# isabelleqywang/runtime-aware_sbom_generator architecture

> Architecture diagram of the GitHub repository isabelleqywang/runtime-aware_sbom_generator, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/isabelleqywang/runtime-aware_sbom_generator
- Repository: https://github.com/isabelleqywang/runtime-aware_sbom_generator

## Overview

This repository is a macOS shell tool for generating runtime-aware SBOMs. The user supplies a target program; the script combines package inventory from Syft, linked-library findings from otool, and—when enabled—runtime library observations from dtruss into a final SBOM. The README documents these capabilities and their relationships, but no source excerpts were available to verify implementation details or finer-grained control flow.

Main entry points: [`sbom-generator.sh`](https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh) (Generator script)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workflow["SBOM workflow"]
  node_generator["Generator script<br/>[sbom-generator.sh]"]
  node_combine["SBOM combination<br/>[sbom-generator.sh]"]
end

subgraph group_analysis["Dependency analysis"]
  node_package_scan["Package scan<br/>[sbom-generator.sh]"]
  node_syft["Syft"]
  node_linked_scan["Linked libraries<br/>[sbom-generator.sh]"]
  node_otool["otool"]
  node_runtime_trace["Runtime trace<br/>[sbom-generator.sh]"]
  node_dtruss["dtruss"]
end

subgraph group_results["SBOM results"]
  node_package_inventory["Package inventory"]
  node_static_dependencies["Static dependencies"]
  node_runtime_dependencies["Runtime dependencies"]
  node_final_sbom["Final SBOM"]
end

node_user(("User"))
node_target["Target program"]

node_user -->|"runs"| node_generator
node_user -->|"selects"| node_target
node_generator -->|"starts"| node_package_scan
node_package_scan -->|"scans packages"| node_syft
node_syft -->|"produces"| node_package_inventory
node_generator -->|"starts"| node_linked_scan
node_linked_scan -->|"finds links"| node_otool
node_otool -->|"inspects"| node_target
node_otool -->|"reports"| node_static_dependencies
node_generator -.->|"enables optionally"| node_runtime_trace
node_runtime_trace -.->|"traces"| node_dtruss
node_dtruss -.->|"watches"| node_target
node_dtruss -.->|"reports"| node_runtime_dependencies
node_generator -->|"combines findings"| node_combine
node_package_inventory -->|"provides packages"| node_combine
node_static_dependencies -->|"provides libraries"| node_combine
node_runtime_dependencies -.->|"provides libraries"| node_combine
node_combine -->|"writes"| node_final_sbom

click node_generator "https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh"
click node_package_scan "https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh"
click node_linked_scan "https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh"
click node_runtime_trace "https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh"
click node_combine "https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_generator,node_combine,node_user toneBlue
class node_package_scan,node_syft,node_linked_scan,node_otool,node_runtime_trace,node_dtruss toneAmber
class node_package_inventory,node_static_dependencies,node_runtime_dependencies,node_final_sbom toneMint
class node_target toneIndigo
```

## Components

### SBOM workflow

- [Generator script](https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh): `sbom-generator.sh`
- [SBOM combination](https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh): `sbom-generator.sh`

### Dependency analysis

- [Package scan](https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh): `sbom-generator.sh`
- **Syft**
- [Linked libraries](https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh): `sbom-generator.sh`
- **otool**
- [Runtime trace](https://github.com/isabelleqywang/runtime-aware_sbom_generator/blob/main/sbom-generator.sh): `sbom-generator.sh`
- **dtruss**

### SBOM results

- **Package inventory**
- **Static dependencies**
- **Runtime dependencies**
- **Final SBOM**

### Other components

- **User**
- **Target program**

## Connections

- User → Generator script: runs
- User → Target program: selects
- Generator script → Package scan: starts
- Package scan → Syft: scans packages
- Syft → Package inventory: produces
- Generator script → Linked libraries: starts
- Linked libraries → otool: finds links
- otool → Target program: inspects
- otool → Static dependencies: reports
- Generator script → Runtime trace: enables optionally
- Runtime trace → dtruss: traces
- dtruss → Target program: watches
- dtruss → Runtime dependencies: reports
- Generator script → SBOM combination: combines findings
- Package inventory → SBOM combination: provides packages
- Static dependencies → SBOM combination: provides libraries
- Runtime dependencies → SBOM combination: provides libraries
- SBOM combination → Final SBOM: writes