d .)$OS_ARCH_SUFFIX"
SWIFT_BIN_URL="$SWIFT_WEBDIR/$SWIFT_VERSION/$SWIFT_VERSION-$SWIFT_PLATFORM$OS_ARCH_SUFFIX.tar.gz"
SWIFT_SIG_URL="$SWIFT_BIN_URL.sig"
GNUPGHOME="$(mktemp -d)"
curl -fsSL "$SWIFT_BIN_URL" -o swift.tar.gz "$SWIFT_SIG_URL" -o swift.tar.gz.sig
gpg --batch --quiet --keyserver keyserver.ubuntu.com --recv-keys "$SWIFT_SIGNING_KEY"
gpg --batch --verify swift.tar.gz.sig swift.tar.gz
tar -xzf swift.tar.gz --directory / --strip-components=1
chmod -R o+r /usr/lib/swift
apt-get autoremove -y
curl -fsSL https://deb.nodesource.com/setup_23.x -o nodesource_setup.sh
bash nodesource_setup.sh
apt install -y nodejs
rm nodesource_setup.sh
export ARCH_NAME="$(dpkg --print-architecture)"
curl -LO https://github.com/dragonflyoss/nydus/releases/download/v2.3.1/nydus-static-v2.3.1-linux-${ARCH_NAME}.tgz
tar -xvf nydus-static-v2.3.1-linux-${ARCH_NAME}.tgz
chmod +x nydus-static/*
mv nydus-static/* /usr/local/bin/
rm -rf nydus-static-v2.3.1-linux-${ARCH_NAME}.tgz nydus-static
```

--------------------------------

### Configure Docker APT Repository Source

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/cloud-init.txt

Defines the APT source for Docker CE within a cloud-config script, enabling the system to fetch Docker packages from the official repository. This ensures that the latest stable Docker versions are available for installation.

```Shell
deb https://download.docker.com/linux/ubuntu $RELEASE stable
```

--------------------------------

### Enable License Resolution for cdxgen

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

To automatically query public registries for package licenses, set the `FETCH_LICENSE` environment variable to `true`. This operation is time-consuming and disabled by default.

```bash
export FETCH_LICENSE=true
```

--------------------------------

### Print SBOM as Table

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Use the `-p` argument to print the generated SBOM directly to the console in a human-readable table format, in addition to saving it as `bom.json`.

```shell
cdxgen -t java -o bom.json -p
```

--------------------------------

### Generate Minimal SBOM for Git Repository

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Navigate to your source code directory and use this command to generate a basic SBOM in JSON format. The output file will be named `bom.json`.

```shell
cd <Path to source code>
cdxgen -o bom.json
```

--------------------------------

### cdxgen REPL Custom Commands Reference

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

A comprehensive list of custom commands available within the cdxgen REPL, detailing their purpose and usage, including commands for SBOM creation, import, search, query, sort, print, tree, validation, exit, save, update, occurrences, callstack, and services.

```APIDOC
.create: Create an SBOM from a path
.import: Import an existing SBOM from a path. Any SBOM in CycloneDX format is supported.
.search: Search the given string in the components name, group, purl and description
.sort: Sort the components based on the given attribute. Eg: .sort name to sort by name. Accepts full jsonata [order by](http://docs.jsonata.org/path-operators#order-by-) clause too. Eg: `.sort components^(>name)`
.query: Pass a raw query in [jsonata](http://docs.jsonata.org/) format
.print: Print the SBOM as a table
.tree: Print the dependency tree if available
.validate: Validate the SBOM
.exit: To exit the shell
.save: To save the modified SBOM to a new file
.update: Update components based on query expression. Use syntax `\| query \| new object \|`. See example.
.occurrences: View components with evidence.occurrences as a table. Use evinse command to generate such an SBOM
.callstack: View components with evidence.callstack.frames as a table. Use evinse command to generate such an SBOM
.services: View services as a table

In addition, all the keys from [queries.json](./data/queries.json) are also valid commands. Example: `processes`, `apt_sources`, etc. Type `.help` to view the full list of commands.
```

--------------------------------

### Full Workflow Example for Snapshot Testing

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/test/diff/README.md

A comprehensive bash script demonstrating the end-to-end process of setting up and running cdxgen snapshot tests, from downloading and unzipping BOMs to activating a virtual environment and executing the diff script.

```bash
curl https://github.com/AppThreat/cdxgen-samples/archive/refs/heads/main.zip -o original_snapshots.zip
unzip original_snapshots.zip
unzip cdxgen_boms.zip -d new_snapshots # downloaded workflow artifact from github
python3 -m venv .venv
source .venv/bin/activate
pip3 install custom-json-diff
python3 test/diff/diff_tests.py -d original_snapshots new_snapshots
```

--------------------------------

### Install Lima on macOS using Homebrew

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command installs the Lima virtualization tool on macOS using the Homebrew package manager. Lima is used to launch Linux virtual machines.

```shell
brew install lima
```

--------------------------------

### Import cdxgen as Library in Deno/TypeScript

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

cdxgen is an ESM-only module and can be imported and used in Deno environments. This example shows a minimal import statement for `createBom` and `submitBom` functions.

```typescript
import { createBom, submitBom } from "npm:@cyclonedx/cdxgen@^9.9.0";
```

--------------------------------

### Clone and Compile Dependency-Track Project

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/LESSON1.md

Details the shell commands to clone the Dependency-Track GitHub repository and compile it using Maven, including specific profiles for a clean build and embedded Jetty.

```shell
git clone https://github.com/DependencyTrack/dependency-track
cd dependency-track
mvn clean compile -P clean-exclude-wars -P enhance -P embedded-jetty -DskipTests
```

--------------------------------

### Generate SBOM for C or Python Projects

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

To generate SBOMs for C or Python projects, ensure Java Development Kit (JDK) version 21 or higher is installed on your system as a prerequisite.

```shell
# Install java >= 21
cdxgen -t c -o bom.json
```

--------------------------------

### Custom SBOM Signature Verification in Node.js

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

This Node.js example demonstrates how to programmatically verify an SBOM signature using the `jws` library. It reads the BOM JSON and public key, then uses `jws.verify` to validate the signature.

```javascript
# npm install jws
const jws = require("jws");
const fs = require("fs");
// Location of the SBOM json file
const bomJsonFile = "bom.json";
// Location of the public key
const publicKeyFile = "public.key";
const bomJson = JSON.parse(fs.readFileSync(bomJsonFile, "utf8"));
// Retrieve the signature
const bomSignature = bomJson.signature.value;
const validationResult = jws.verify(bomSignature, bomJson.signature.algorithm, fs.readFileSync(publicKeyFile, "utf8"));
if (validationResult) {
  console.log("Signature is valid!");
} else {
  console.log("SBOM signature is invalid :(");
}
```

--------------------------------

### Generate Detailed .NET SBOM Example with cdxgen Container Images

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/xBOMEval/cdx1-NOTES.md

Shows how to prompt the `cdx1-mlx-8bit` model to provide a detailed example for generating .NET SBOMs using `cdxgen` container images. This includes `docker pull` and `docker run` commands, demonstrating how to explicitly request more information.

```bash
mlx_lm.generate --model ./CycloneDX/cdx1-mlx-8bit --prompt "Does cdxgen offer container images for building sbom for dotnet? Can you provide a detailed example?" --temp 0.05 --system-prompt "You are a helpful assistant to the user." --max-tokens 128000
```

```bash
docker pull ghcr.io/cyclonedx/cdxgen-dotnet:latest
```

```bash
docker run --rm -v $(pwd):/app -w /app ghcr.io/cyclonedx/cdxgen-dotnet:latest cdxgen -t dotnet -o sbom.json
```

--------------------------------

### Display Evinse Command-Line Help Options

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ADVANCED.md

Shows all available command-line options for the 'evinse' tool, including input/output files, supported languages, database paths, and various evidence generation flags. This is useful for understanding the full capabilities and parameters of the command.

```shell
evinse -h
Options:
  -i, --input                    Input SBOM file. Default bom.json
                                                           [default: "bom.json"]
  -o, --output                   Output file. Default bom.evinse.json
                                                    [default: "bom.evinse.json"]
  -l, --language                 Application language
  [choices: "java", "jar", "javascript", "python", "android", "cpp"] [default: "
                                                                          java"]
      --db-path                  Atom slices DB path. Default /home/prabhu/.loca
                                 l/share/.atomdb
                                  [default: "/home/prabhu/.local/share/.atomdb"]
      --force                    Force creation of the database
                                                      [boolean] [default: false]
      --skip-maven-collector     Skip collecting jars from maven and gradle cach
                                 es. Can speedup re-runs if the data was cached
                                 previously.          [boolean] [default: false]
      --with-deep-jar-collector  Enable collection of all jars from maven cache
                                 directory. Useful to improve the recall for cal
                                 lstack evidence.     [boolean] [default: false]
      --annotate                 Include contents of atom slices as annotations
                                                       [boolean] [default: true]
      --with-data-flow           Enable inter-procedural data-flow slicing.
                                                      [boolean] [default: false]
      --usages-slices-file       Use an existing usages slices file.
                                                 [default: "usages.slices.json"]
      --data-flow-slices-file    Use an existing data-flow slices file.
                                              [default: "data-flow.slices.json"]
  -p, --print                    Print the evidences as table          [boolean]
      --version                  Show version number                   [boolean]
  -h                             Show help                             [boolean]
```

--------------------------------

### Verify SBOM Signature using cdx-verify Command

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

The `cdx-verify` command, bundled with cdxgen, can be used to verify a single signature at the BOM level. Install cdxgen globally and then run `cdx-verify` with the BOM file and public key.

```shell
npm install -g @cyclonedx/cdxgen
cdx-verify -i bom.json --public-key public.key
```

--------------------------------

### cdxgen Variant for Node.js 23

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ci/images/README.md

Supports automatic Node.js installation. For example, pass `-t node20` to install Node.js 20.

```APIDOC
Node.js Version: 23
Image: ghcr.io/cyclonedx/cdxgen:master
```

--------------------------------

### cdxgen Variant for Ruby 2.6.10

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ci/images/README.md

Supports automatic Ruby installation for 2.6.x. For example, pass `-t ruby2.6.1` to install Ruby 2.6.1.

```APIDOC
Ruby Version: 2.6.10
Image: ghcr.io/cyclonedx/cdxgen-debian-ruby26:v11
```

--------------------------------

### Installing Dependencies and Running Local Snapshot Diff

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/test/diff/README.md

Commands to install the required Python dependencies and execute the `diff_tests.py` script, comparing two sets of snapshot BOMs.

```bash
pip install -r requirements.txt
diff_tests.py -d path/to/snapshots/from/step/1 path/to/snapshots/from/step/2
```

--------------------------------

### cdxgen Variant for Ruby 2.5.0

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ci/images/README.md

Supports automatic Ruby installation for 2.5.x. For example, pass `-t ruby2.5.1` to install Ruby 2.5.1.

```APIDOC
Ruby Version: 2.5.0
Image: ghcr.io/cyclonedx/cdxgen-ruby25:v11
```

--------------------------------

### cdxgen Variant for Ruby 3.4.x

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ci/images/README.md

Supports automatic Ruby installation for 3.4.x. For example, pass `-t ruby3.4.0` to install Ruby 3.4.0.

```APIDOC
Ruby Version: 3.4.x
Image: ghcr.io/cyclonedx/cdxgen-debian-ruby34:v11
```

--------------------------------

### cdxgen Variant for Ruby 3.3.6

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ci/images/README.md

Supports automatic Ruby installation for 3.3.x. For example, pass `-t ruby3.3.1` to install Ruby 3.3.1.

```APIDOC
Ruby Version: 3.3.6
Image: ghcr.io/cyclonedx/cdxgen-debian-ruby33:v11
```

--------------------------------

### cdxi REPL Sample Usage for BOM Management

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ADVANCED.md

Examples demonstrating common operations within the `cdxi` interactive REPL, including creating an SBOM, printing its contents, searching for components, executing JSONata queries, sorting components, and updating component properties.

```shell
.create /mnt/work/vuln-spring
.print
.search spring
.query components[name ~> /spring/ and scope = "required"]
.query components[scope='required'].purl
// Supplier names
.query $distinct(components.supplier.name)
.sort name
.sort components^(>name)
.update | components[name ~> /spring/] | {'publisher': "foo"} |
```

--------------------------------

### Example cdxgen Configuration in JSON

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/ADVANCED.md

Provides an example of `cdxgen` configuration in JSON format, demonstrating how to set the project type, enable printing, and specify the output file.

```json
{
  "type": "java",
  "print": true,
  "output": "bom.json"
}
```

--------------------------------

### Configure and Load Model in LM Studio

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/fine-tuning/README.md

These commands prepare LM Studio for testing. They copy the model files, list available models, check server status, and then load the `cdx1-mlx-8bit` model with specific parameters like exact match, GPU usage, identifier, and context length.

```shell
cp -rf prabhuat ~/.lmstudio/models/
lms ls
lms server status
lms load CycloneDX/cdx1-mlx-8bit --exact --gpu max --identifier cdx1-test --context-length 16000
```

--------------------------------

### Example cdxgen Configuration in YAML

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/ADVANCED.md

Provides an example of `cdxgen` configuration in YAML format, showing how to set the project type, enable printing, specify the output file, and include an 'only' filter.

```yaml
# Java type
type: java
# Print the BOM as table and tree
print: true
# Set the output file
output: bom.json
# Only include these components in the BOM
only: org.springframework
```

--------------------------------

### Submit SBOM Scan Arguments via POST Request

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Instead of GET, arguments for SBOM scanning can be sent as a JSON payload in a POST request to the `/sbom` endpoint. This allows for more complex or sensitive parameters.

```APIDOC
curl -H "Content-Type: application/json" http://localhost:9090/sbom -XPOST -d $'{"url": "https://github.com/HooliCorp/vulnerable-aws-koa-app.git", "type": "nodejs", "multiProject": "true"}'
```

--------------------------------

### Scan Git Repository via cdxgen SBOM Server API

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Send a GET request to the `/sbom` route to scan a remote Git repository. Provide the repository URL, `multiProject` flag, and project type.

```APIDOC
curl "http://127.0.0.1:9090/sbom?url=https://github.com/HooliCorp/vulnerable-aws-koa-app.git&multiProject=true&type=js"
```

--------------------------------

### Scan Local Path via cdxgen SBOM Server API

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Use `curl` to send a GET request to the `/sbom` route of the cdxgen server to scan a local file path. Specify the path, `multiProject` flag, and project type.

```APIDOC
curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/vulnerable-aws-koa-app&multiProject=true&type=js"
```

--------------------------------

### cdxgen Common Usage Examples

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/CLI.md

Practical examples demonstrating how to use the cdxgen command-line tool to generate SBOMs for different programming languages and with specific profiles, or to run cdxgen as a server.

```Shell
cdxgen -t java .
cdxgen -t java -t js .
cdxgen -t java --profile ml .
cdxgen -t python --profile research .
cdxgen --server
```

--------------------------------

### Generate SBOM for Container Image by Tag

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Generate an SBOM for a container image using its tag. If no tag is specified, cdxgen will pull the `latest` tag by default.

```shell
cdxgen ghcr.io/owasp-dep-scan/depscan:nightly -o bom.json -t docker
```

--------------------------------

### Generate SBOM for Older CycloneDX Specification Version

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

Specify an older CycloneDX specification version, such as 1.4, using the `--spec-version` argument for compatibility requirements.

```shell
cdxgen -r -o bom.json --spec-version 1.4
```

--------------------------------

### Example Multi-Platform Container Execution with Nerdctl

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/ci/images/README.md

This command demonstrates how to run a `cdxgen-node20` container with `nerdctl`, explicitly targeting the `linux/arm64` platform. It includes volume mounts for `/tmp` and the current working directory, sets a debug environment variable, and specifies output paths for SBOM generation. This allows for generating SBOMs for `arm64` projects from an `x64` host.

```shell
nerdctl run --rm --platform=linux/arm64 -e CDXGEN_DEBUG_MODE=verbose -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen-node20:v11 -r /app -o /app/bom.json -t js
```

--------------------------------

### Evinse Command-Line Options Reference

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/ADVANCED.md

Provides a comprehensive list of command-line options for the `evinse` tool, including input/output file specifications, supported languages, database paths, and various evidence generation flags like `--with-data-flow` and `--with-reachables`.

```APIDOC
evinse -h
Options:
  -i, --input                    Input SBOM file. Default bom.json
                                                           [default: "bom.json"]
  -o, --output                   Output file. Default bom.evinse.json
                                                    [default: "bom.evinse.json"]
  -l, --language                 Application language
  [choices: "java", "jar", "javascript", "python", "android", "cpp"] [default: "
                                                                          java"]
      --db-path                  Atom slices DB path. Default /home/prabhu/.loca
                                 l/share/.atomdb
                                  [default: "/home/prabhu/.local/share/.atomdb"]
      --force                    Force creation of the database
                                                      [boolean] [default: false]
      --skip-maven-collector     Skip collecting jars from maven and gradle cach
                                 es. Can speedup re-runs if the data was cached
                                 previously.          [boolean] [default: false]
      --with-deep-jar-collector  Enable collection of all jars from maven cache
                                 directory. Useful to improve the recall for cal
                                 lstack evidence.     [boolean] [default: false]
      --annotate                 Include contents of atom slices as annotations
                                                      [boolean] [default: false]
      --with-data-flow           Enable inter-procedural data-flow slicing.
                                                      [boolean] [default: false]
      --with-reachables          Enable auto-tagged reachable slicing. Requires
                                 SBOM generated with --deep mode.
                                                      [boolean] [default: false]
      --usages-slices-file       Use an existing usages slices file.
                                                 [default: "usages.slices.json"]
      --data-flow-slices-file    Use an existing data-flow slices file.
                                              [default: "data-flow.slices.json"]
      --reachables-slices-file   Use an existing reachables slices file.
                                             [default: "reachables.slices.json"]
  -p, --print                    Print the evidences as table          [boolean]
      --version                  Show version number                   [boolean]
  -h                             Show help                             [boolean]
```

--------------------------------

### Example CSV Format for Repository Configuration

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/bulk-generate/README.md

This example illustrates the required format for the input CSV file. Each row defines a repository with columns for project name, Git link, commit hash, cdxgen image, primary language, and cdxgen-specific variables.

```csv
project,link,commit,image,language,cdxgen_vars
astro,https://github.com/withastro/astro.git,9d6bcdb88fcb9df0c5c70e2b591bcf962ce55f63,ghcr.io/cyclonedx/cdxgen-node20:v11,js,,
```

--------------------------------

### Generate SBOM for Container Image by SHA256

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

cdxgen automatically detects the `docker` type when an image is specified by its SHA256 digest or `docker.io` prefix, generating an SBOM for the container.

```shell
cdxgen odoo@sha256:4e1e147f0e6714e8f8c5806d2b484075b4076ca50490577cdf9162566086d15e -o bom.json
```

--------------------------------

### Install cdxgen globally

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/LESSON2.md

Installs the cdxgen command-line tool globally using npm. This allows cdxgen to be executed from any directory on the system.

```shell
sudo npm install -g @cyclonedx/cdxgen
```

--------------------------------

### Recursively Generate Single SBOM for All Languages

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

The `-r` argument enables recursive scanning to generate a single consolidated SBOM for projects containing multiple languages or sub-modules.

```shell
cdxgen -r -o bom.json
```

--------------------------------

### Stop cdxgen Lima VM

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/lima/README.md

This command gracefully stops the running 'cdxgen' Lima virtual machine, terminating its processes and freeing up resources.

```shell
limactl stop cdxgen
```

--------------------------------

### cdxgen Arguments for Dependency Track Integration

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

These arguments allow cdxgen to automatically submit the generated SBOM to a Dependency Track server, specifying project details and authentication parameters.

```APIDOC
      --type                   Project type. Please refer to https://cyclonedx.g
                               ithub.io/cdxgen/#/PROJECT_TYPES for supported lan
                               guages/platforms.
      --server-url             Dependency track url. Eg: https://deptrack.cyclon
                               edx.io
      --api-key                Dependency track api key
      --project-group          Dependency track project group
      --project-name           Dependency track project name. Default use the di
                               rectory name
      --project-version        Dependency track project version    [default: ""]
      --project-id             Dependency track project id. Either provide the i
                               d or the project name and version together
      --parent-project-id      Dependency track parent project id
```

--------------------------------

### Generate Java SBOM with mlx_lm using 4-bit Model

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/contrib/xBOMEval/cdx1-NOTES.md

Illustrates generating an SBOM for a Java project using the `cdx1-mlx-4bit` model. This example highlights the higher tokens-per-second generation rate at the cost of slight reduced accuracy, utilizing the `bomgen` command.

```bash
mlx_lm.generate --model ./CycloneDX/cdx1-mlx-4bit --prompt "How do I generate an SBOM for a java project? Share the full command to be used." --temp 0.05
```

--------------------------------

### Generate SBOM for JavaScript Application

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/LESSON2.md

Navigates into the "frontend" directory, installs its npm dependencies, and then generates an SBOM. The SBOM is outputted as "bom.json" and includes reachable evidence using the "research" profile. This process can take approximately 5 minutes.

```shell
cd frontend
npm install
# Takes around 5 mins
cdxgen -o bom.json -t js --profile research . -p
```

--------------------------------

### Generate SBOM for Java Projects

Source: https://github.com/jonathanginz/cdxgenofficial/blob/master/docs/README.md

This command automatically detects Maven, Gradle, or SBT projects within a Java codebase and generates a CycloneDX SBOM. The output is saved as `bom.json`.

```shell
cdxgen -t java -o bom.json
```