Documentation

kunnus-scanner Docs

Everything you need to go from install to a standards-compliant SBOM — for source code, machines, firmware images, and containers.

About kunnus-scanner GitHub

OpenSSF Best Practices badge: passing — view the report

OpenSSF Scorecard badge — view the current score

Install

shell

# macOS
brew install think-ahead-technologies/tap/kunnus

# Windows
scoop bucket add think-ahead https://github.com/think-ahead-technologies/scoop-bucket
scoop install kunnus

# Linux — .deb/.rpm packages and static binaries on the releases page
sudo dpkg -i kunnus_*.deb

# Docker (multi-arch: amd64/arm64)
docker pull ghcr.io/think-ahead-technologies/kunnus-scanner:latest

A single static binary — no installer, no runtime dependencies. Verify with kunnus --version.

Your first SBOM

kunnus has three scan modes. Pick the one that matches what you're pointing it at — each has its own guide below.

shell

kunnus sbom repo --output sbom.cdx.json        # a source-code checkout
kunnus sbom os --output machine.cdx.json       # a running machine or mounted firmware image
kunnus sbom container alpine:3.20 -o img.json  # a container image

Guides

Scanning Source Code

Generate an SBOM from a source repository — auto-detected ecosystems, lockfile hashes, offline licences.

Read guide

Scanning Operating Systems & Firmware Images

Inventory a running machine or a mounted firmware image — Linux, Windows, macOS, plus non-packaged binaries.

Read guide

Scanning Container Images

SBOMs for container images from a registry, tarball, or local daemon — with per-layer attribution.

Read guide

CI/CD Integration

Automate SBOM generation per release — GitHub Actions, GitLab CI, degraded-scan exit codes, platform upload.

Read guide

Embedded & C/C++ Ecosystems

Zephyr, ESP-IDF, PlatformIO, vcpkg, CMake, Arduino, CMSIS, ModusToolbox, git submodules — what is parsed, and what deliberately isn't.

Read guide

FAQ & Troubleshooting

Why a component is missing or versionless, exit codes, offline guarantees, and licence coverage.

Read guide

Reference

The full CLI flag reference, SBOM property semantics, and per-ecosystem licence coverage are maintained next to the code, so they never drift from the released binary:

SBOM generated. What about the other CRA duties?

Continuous vulnerability monitoring, CVE alerting, and the documentation trail for market surveillance authorities live on the kunnus platform.

Explore the Platform