Use
Export a lockfile SBOM
Export a CycloneDX or SPDX SBOM inventory from apm.lock.yaml.
ht lock export serializes the existing apm.lock.yaml into a CycloneDX 1.5 or SPDX 2.3 document. It is an inventory export, not a security attestation: it reads the lockfile only and never re-resolves, re-hashes, or touches the network.
ht lock export
ht lock export --format cyclonedx -o sbom.json
ht lock export --format spdx | jq '.packages | length'
ht lock export --timestamp 2024-06-01T00:00:00+00:00Missing lockfile fails closed. Diagnostics go to stderr so ht lock export | jq stays clean. Two runs with the same --timestamp are byte-identical.
This document is unsigned and does not claim SLSA.
Flags
| Flag | Default | Notes |
|---|---|---|
--format / -f | cyclonedx | CycloneDX 1.5 or SPDX 2.3 |
--output / -o | stdout | File write; stdout stays log-free |
--project | . | Project directory |
--global / -g | off | Reads ~/.harnesstap/apm.lock.yaml only if that file already exists |
--timestamp | SOURCE_DATE_EPOCH, then lock generated_at | Timezone-aware ISO 8601 for byte-identical reruns |
Identity and license
- Git:
pkg:github/owner/repo@sha(or host-appropriate purl) - Catalog:
pkg:generic/harnesstap/<name>@<version>— no fake OCI - Local:
pkg:generic/<name>@<content_hash> - Credentials (userinfo / query tokens) scrubbed from recorded URLs
declared_licensefrom dep manifestlicense:only (never LICENSE file text). Written by apply/install.- Undeclared: CycloneDX omits licenses; SPDX writes
NOASSERTION
Output is deterministic: components sorted by purl, pinned timestamp, stable key order.
See also: Lockfile, Command reference.