stella sbomer — Command Guide

The stella sbomer command group produces deterministic, per-layer Software Bills of Materials (SBOMs) and composes, diffs, and verifies them. It is designed for offline-first, air-gapped pipelines where every run must be byte-for-byte reproducible.

Audience: release engineers and CI authors who need repeatable SBOM artifacts without network access.

Tip: For online, image-level SBOM generation and signed-archive verification, see the stella sbomcommand group.

Prerequisites

Install CLI from offline bundle; ensure local-nugets/ is available.
Export images/charts locally; no network access required during commands.

Commands

stella sbomer layer <image>
- Emits deterministic SBOM per layer; options: --format cyclonedx|spdx, --output <path>, --deterministic (default true).
stella sbomer compose <manifest>
- Merges layer SBOMs with stable ordering; rejects missing hashes.
stella sbomer drift <baseline> <current>
- Computes drift; returns machine-readable diff with stable ordering.
stella sbomer verify <sbom> --hash <sha256>
- Validates hash/signature if provided; offline only.

Determinism rules

Use fixed sort keys (component name, version, purl) when composing.
All timestamps forced to 1970-01-01T00:00:00Z unless --timestamp supplied.
GUID/UUID generation disabled; use content hashes as IDs.
Outputs written in UTF-8 with LF line endings; no BOM.

Examples

# generate layer SBOM
stella sbomer layer ghcr.io/acme/app:1.2.3 --format cyclonedx --output app.cdx.json

# compose
stella sbomer compose app.cdx.json lib.cdx.json --output combined.cdx.json

# drift
stella sbomer drift baseline.cdx.json combined.cdx.json --output drift.json

Offline tips