---
name: "bomtool"
section: "1"
platform: "linux"
package: "pkgconf"
version: "3.0.10-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/bomtool"
---

# bomtool(1)

a tool for generating SPDX-based software bills of material

## NAME

**bomtool** – a tool for generating SPDX-based software bills of material

## SYNOPSIS

**bomtool** \[*options*\] *module* *...*

## DESCRIPTION

**bomtool** is a program which generates a textual SPDX 2.0 software bill of materials (SBOM) for a given set of pkg-config modules. The output of this tool can then be translated into other SBOM formats as necessary.

The *options* are as follows:

- **--about**

  Print the version number, the Copyright notice, and the license of the **bomtool** program to standard output and exit. Most other options and all command line arguments are ignored.

- **--version**

  Print the version number of the **bomtool** program to standard output and exit. Most other options and all command line arguments are ignored.

- **--define-variable**=*varname*=*value*

  Define *varname* as *value*. Variables are used in query output, and some modules' results may change based on the presence of a variable definition.

- **--creation-time** *time*

  Use *time* as the value of the **Created** field in the generated SBOM instead of the current time. SPDX recommends using an ISO 8601-formatted time, which is: YYYY-MM-DDThh:mm:ssZ. This takes precedence over the SOURCE\_DATE\_EPOCH environment variable.

- **--output** *file*

  Write the generated SBOM to *file* instead of standard output.

## ENVIRONMENT

- PKG\_CONFIG\_DEBUG\_SPEW

  If set, print debugging messages to stderr.

- PKG\_CONFIG\_IGNORE\_CONFLICTS

  If set, ignore **Conflicts** rules in modules. Has the same effect as the **--ignore-conflicts** option in [pkgconf(1)](/pkgconf/1.md)

- PKG\_CONFIG\_LIBDIR

  A colon-separated list of low-priority directories where [pc(5)](/pc/5.md) files are looked up. The module search path is constructed by appending this list to PKG\_CONFIG\_PATH, which enjoys higher priority. If PKG\_CONFIG\_LIBDIR is not defined, the default list compiled into the **bomtool** program from the PKG\_DEFAULT\_PATH preprocessor macro is appended instead. If PKG\_CONFIG\_LIBDIR is defined but empty, nothing is appended.

- PKG\_CONFIG\_MAXIMUM\_TRAVERSE\_DEPTH

  Impose a limit on the allowed depth in the dependency graph.

- PKG\_CONFIG\_PATH

  A colon-separated list of high-priority directories where [pc(5)](/pc/5.md) files are looked up.

- PKG\_CONFIG\_PRELOADED\_FILES

  Colon-separated list of [pc(5)](/pc/5.md) files which are loaded before any other pkg-config files. These packages are given highest priority over any other [pc(5)](/pc/5.md) files that would otherwise provide a given package.

- SOURCE\_DATE\_EPOCH

  If set, and the **--creation-time** option is not given, the **Created** field in the generated SBOM is derived from this UNIX timestamp instead of the current time, allowing for reproducible SBOM generation.

## EXIT STATUS

The **bomtool** utility exits 0 on success, and \>0 if an error occurs.

## EXAMPLES

Generating an SBOM for the package named foo:

```
$ bomtool foo
```

```
SPDXVersion: SPDX-2.2
```

```
DataLicense: CC0-1.0
```

```
SPDXID: SPDXRef-DOCUMENT
```

```
DocumentName: SBOM-SPDX-fooC641.2.3
```

```
DocumentNamespace: https://spdx.org/spdxdocs/bomtool
```

```
Creator: Tool: bomtool
```

```
[...]
```

## SEE ALSO

[pc(5)](/pc/5.md), [pkgconf(1)](/pkgconf/1.md)