SBOM Generation. Free. For Everyone.
kunnus-scanner is an open source CLI tool that scans source code, operating systems, firmware images, and container images and generates a standards-compliant Software Bill of Materials in minutes.
Built for CRA Compliance. Free to Use.
The EU Cyber Resilience Act requires manufacturers to maintain an SBOM for every product they ship. We believe the tooling to generate those SBOMs should be freely available to everyone – from solo developers to large engineering teams.
Manufacturers shall identify and document vulnerabilities and components contained in products, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at least the top-level dependencies of the products.
— Regulation (EU) 2024/2847, Annex I, Part II
What kunnus-scanner Does
Code, OS & Container Scans
Scan a source repository, a running machine or mounted firmware image, or a container image with per-layer attribution — one binary, three commands.
CycloneDX 1.6
Outputs standard-compliant CycloneDX 1.6, conformant with BSI TR-03183-2 and covering 16 of the 17 data fields in CISA's 2026 SBOM minimum elements – licences, content hashes, CPEs, dependency relationships mined from lockfiles, and a named SBOM author.
Offline by Default
Scans make no network requests. Run it from a USB stick on an air-gapped industrial PC – no installer, no cloud connection, no account.
CI/CD Integration
The Docker image drops into GitHub Actions, GitLab CI, or Jenkins. Exit codes distinguish clean scans from degraded ones, and stable serial numbers turn successive pipeline runs into one traceable document series instead of unrelated files.
Broad Ecosystem Coverage
npm, Python, Go, Rust, Java, .NET, PHP, Ruby, and more via Google's osv-scalibr – plus native support for embedded firmware manifests (vcpkg, CMake, Zephyr, PlatformIO, ESP-IDF, Arduino, CMSIS, ModusToolbox), OS packages on Linux, Windows, and macOS, distroless images, and the Linux kernel with its modules.
Multiple Install Paths
Homebrew (macOS), Scoop (Windows), .deb/.rpm packages, Docker (amd64/arm64), or pre-built binaries. Releases ship with SLSA Build L2 provenance, signed container images, and a signed SBOM — all as GitHub artifact attestations.
Get Started in Minutes
brew install think-ahead-technologies/tap/kunnusAlso available via Scoop, Docker, .deb/.rpm packages, and pre-built binaries.
kunnus sbom repo --output sbom.cdx.jsonAuto-detects every ecosystem in the tree and writes a CycloneDX 1.6 SBOM.
kunnus sbom os --output machine.cdx.jsonInventories the OS you're standing on – or a mounted firmware image. kunnus sbom container <image> does the same for container images.
GitHub Actions
Add SBOM generation and upload to any workflow in two steps.
- name: Generate SBOM
env:
KUNNUS_COMPONENT_ID: ${{ vars.KUNNUS_COMPONENT_ID }}
KUNNUS_COMPONENT_VERSION: ${{ github.ref_name }}
KUNNUS_AUTHOR: ${{ vars.KUNNUS_AUTHOR }}
run: |
docker run --rm -v ${{ github.workspace }}:/src \
-e KUNNUS_COMPONENT_ID -e KUNNUS_COMPONENT_VERSION -e KUNNUS_AUTHOR \
ghcr.io/think-ahead-technologies/kunnus-scanner:latest \
sbom repo /src --output /src/sbom.cdx.json
- name: Upload to kunnus platform
env:
KUNNUS_API_KEY: ${{ secrets.KUNNUS_API_KEY }}
KUNNUS_COMPONENT_ID: ${{ vars.KUNNUS_COMPONENT_ID }}
run: |
docker run --rm -v ${{ github.workspace }}:/src \
-e KUNNUS_API_KEY -e KUNNUS_COMPONENT_ID \
ghcr.io/think-ahead-technologies/kunnus-scanner:latest \
upload /src/sbom.cdx.jsonNeed More Than SBOM Generation?
kunnus-scanner generates the SBOM. The Kunnus platform takes it from there: continuous vulnerability monitoring across all your products, automated CVE alerting, structured CRA documentation, and the audit trail you need for market surveillance authorities.
Apache 2.0 Licensed
kunnus-scanner is free to use, modify, and distribute. Built on Google's osv-scalibr. Contributions welcome.
View Source on GitHub