Scanning Source Code
kunnus sbom repo walks a source tree, detects every package ecosystem present, and emits one CycloneDX 1.6 SBOM covering all of them. No configuration file, no per-language setup.
cd my-project
kunnus sbom repo --output sbom.cdx.jsonWithout --output the SBOM goes to stdout so you can pipe it; all log output goes to stderr. The path argument defaults to the current directory, so kunnus sbom repo ~/src/firmware works too.
What gets detected
Detection is marker-based: kunnus looks for the manifest and lockfiles each ecosystem uses (package.json, go.mod, Cargo.lock, pom.xml, requirements.txt, …) and enables the matching extractors. One scan covers more than 20 language ecosystems — npm/pnpm/yarn/bun, Python (requirements, poetry, pdm, Pipfile, uv, conda), Go, Rust, Java (Maven, Gradle), .NET, PHP, Ruby, Swift (SwiftPM, CocoaPods), Haskell, Lua, R, and C/C++ (Conan) — plus embedded firmware manifests and vendored C/C++ library directories.
Monorepos need nothing special: every ecosystem found anywhere in the tree lands in the same SBOM, and duplicate declarations across sub-projects collapse in the deduplication stage.
Restricting the scan
To scan only specific ecosystems, pass --ecosystem (repeatable). To add or remove individual scalibr plugins, use --enable / --disable.
kunnus sbom repo --ecosystem npm --ecosystem pythonHashes and licences
Where a lockfile embeds content digests (npm, yarn, pnpm, bun, poetry, uv, Cargo, Conan, ESP-IDF, …), kunnus carries them into the SBOM as component hashes — a BSI TR-03183-2 requirement. Licences are attached from package data that is available offline; for ecosystems whose lockfiles carry no licence (Go, Rust, .NET), the opt-in --online-licenses flag fills the gap via deps.dev. That flag is the only scan feature that touches the network.