Homebrew Tap for sbom-tools

Homebrew formulae for sbom-tools — a semantic SBOM diff and analysis tool.

Installation

brew install sbom-tool/tap/sbom-tools

Homebrew builds from source and verifies the source tarball SHA256 automatically. No manual verification is needed.

Upgrading

brew update
brew upgrade sbom-tools

Verifying pre-built binary downloads

If you download pre-built binaries from GitHub Releases instead of using Homebrew, each archive is signed with Sigstore and has a GitHub build attestation:

# Verify Sigstore signature (replace version tag)
cosign verify-blob \
  --bundle sbom-tools-macos-aarch64.tar.gz.bundle \
  --certificate-identity 'https://github.com/sbom-tool/sbom-tools/.github/workflows/publish-crates.yml@refs/tags/v0.1.15' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  sbom-tools-macos-aarch64.tar.gz

# Verify GitHub attestation
gh attestation verify sbom-tools-macos-aarch64.tar.gz \
  --repo sbom-tool/sbom-tools

License

MIT