Scanning Operating Systems & Firmware Images

kunnus sbom os inventories an operating-system filesystem: the machine you are standing on, or an extracted firmware image mounted read-only. This is the mode for industrial PCs, IoT gateways, and any device that ships with an OS.

# The machine you're standing on (default root: / on Unix, C:\ on Windows)
kunnus sbom os --output machine.cdx.json

# A mounted firmware image or extracted rootfs
kunnus sbom os /mnt/firmware --target-os linux --output firmware.cdx.json

What gets inventoried

• Linux: the distro family is fingerprinted (Debian/Ubuntu, RHEL, SUSE, Alpine, Arch, Gentoo, Nix, Container-Optimized OS) and its package database read; Flatpak and Snap packages are picked up as well.
• Windows: installed programs from the registry, plus Chocolatey and winget state.
• macOS: Homebrew, MacPorts, and installed .app bundles.
• Non-packaged binaries: a classifier surfaces bare executables no package manager tracks — a hand-built memcached, a vendored python — with overlap suppression so nothing appears twice.
• Installed language packages found on the image (site-packages wheels, gems, JARs, node_modules, Go binaries, …).

Scanning a foreign rootfs: --target-os

When the filesystem you scan is not the OS you run on — a Linux firmware image mounted on your Mac, for example — pass --target-os (linux | windows | mac) so kunnus knows what it is looking at.

Mounting a firmware image

kunnus sbom os scans a directory tree, so an image file first needs to be mounted or extracted. All of the following are read-only — kunnus never writes to the scan root.

sudo mount -o ro,loop firmware.img /mnt/firmware
kunnus sbom os /mnt/firmware --target-os linux --output firmware.cdx.json
sudo umount /mnt/firmware

sudo losetup -f --show -P firmware.img   # prints e.g. /dev/loop0
lsblk /dev/loop0                          # find the rootfs partition
sudo mount -o ro /dev/loop0p2 /mnt/firmware
kunnus sbom os /mnt/firmware --target-os linux -o firmware.cdx.json

unsquashfs -d rootfs rootfs.squashfs
kunnus sbom os ./rootfs --target-os linux

Vendor update packages (.swu, .raucb, zip/tar containers) usually wrap one of the above — unpack the container first, then mount or extract the filesystem inside. When the format is unknown, binwalk -e finds and extracts embedded filesystems. On macOS or Windows there is no loop mount for Linux filesystems: extract instead (7z, unsquashfs, binwalk) and pass --target-os linux.