What Programming Languages and Package Managers Does Trivy Support for SBOM Generation?

Trivy generates Software Bill of Materials (SBOM) for 13 programming languages—including Ruby, Python, Java, Go, and Rust—by scanning native package manager lock files, manifests, and binary metadata to produce CycloneDX or SPDX documents.

Trivy, the open-source security scanner from Aqua Security, automates SBOM creation by mapping each programming language to its specific dependency descriptors. The tool references the matrix defined in docs/guide/coverage/language/index.md to identify relevant artifacts, then encodes the discovered components into standard formats using the logic in pkg/sbom/io/encode.go.

Supported Programming Languages and Package Managers

Trivy detects dependencies by scanning language-specific package manager descriptors. The complete coverage matrix, maintained in docs/guide/coverage/language/index.md, includes the following ecosystems:

• Ruby — Analyzes Gemfile.lock for library projects and *.gemspec for packaged binaries.
• Python — Scans Pipfile.lock, poetry.lock, uv.lock, requirements.txt, *.egg, and *.whl artifacts.
• PHP — Processes composer.lock and installed.json from Composer installations.
• Node.js — Reads package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock, and package.json.
• .NET — Detects packages.lock.json, packages.config, *.deps.json, and *.props files.
• Java — Supports Maven and Gradle through pom.xml, *.gradle.lockfile, *.sbt.lock, and archive formats (*.jar, *.war, *.par, *.ear).
• Go — Extracts module information from compiled Go binaries and go.mod files.
• Rust — Parses Cargo.lock and optionally Cargo.toml for binary analysis.
• C/C++ — Identifies dependencies via conan.lock for Conan-managed projects.
• Elixir — Reads mix.lock for Mix/Hex dependencies.
• Dart — Processes pubspec.lock for Pub packages.
• Swift — Analyzes Podfile.lock and Package.resolved for CocoaPods and Swift Package Manager.
• Julia — Scans Manifest.toml for Julia environments.

How Trivy Generates SBOMs

The SBOM generation pipeline abstracts descriptor-based logic across all scan targets, including container images, root filesystems, local directories, and source repositories. When you invoke the --format flag (e.g., cyclonedx or spdx-json), Trivy performs three operations:

1. Discovery — Recursively scans the target for the package manager descriptors listed above.
2. Graph Construction — Builds a dependency graph from the parsed lock files and manifests.
3. Encoding — Serializes the internal model to the requested standard via pkg/sbom/io/encode.go.

The CLI entry point in cmd/trivy/main.go wires the format flags to this encoder, while pkg/sbom/io/decode.go provides support for parsing existing SBOM files during rescan operations.

SBOM Generation Command Examples

Use the following commands to generate SBOMs for different project types and container images:

# Generate a CycloneDX SBOM for a Python project directory

trivy fs --format cyclonedx --output python-sbom.json /path/to/python/project

# Generate an SPDX SBOM for a Node.js project directory

trivy fs --format spdx-json --output node-sbom.spdx.json /path/to/nodejs/project

# Create a CycloneDX SBOM for a Docker image containing a Go binary

trivy image --format cyclonedx --output go-image-sbom.json myrepo/go-app:latest

# Produce an SPDX SBOM for a Maven-based Java repository

trivy repo --format spdx-json --output java-sbom.spdx.json /path/to/java/repo

Summary

• Trivy supports 13 programming languages for SBOM generation, from mainstream stacks like Node.js and Python to specialized ecosystems like Julia and Elixir.
• Detection relies on native package manager descriptors defined in docs/guide/coverage/language/index.md, including lock files, manifests, and embedded binary metadata.
• The tool outputs CycloneDX and SPDX formats through the encoder implemented in pkg/sbom/io/encode.go.
• SBOM generation works uniformly across containers, filesystems, and repositories using the same descriptor-based abstraction layer.

Frequently Asked Questions

Does Trivy support SBOM generation for compiled binaries without source code?

Yes. Trivy extracts dependency metadata from compiled artifacts when they embed module information, such as Go binaries (containing go.mod data), Ruby *.gemspec files, and Java archives (*.jar, *.war), as documented in the language coverage matrix at docs/guide/coverage/language/index.md.

What SBOM formats does Trivy output?

Trivy generates CycloneDX (--format cyclonedx) and SPDX (--format spdx-json) compliant documents. The encoding implementation in pkg/sbom/io/encode.go ensures the internal dependency graph is serialized according to these standards.

Can Trivy generate a single SBOM for container images with multiple languages?

Yes. When scanning container images with trivy image, the tool recursively analyzes all layers to detect package manager descriptors for every supported language present in the image. It aggregates all discovered dependencies into a unified SBOM output.

How does Trivy handle projects without lock files?

Trivy falls back to manifest files (e.g., package.json, Cargo.toml) or binary metadata when lock files are absent, though lock files are preferred for deterministic resolution. The specific detection priority is defined per-language in the coverage documentation at docs/guide/coverage/language/index.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}