devradarctl

devradarctl

CLI for the DevRadar service. It hides the by-digest / all-layers / base64 mechanics of getting an SBOM into DevRadar behind two commands:

• devradarctl sbom — generate an all-layers CycloneDX SBOM for a container image.
• devradarctl submit — submit an SBOM (from a file, or generated from an image).

Install

go install github.com/thingzio/devradarctl@latest

Or download a release archive from the releases page.

Prerequisites

• syft on PATH (or pass --syft-path) — used to generate SBOMs. Only required for the sbom command and submit --image.
• Image digest resolution is done in-process (no crane needed) and uses your ambient Docker credentials (docker login, credential helpers).

Usage

Generate an SBOM

# Print to stdout
devradarctl sbom --image alpine:3.20

# Write to a file
devradarctl sbom --image alpine:3.20 --output alpine.cdx.json

The image is pinned to its manifest digest (repo@sha256:…) before syft runs, so the SBOM carries the digest DevRadar uses to identify the image unambiguously.

Submit an SBOM

The API token is read from DEVRADAR_TOKEN, or piped via stdin.

# From an existing SBOM file
DEVRADAR_TOKEN=xxx devradarctl submit --file alpine.cdx.json --image-ref alpine@sha256:…

# From an image (resolve digest, generate, submit — one step)
echo "$DEVRADAR_TOKEN" | devradarctl submit --image alpine:3.20 --group team-x --group prod

Configuration

Development

make build     # build ./bin/devradarctl
make test      # unit tests (race + coverage)
make lint      # go vet + golangci-lint
make snapshot  # local goreleaser snapshot build

License

MIT — see LICENSE.