How isabelleqywang/runtime-aware_sbom_generator works
This repository is a macOS shell tool for generating runtime-aware SBOMs. The user supplies a target program; the script combines package inventory from Syft, linked-library findings from otool, and—when enabled—runtime library observations from dtruss into a final SBOM. The README documents these capabilities and their relationships, but no source excerpts were available to verify implementation details or finer-grained control flow.
Main entry points: sbom-generator.sh Generator script
Components 14
SBOM workflow
- Generator script
sbom-generator.sh - SBOM combination
sbom-generator.sh
Dependency analysis
- Package scan
sbom-generator.sh - Syft
- Linked libraries
sbom-generator.sh - otool
- Runtime trace
sbom-generator.sh - dtruss
SBOM results
- Package inventory
- Static dependencies
- Runtime dependencies
- Final SBOM
Other components
- User
- Target program
Connections 18
- User → Generator script: runs
- User → Target program: selects
- Generator script → Package scan: starts
- Package scan → Syft: scans packages
- Syft → Package inventory: produces
- Generator script → Linked libraries: starts
- Linked libraries → otool: finds links
- otool → Target program: inspects
- otool → Static dependencies: reports
- Generator script → Runtime trace: enables optionally
- Runtime trace → dtruss: traces
- dtruss → Target program: watches
- dtruss → Runtime dependencies: reports
- Generator script → SBOM combination: combines findings
- Package inventory → SBOM combination: provides packages
- Static dependencies → SBOM combination: provides libraries
- Runtime dependencies → SBOM combination: provides libraries
- SBOM combination → Final SBOM: writes