How hermetoproject/hermeto works
Hermeto is a CLI for fetching pinned project dependencies into an offline build cache and producing SBOMs. Its documented workflow continues with environment-file generation and project-file injection before a network-isolated build; separately, it can merge SBOMs. The tree identifies these entry points and package-manager backends, but the sampled source is partial, so backend dispatch and some CLI wiring are not shown as detailed call chains.
Main entry points: resolver.py Fetch request · sbom.py SBOM components · gomod/main.py Go modules · cargo/main.py Cargo
Components 23
CLI workflow
- Hermeto CLI
hermeto/interface/cli.py
Request processing
- Fetch request
hermeto/core/resolver.py - Request model
hermeto/core/models/input.py - Request output
hermeto/core/models/output.py - SBOM components
hermeto/core/models/sbom.py
Package backends
- Go modules
hermeto/core/package_managers/gomod/main.py - Cargo
hermeto/core/package_managers/cargo/main.py - Python pip
hermeto/core/package_managers/python/pip/main.py - npm
hermeto/core/package_managers/javascript/npm/main.py - pnpm
hermeto/core/package_managers/javascript/pnpm/main.py - Yarn Berry
hermeto/core/package_managers/javascript/yarn/main.py - Yarn Classic
hermeto/core/package_managers/javascript/yarn_classic/main.py - Bundler
hermeto/core/package_managers/bundler/main.py - Maven
hermeto/core/package_managers/maven/main.py - RPM
hermeto/core/package_managers/rpm/main.py - Generic URLs
hermeto/core/package_managers/generic/main.py
Build outputs
- Dependency cache
- Environment file
hermeto/core/extras/envfile.py - Project file injection
hermeto/core/package_managers/general.py - SBOM merge
hermeto/core/models/sbom.py
Other components
- Project user
- Package registries
- Isolated container build
Connections 48
- Project user → Hermeto CLI: runs commands
- Hermeto CLI → Fetch request: dispatches fetch
- Fetch request → Request model: builds request
- Fetch request → Go modules: processes Go
- Fetch request → Cargo: processes Rust
- Fetch request → Python pip: processes Python
- Fetch request → npm: processes npm
- Fetch request → pnpm: processes pnpm
- Fetch request → Yarn Berry: processes Yarn
- Fetch request → Yarn Classic: processes Yarn v1
- Fetch request → Bundler: processes Ruby
- Fetch request → Maven: processes Maven
- Fetch request → RPM: processes RPM
- Fetch request → Generic URLs: processes lockfile
- Go modules → Package registries: fetches modules
- Cargo → Package registries: fetches crates
- Python pip → Package registries: fetches distributions
- npm → Package registries: fetches packages
- pnpm → Package registries: fetches packages
- Yarn Berry → Package registries: fetches packages
- Yarn Classic → Package registries: fetches packages
- Bundler → Package registries: fetches gems
- Maven → Package registries: fetches artifacts
- RPM → Package registries: fetches packages
- Generic URLs → Package registries: fetches URLs
- Go modules → Dependency cache: writes dependencies
- Cargo → Dependency cache: writes dependencies
- Python pip → Dependency cache: writes dependencies
- npm → Dependency cache: writes dependencies
- pnpm → Dependency cache: writes dependencies
- Yarn Berry → Dependency cache: writes dependencies
- Yarn Classic → Dependency cache: writes dependencies
- Bundler → Dependency cache: writes dependencies
- Maven → Dependency cache: writes dependencies
- RPM → Dependency cache: writes dependencies
- Generic URLs → Dependency cache: writes dependencies
- Go modules → SBOM components: creates components
- Cargo → SBOM components: creates components
- Python pip → SBOM components: creates components
- npm → SBOM components: creates components
- pnpm → SBOM components: creates components
- Yarn Berry → SBOM components: creates components
- Yarn Classic → SBOM components: creates components
- Bundler → SBOM components: creates components
- Maven → SBOM components: creates components
- RPM → SBOM components: creates components
- Generic URLs → SBOM components: creates components
- Fetch request → Request output: returns results