# hermetoproject/hermeto architecture

> Architecture diagram of the GitHub repository hermetoproject/hermeto, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hermetoproject/hermeto
- Repository: https://github.com/hermetoproject/hermeto

## Overview

Hermeto is a CLI for fetching pinned project dependencies into an offline build cache and producing SBOMs. Its documented workflow continues with environment-file generation and project-file injection before a network-isolated build; separately, it can merge SBOMs. The tree identifies these entry points and package-manager backends, but the sampled source is partial, so backend dispatch and some CLI wiring are not shown as detailed call chains.

Main entry points: [`hermeto/core/resolver.py`](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/resolver.py) (Fetch request), [`hermeto/core/models/sbom.py`](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/sbom.py) (SBOM components), [`hermeto/core/package_managers/gomod/main.py`](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/gomod/main.py) (Go modules), [`hermeto/core/package_managers/cargo/main.py`](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/cargo/main.py) (Cargo)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["CLI workflow"]
  node_cli["Hermeto CLI<br/>[cli.py]"]
end

subgraph group_orchestration["Request processing"]
  node_fetch["Fetch request<br/>[resolver.py]"]
  node_input["Request model<br/>[input.py]"]
  node_output["Request output<br/>[output.py]"]
  node_sbom["SBOM components<br/>[sbom.py]"]
end

subgraph group_backends["Package backends"]
  node_gomod["Go modules<br/>[main.py]"]
  node_cargo["Cargo<br/>[main.py]"]
  node_pip["Python pip<br/>[main.py]"]
  node_npm["npm<br/>[main.py]"]
  node_pnpm["pnpm<br/>[main.py]"]
  node_yarn["Yarn Berry<br/>[main.py]"]
  node_yarnclassic["Yarn Classic<br/>[main.py]"]
  node_bundler["Bundler<br/>[main.py]"]
  node_maven["Maven<br/>[main.py]"]
  node_rpm["RPM<br/>[main.py]"]
  node_generic["Generic URLs<br/>[main.py]"]
end

subgraph group_outputs["Build outputs"]
  node_cache[("Dependency cache")]
  node_env["Environment file<br/>[envfile.py]"]
  node_inject["Project file injection<br/>[general.py]"]
  node_merge["SBOM merge<br/>[sbom.py]"]
end

node_user(("Project user"))
node_registry(("Package registries"))
node_build(("Isolated container build"))

node_user -->|"runs commands"| node_cli
node_cli -->|"dispatches fetch"| node_fetch
node_fetch -->|"builds request"| node_input
node_fetch -->|"processes Go"| node_gomod
node_fetch -->|"processes Rust"| node_cargo
node_fetch -->|"processes Python"| node_pip
node_fetch -->|"processes npm"| node_npm
node_fetch -->|"processes pnpm"| node_pnpm
node_fetch -->|"processes Yarn"| node_yarn
node_fetch -->|"processes Yarn v1"| node_yarnclassic
node_fetch -->|"processes Ruby"| node_bundler
node_fetch -->|"processes Maven"| node_maven
node_fetch -->|"processes RPM"| node_rpm
node_fetch -->|"processes lockfile"| node_generic
node_gomod -->|"fetches modules"| node_registry
node_cargo -->|"fetches crates"| node_registry
node_pip -->|"fetches distributions"| node_registry
node_npm -->|"fetches packages"| node_registry
node_pnpm -->|"fetches packages"| node_registry
node_yarn -->|"fetches packages"| node_registry
node_yarnclassic -->|"fetches packages"| node_registry
node_bundler -->|"fetches gems"| node_registry
node_maven -->|"fetches artifacts"| node_registry
node_rpm -->|"fetches packages"| node_registry
node_generic -->|"fetches URLs"| node_registry
node_gomod -->|"writes dependencies"| node_cache
node_cargo -->|"writes dependencies"| node_cache
node_pip -->|"writes dependencies"| node_cache
node_npm -->|"writes dependencies"| node_cache
node_pnpm -->|"writes dependencies"| node_cache
node_yarn -->|"writes dependencies"| node_cache
node_yarnclassic -->|"writes dependencies"| node_cache
node_bundler -->|"writes dependencies"| node_cache
node_maven -->|"writes dependencies"| node_cache
node_rpm -->|"writes dependencies"| node_cache
node_generic -->|"writes dependencies"| node_cache
node_gomod -->|"creates components"| node_sbom
node_cargo -->|"creates components"| node_sbom
node_pip -->|"creates components"| node_sbom
node_npm -->|"creates components"| node_sbom
node_pnpm -->|"creates components"| node_sbom
node_yarn -->|"creates components"| node_sbom
node_yarnclassic -->|"creates components"| node_sbom
node_bundler -->|"creates components"| node_sbom
node_maven -->|"creates components"| node_sbom
node_rpm -->|"creates components"| node_sbom
node_generic -->|"creates components"| node_sbom
node_fetch -->|"returns results"| node_output

click node_cli "https://github.com/hermetoproject/hermeto/blob/main/hermeto/interface/cli.py"
click node_fetch "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/resolver.py"
click node_input "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/input.py"
click node_output "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/output.py"
click node_sbom "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/sbom.py"
click node_gomod "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/gomod/main.py"
click node_cargo "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/cargo/main.py"
click node_pip "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/python/pip/main.py"
click node_npm "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/npm/main.py"
click node_pnpm "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/pnpm/main.py"
click node_yarn "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/yarn/main.py"
click node_yarnclassic "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/yarn_classic/main.py"
click node_bundler "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/bundler/main.py"
click node_maven "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/maven/main.py"
click node_rpm "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/rpm/main.py"
click node_generic "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/generic/main.py"
click node_env "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/extras/envfile.py"
click node_inject "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/general.py"
click node_merge "https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/sbom.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_user toneBlue
class node_fetch,node_input,node_output,node_sbom toneAmber
class node_gomod,node_cargo,node_pip,node_npm,node_pnpm,node_yarn,node_yarnclassic,node_bundler,node_maven,node_rpm,node_generic toneMint
class node_cache,node_env,node_inject,node_merge toneRose
class node_registry,node_build toneIndigo
```

## Components

### CLI workflow

- [Hermeto CLI](https://github.com/hermetoproject/hermeto/blob/main/hermeto/interface/cli.py): `hermeto/interface/cli.py`

### Request processing

- [Fetch request](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/resolver.py): `hermeto/core/resolver.py`
- [Request model](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/input.py): `hermeto/core/models/input.py`
- [Request output](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/output.py): `hermeto/core/models/output.py`
- [SBOM components](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/sbom.py): `hermeto/core/models/sbom.py`

### Package backends

- [Go modules](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/gomod/main.py): `hermeto/core/package_managers/gomod/main.py`
- [Cargo](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/cargo/main.py): `hermeto/core/package_managers/cargo/main.py`
- [Python pip](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/python/pip/main.py): `hermeto/core/package_managers/python/pip/main.py`
- [npm](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/npm/main.py): `hermeto/core/package_managers/javascript/npm/main.py`
- [pnpm](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/pnpm/main.py): `hermeto/core/package_managers/javascript/pnpm/main.py`
- [Yarn Berry](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/yarn/main.py): `hermeto/core/package_managers/javascript/yarn/main.py`
- [Yarn Classic](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/javascript/yarn_classic/main.py): `hermeto/core/package_managers/javascript/yarn_classic/main.py`
- [Bundler](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/bundler/main.py): `hermeto/core/package_managers/bundler/main.py`
- [Maven](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/maven/main.py): `hermeto/core/package_managers/maven/main.py`
- [RPM](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/rpm/main.py): `hermeto/core/package_managers/rpm/main.py`
- [Generic URLs](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/generic/main.py): `hermeto/core/package_managers/generic/main.py`

### Build outputs

- **Dependency cache**
- [Environment file](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/extras/envfile.py): `hermeto/core/extras/envfile.py`
- [Project file injection](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/package_managers/general.py): `hermeto/core/package_managers/general.py`
- [SBOM merge](https://github.com/hermetoproject/hermeto/blob/main/hermeto/core/models/sbom.py): `hermeto/core/models/sbom.py`

### Other components

- **Project user**
- **Package registries**
- **Isolated container build**

## Connections

- Project user → Hermeto CLI: runs commands
- Hermeto CLI → Fetch request: dispatches fetch
- Fetch request → Request model: builds request
- Fetch request → Go modules: processes Go
- Fetch request → Cargo: processes Rust
- Fetch request → Python pip: processes Python
- Fetch request → npm: processes npm
- Fetch request → pnpm: processes pnpm
- Fetch request → Yarn Berry: processes Yarn
- Fetch request → Yarn Classic: processes Yarn v1
- Fetch request → Bundler: processes Ruby
- Fetch request → Maven: processes Maven
- Fetch request → RPM: processes RPM
- Fetch request → Generic URLs: processes lockfile
- Go modules → Package registries: fetches modules
- Cargo → Package registries: fetches crates
- Python pip → Package registries: fetches distributions
- npm → Package registries: fetches packages
- pnpm → Package registries: fetches packages
- Yarn Berry → Package registries: fetches packages
- Yarn Classic → Package registries: fetches packages
- Bundler → Package registries: fetches gems
- Maven → Package registries: fetches artifacts
- RPM → Package registries: fetches packages
- Generic URLs → Package registries: fetches URLs
- Go modules → Dependency cache: writes dependencies
- Cargo → Dependency cache: writes dependencies
- Python pip → Dependency cache: writes dependencies
- npm → Dependency cache: writes dependencies
- pnpm → Dependency cache: writes dependencies
- Yarn Berry → Dependency cache: writes dependencies
- Yarn Classic → Dependency cache: writes dependencies
- Bundler → Dependency cache: writes dependencies
- Maven → Dependency cache: writes dependencies
- RPM → Dependency cache: writes dependencies
- Generic URLs → Dependency cache: writes dependencies
- Go modules → SBOM components: creates components
- Cargo → SBOM components: creates components
- Python pip → SBOM components: creates components
- npm → SBOM components: creates components
- pnpm → SBOM components: creates components
- Yarn Berry → SBOM components: creates components
- Yarn Classic → SBOM components: creates components
- Bundler → SBOM components: creates components
- Maven → SBOM components: creates components
- RPM → SBOM components: creates components
- Generic URLs → SBOM components: creates components
- Fetch request → Request output: returns results