How to create SBOM for kosi packages (kosi tools sbom)
A guide on how to use the kosi tools sbom command to generate a Software Bill of Materials (SBOM) for local and hub packages.
7 minute read
How to use KOSI Tools SBOM
This guide shows you how to use the kosi tools sbom command to generate and display a Software Bill of Materials (SBOM) for KOSI packages. You can generate SBOMs for both locally available packages and packages hosted on a hub.
⚠ Warning
Currently
kosi tools sbom can only be used by a privileged user (root) and in a non-airgap environment.
Prerequisites
Before you begin, make sure the following prerequisites are met:
-
Supported Operating Systems: KOSI tools are tested and supported on the following operating systems:
- Ubuntu 24.04
- Red Hat Enterprise Linux (RHEL) 9.6
-
Syft Installation: To execute the
sbomcommand, you must have Syft installed on your machine. -
A privileged user (root) and a non-airgap environment.
Installing Syft
You can easily install Syft on our supported systems using wget to download the specific package format for your OS.
# Define the Syft version (check GitHub for the current release)
# https://github.com/anchore/syft/releases/
SYFT_VERSION="1.46.0"
# Download the .deb package with wget
wget https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.deb
# Install the downloaded package
sudo dpkg --install syft_${SYFT_VERSION}_linux_amd64.deb
# Define the Syft version (check GitHub for the current release)
# https://github.com/anchore/syft/releases/
SYFT_VERSION="1.46.0"
# Download the .rpm package with wget
wget https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.rpm
# Install the downloaded package
sudo dnf install syft_${SYFT_VERSION}_linux_amd64.rpm
Note
Alternatively, you can install Syft universally using their official installation script:
wget -qO- https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin
Usage Options
The command syntax for generating an SBOM is as follows:
kosi tools sbom [options] [<package>]
Available Arguments and Options
| Option | Description |
|---|---|
<package> |
The name or path of the package. |
-p, --local-package <p> |
Show SBOM from a local package file (e.g., a .tgz archive). |
--hub |
Show SBOM directly from a package located in the KOSI hub. |
-?, -h, --help |
Show help and usage information. |
Examples
To generate an SBOM for a package that has already been downloaded to your local file system, use the -p (or --local-package) flag followed by the file name:
kosi tools sbom -p metricsserver.tgz
Example output
# kosi tools sbom -p metricsserver.tgz
2026-07-06 10:16:41 Info: KOSI version: KOSI version: 2.15.0.4_Beta0_1785144578
----------------------------------------------------------------------
Generate SBOM for image registry.kubeops.net/kubeops/kubeops/metrics-server/metrics-server:v0.8.0@sha256:3d2ca9b2af6aa14c9b698fa14e3a8f017f012517ebd1a6d3a36f28a4c56ae938
NAME VERSION TYPE
base-files 12.4+deb12u11 deb
cel.dev/expr v0.20.0 go-module
github.com/NYTimes/gziphandler v1.1.1 go-module
github.com/antlr4-go/antlr/v4 v4.13.0 go-module
github.com/beorn7/perks v1.0.1 go-module
github.com/blang/semver/v4 v4.0.0 go-module
github.com/cenkalti/backoff/v4 v4.3.0 go-module
github.com/cespare/xxhash/v2 v2.3.0 go-module
github.com/coreos/go-semver v0.3.1 go-module
github.com/coreos/go-systemd/v22 v22.5.0 go-module
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module
github.com/emicklei/go-restful/v3 v3.11.0 go-module
github.com/felixge/httpsnoop v1.0.4 go-module
github.com/fsnotify/fsnotify v1.8.0 go-module
github.com/fxamacker/cbor/v2 v2.7.0 go-module
github.com/go-logr/logr v1.4.2 go-module
github.com/go-logr/stdr v1.2.2 go-module
github.com/go-logr/zapr v1.3.0 go-module
github.com/go-openapi/jsonpointer v0.21.0 go-module
github.com/go-openapi/jsonreference v0.21.0 go-module
github.com/go-openapi/swag v0.23.0 go-module
github.com/gogo/protobuf v1.3.2 go-module
github.com/golang/protobuf v1.5.4 go-module
github.com/google/btree v1.1.3 go-module
github.com/google/cel-go v0.23.2 go-module
github.com/google/gnostic-models v0.6.9 go-module
github.com/google/go-cmp v0.7.0 go-module
github.com/google/uuid v1.6.0 go-module
github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc go-module
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 go-module
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 go-module
github.com/josharian/intern v1.0.0 go-module
github.com/json-iterator/go v1.1.12 go-module
github.com/kylelemons/godebug v1.1.0 go-module
github.com/mailru/easyjson v0.7.7 go-module
github.com/moby/term v0.5.0 go-module
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module
github.com/modern-go/reflect2 v1.0.2 go-module
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module
github.com/pkg/errors v0.9.1 go-module
github.com/prometheus/client_golang v1.22.0 go-module
github.com/prometheus/client_model v0.6.2 go-module
github.com/prometheus/common v0.65.0 go-module
github.com/prometheus/procfs v0.15.1 go-module
github.com/prometheus/prometheus v0.304.2 go-module
github.com/spf13/cobra v1.9.1 go-module
github.com/spf13/pflag v1.0.6 go-module
github.com/stoewer/go-strcase v1.3.0 go-module
github.com/x448/float16 v0.8.4 go-module
go.etcd.io/etcd/api/v3 v3.5.21 go-module
go.etcd.io/etcd/client/pkg/v3 v3.5.21 go-module
go.etcd.io/etcd/client/v3 v3.5.21 go-module
go.opentelemetry.io/auto/sdk v1.1.0 go-module
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 go-module
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 go-module
go.opentelemetry.io/otel v1.35.0 go-module
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 go-module
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 go-module
go.opentelemetry.io/otel/metric v1.35.0 go-module
go.opentelemetry.io/otel/sdk v1.35.0 go-module
go.opentelemetry.io/otel/trace v1.35.0 go-module
go.opentelemetry.io/proto/otlp v1.5.0 go-module
go.uber.org/multierr v1.11.0 go-module
go.uber.org/zap v1.27.0 go-module
golang.org/x/crypto v0.38.0 go-module
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 go-module
golang.org/x/net v0.40.0 go-module
golang.org/x/oauth2 v0.30.0 go-module
golang.org/x/sync v0.14.0 go-module
golang.org/x/sys v0.33.0 go-module
golang.org/x/term v0.32.0 go-module
golang.org/x/text v0.25.0 go-module
golang.org/x/time v0.11.0 go-module
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb go-module
google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e go-module
google.golang.org/grpc v1.72.0 go-module
google.golang.org/protobuf v1.36.6 go-module
gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module
gopkg.in/inf.v0 v0.9.1 go-module
gopkg.in/natefinch/lumberjack.v2 v2.2.1 go-module
gopkg.in/yaml.v3 v3.0.1 go-module
k8s.io/api v0.33.2 go-module
k8s.io/apimachinery v0.33.2 go-module
k8s.io/apiserver v0.33.2 go-module
k8s.io/client-go v0.33.2 go-module
k8s.io/component-base v0.33.2 go-module
k8s.io/klog/v2 v2.130.1 go-module
k8s.io/kms v0.33.2 go-module
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff go-module
k8s.io/metrics v0.33.2 go-module
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module
netbase 6.4 deb
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 go-module
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module
sigs.k8s.io/metrics-server UNKNOWN go-module
sigs.k8s.io/randfill v1.0.0 go-module
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 go-module
sigs.k8s.io/yaml v1.4.0 go-module
stdlib go1.24.4 go-module
tzdata 2025b-0+deb12u1 deb
----------------------------------------------------------------------
Generate SBOM for image registry.kubeops.net/kubeops/kubeops/autoscaling/addon-resizer:1.8.23@sha256:4c24051f09c29ed6a855341754feb581b81e0f54aaedc7782edf2c9e7e67b3a7
NAME VERSION TYPE
base-files 12.4+deb12u9 deb
github.com/beorn7/perks v1.0.1 go-module
github.com/blang/semver/v4 v4.0.0 go-module
github.com/cespare/xxhash/v2 v2.3.0 go-module
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module
github.com/emicklei/go-restful/v3 v3.11.0 go-module
github.com/fxamacker/cbor/v2 v2.7.0 go-module
github.com/go-logr/logr v1.4.2 go-module
github.com/go-openapi/jsonpointer v0.21.0 go-module
github.com/go-openapi/jsonreference v0.20.2 go-module
github.com/go-openapi/swag v0.23.0 go-module
github.com/gogo/protobuf v1.3.2 go-module
github.com/golang/protobuf v1.5.4 go-module
github.com/google/gnostic-models v0.6.8 go-module
github.com/google/go-cmp v0.6.0 go-module
github.com/google/gofuzz v1.2.0 go-module
github.com/google/uuid v1.6.0 go-module
github.com/josharian/intern v1.0.0 go-module
github.com/json-iterator/go v1.1.12 go-module
github.com/klauspost/compress v1.17.9 go-module
github.com/mailru/easyjson v0.7.7 go-module
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module
github.com/modern-go/reflect2 v1.0.2 go-module
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module
github.com/pkg/errors v0.9.1 go-module
github.com/prometheus/client_golang v1.20.5 go-module
github.com/prometheus/client_model v0.6.1 go-module
github.com/prometheus/common v0.62.0 go-module
github.com/prometheus/procfs v0.15.1 go-module
github.com/spf13/pflag v1.0.5 go-module
github.com/x448/float16 v0.8.4 go-module
go.opentelemetry.io/otel v1.28.0 go-module
go.opentelemetry.io/otel/trace v1.28.0 go-module
golang.org/x/net v0.33.0 go-module
golang.org/x/oauth2 v0.24.0 go-module
golang.org/x/sys v0.28.0 go-module
golang.org/x/term v0.27.0 go-module
golang.org/x/text v0.21.0 go-module
golang.org/x/time v0.7.0 go-module
google.golang.org/protobuf v1.36.1 go-module
gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module
gopkg.in/inf.v0 v0.9.1 go-module
gopkg.in/yaml.v3 v3.0.1 go-module
k8s.io/api v0.32.1 go-module
k8s.io/apimachinery v0.32.1 go-module
k8s.io/autoscaler/addon-resizer v1.8.23 go-module
k8s.io/client-go v0.32.1 go-module
k8s.io/component-base v0.32.1 go-module
k8s.io/klog/v2 v2.130.1 go-module
k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f go-module
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module
netbase 6.4 deb
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 go-module
sigs.k8s.io/yaml v1.4.0 go-module
stdlib go1.23.4 go-module
tzdata 2024b-0+deb12u1 deb
To generate an SBOM for a package that is hosted on the KOSI hub without downloading it manually, specify the package name and use the --hub flag to specify the hub name:
kosi tools sbom kubeops/metrics-server:2.2.0_Beta0 --hub kubeops
Example output
# kosi tools sbom kubeops/metrics-server:2.2.0_Beta0 --hub kubeops
2026-07-06 10:15:32 Info: KOSI version: 2.15.0.4_Beta0_1785144578
2026-07-06 10:15:33 Info: ...Download 100%
2026-07-06 10:16:25 Info: Checking package hash
2026-07-06 10:16:25 Info: Hash checked succesfully. Is equal
----------------------------------------------------------------------
Generate SBOM for image registry.kubeops.net/kubeops/kubeops/metrics-server/metrics-server:v0.8.0@sha256:3d2ca9b2af6aa14c9b698fa14e3a8f017f012517ebd1a6d3a36f28a4c56ae938
NAME VERSION TYPE
base-files 12.4+deb12u11 deb
cel.dev/expr v0.20.0 go-module
github.com/NYTimes/gziphandler v1.1.1 go-module
github.com/antlr4-go/antlr/v4 v4.13.0 go-module
github.com/beorn7/perks v1.0.1 go-module
github.com/blang/semver/v4 v4.0.0 go-module
github.com/cenkalti/backoff/v4 v4.3.0 go-module
github.com/cespare/xxhash/v2 v2.3.0 go-module
github.com/coreos/go-semver v0.3.1 go-module
github.com/coreos/go-systemd/v22 v22.5.0 go-module
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module
github.com/emicklei/go-restful/v3 v3.11.0 go-module
github.com/felixge/httpsnoop v1.0.4 go-module
github.com/fsnotify/fsnotify v1.8.0 go-module
github.com/fxamacker/cbor/v2 v2.7.0 go-module
github.com/go-logr/logr v1.4.2 go-module
github.com/go-logr/stdr v1.2.2 go-module
github.com/go-logr/zapr v1.3.0 go-module
github.com/go-openapi/jsonpointer v0.21.0 go-module
github.com/go-openapi/jsonreference v0.21.0 go-module
github.com/go-openapi/swag v0.23.0 go-module
github.com/gogo/protobuf v1.3.2 go-module
github.com/golang/protobuf v1.5.4 go-module
github.com/google/btree v1.1.3 go-module
github.com/google/cel-go v0.23.2 go-module
github.com/google/gnostic-models v0.6.9 go-module
github.com/google/go-cmp v0.7.0 go-module
github.com/google/uuid v1.6.0 go-module
github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc go-module
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 go-module
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 go-module
github.com/josharian/intern v1.0.0 go-module
github.com/json-iterator/go v1.1.12 go-module
github.com/kylelemons/godebug v1.1.0 go-module
github.com/mailru/easyjson v0.7.7 go-module
github.com/moby/term v0.5.0 go-module
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module
github.com/modern-go/reflect2 v1.0.2 go-module
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module
github.com/pkg/errors v0.9.1 go-module
github.com/prometheus/client_golang v1.22.0 go-module
github.com/prometheus/client_model v0.6.2 go-module
github.com/prometheus/common v0.65.0 go-module
github.com/prometheus/procfs v0.15.1 go-module
github.com/prometheus/prometheus v0.304.2 go-module
github.com/spf13/cobra v1.9.1 go-module
github.com/spf13/pflag v1.0.6 go-module
github.com/stoewer/go-strcase v1.3.0 go-module
github.com/x448/float16 v0.8.4 go-module
go.etcd.io/etcd/api/v3 v3.5.21 go-module
go.etcd.io/etcd/client/pkg/v3 v3.5.21 go-module
go.etcd.io/etcd/client/v3 v3.5.21 go-module
go.opentelemetry.io/auto/sdk v1.1.0 go-module
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 go-module
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 go-module
go.opentelemetry.io/otel v1.35.0 go-module
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 go-module
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 go-module
go.opentelemetry.io/otel/metric v1.35.0 go-module
go.opentelemetry.io/otel/sdk v1.35.0 go-module
go.opentelemetry.io/otel/trace v1.35.0 go-module
go.opentelemetry.io/proto/otlp v1.5.0 go-module
go.uber.org/multierr v1.11.0 go-module
go.uber.org/zap v1.27.0 go-module
golang.org/x/crypto v0.38.0 go-module
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 go-module
golang.org/x/net v0.40.0 go-module
golang.org/x/oauth2 v0.30.0 go-module
golang.org/x/sync v0.14.0 go-module
golang.org/x/sys v0.33.0 go-module
golang.org/x/term v0.32.0 go-module
golang.org/x/text v0.25.0 go-module
golang.org/x/time v0.11.0 go-module
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb go-module
google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e go-module
google.golang.org/grpc v1.72.0 go-module
google.golang.org/protobuf v1.36.6 go-module
gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module
gopkg.in/inf.v0 v0.9.1 go-module
gopkg.in/natefinch/lumberjack.v2 v2.2.1 go-module
gopkg.in/yaml.v3 v3.0.1 go-module
k8s.io/api v0.33.2 go-module
k8s.io/apimachinery v0.33.2 go-module
k8s.io/apiserver v0.33.2 go-module
k8s.io/client-go v0.33.2 go-module
k8s.io/component-base v0.33.2 go-module
k8s.io/klog/v2 v2.130.1 go-module
k8s.io/kms v0.33.2 go-module
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff go-module
k8s.io/metrics v0.33.2 go-module
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module
netbase 6.4 deb
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 go-module
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module
sigs.k8s.io/metrics-server UNKNOWN go-module
sigs.k8s.io/randfill v1.0.0 go-module
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 go-module
sigs.k8s.io/yaml v1.4.0 go-module
stdlib go1.24.4 go-module
tzdata 2025b-0+deb12u1 deb
----------------------------------------------------------------------
Generate SBOM for image registry.kubeops.net/kubeops/kubeops/autoscaling/addon-resizer:1.8.23@sha256:4c24051f09c29ed6a855341754feb581b81e0f54aaedc7782edf2c9e7e67b3a7
NAME VERSION TYPE
base-files 12.4+deb12u9 deb
github.com/beorn7/perks v1.0.1 go-module
github.com/blang/semver/v4 v4.0.0 go-module
github.com/cespare/xxhash/v2 v2.3.0 go-module
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module
github.com/emicklei/go-restful/v3 v3.11.0 go-module
github.com/fxamacker/cbor/v2 v2.7.0 go-module
github.com/go-logr/logr v1.4.2 go-module
github.com/go-openapi/jsonpointer v0.21.0 go-module
github.com/go-openapi/jsonreference v0.20.2 go-module
github.com/go-openapi/swag v0.23.0 go-module
github.com/gogo/protobuf v1.3.2 go-module
github.com/golang/protobuf v1.5.4 go-module
github.com/google/gnostic-models v0.6.8 go-module
github.com/google/go-cmp v0.6.0 go-module
github.com/google/gofuzz v1.2.0 go-module
github.com/google/uuid v1.6.0 go-module
github.com/josharian/intern v1.0.0 go-module
github.com/json-iterator/go v1.1.12 go-module
github.com/klauspost/compress v1.17.9 go-module
github.com/mailru/easyjson v0.7.7 go-module
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module
github.com/modern-go/reflect2 v1.0.2 go-module
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module
github.com/pkg/errors v0.9.1 go-module
github.com/prometheus/client_golang v1.20.5 go-module
github.com/prometheus/client_model v0.6.1 go-module
github.com/prometheus/common v0.62.0 go-module
github.com/prometheus/procfs v0.15.1 go-module
github.com/spf13/pflag v1.0.5 go-module
github.com/x448/float16 v0.8.4 go-module
go.opentelemetry.io/otel v1.28.0 go-module
go.opentelemetry.io/otel/trace v1.28.0 go-module
golang.org/x/net v0.33.0 go-module
golang.org/x/oauth2 v0.24.0 go-module
golang.org/x/sys v0.28.0 go-module
golang.org/x/term v0.27.0 go-module
golang.org/x/text v0.21.0 go-module
golang.org/x/time v0.7.0 go-module
google.golang.org/protobuf v1.36.1 go-module
gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module
gopkg.in/inf.v0 v0.9.1 go-module
gopkg.in/yaml.v3 v3.0.1 go-module
k8s.io/api v0.32.1 go-module
k8s.io/apimachinery v0.32.1 go-module
k8s.io/autoscaler/addon-resizer v1.8.23 go-module
k8s.io/client-go v0.32.1 go-module
k8s.io/component-base v0.32.1 go-module
k8s.io/klog/v2 v2.130.1 go-module
k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f go-module
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module
netbase 6.4 deb
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 go-module
sigs.k8s.io/yaml v1.4.0 go-module
stdlib go1.23.4 go-module
tzdata 2024b-0+deb12u1 deb