nsx sbom

Read nsx.lock and emit a single-document SBOM describing every vendored module by upstream URL, commit SHA, and content hash.

Usage

nsx sbom [-h] [--app-dir APP_DIR] [--format {spdx,cyclonedx}]
                [--output FILE]

Options

Options for nsx sbom

Option	Value	Default	Description
--app-dir APP_DIR	value	.	App directory containing nsx.lock
--format FORMAT	spdx | cyclonedx	spdx	SBOM format (default: spdx — SPDX 2.3 JSON)
--output, -o FILE	value	optional	Write SBOM to FILE instead of stdout

Notes

The SBOM is generated from the app’s nsx.lock. It lists every vendored module by name with its upstream URL, locked commit SHA and content hash, so downstream tools (audits, vulnerability scanners, reproducibility checks) can verify exactly what an nsx sync of the lock would materialize.

# SPDX 2.3 to stdout
nsx sbom

# CycloneDX 1.5 to disk
nsx sbom --format cyclonedx --output bom.json

For each module in nsx.lock the SBOM records the upstream URL and commit SHA (for git and unresolved kinds), the locked content_hash (always, as a SHA-256 checksum), and the resolution kind, registry project key, requested constraint and matched tag as package-level annotations. It also records the neuralspotx tool version that produced the lock. These fields expose explicit development overrides: branch refs retain both the requested ref and the resolved commit, while local projects are identified by their local kind and exact content hash.

License metadata is not carried in the lock or in nsx-module.yaml, so every package is emitted with NOASSERTION (SPDX) or with no licenses array (CycloneDX).

The same payload is available from Python:

from neuralspotx import generate_sbom

doc = generate_sbom("/path/to/app", format="spdx")

generate_sbom returns the JSON document as a string. It raises NSXConfigError if nsx.lock is missing or if format is not spdx or cyclonedx.

-v/--verbose, -q/--quiet are parsed by nsx itself, so they go before the command name, as nsx -v sbom.