Critical Severity
Published: Oct 26, 2026

[GitHub] awarely-sbom-scanner

Rce
Type
N/A
CVSS Score
1
Views
Anonymous
Author

Description

Guided Linux and application SBOM scanner. Native Linux/npm/Python inventory, optional verified Syft for Java and more; CycloneDX export, CVE checks and source sync with Awarely Monitor.

# Awarely Scan — Linux SBOM Generator & Software Inventory

[![CI](https://github.com/awarelyeu/awarely-sbom-scanner/actions/workflows/ci.yml/badge.svg)](https://github.com/awarelyeu/awarely-sbom-scanner/actions/workflows/ci.yml)
[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)

Generate a local **CycloneDX SBOM** from application manifests or a focused selection of installed Debian/Ubuntu/Rocky Linux/AlmaLinux/Amazon Linux packages. Local collection runs without root, package installation, project scripts, telemetry or network access. Explicit `check` and `sync` commands communicate with Awarely Monitor over HTTPS.

Built for [Awarely Monitor](https://monitor.awarely.ro/en), with a standalone local workflow you can inspect and use independently.

**Stable release: v0.12.0 for Linux amd64 and arm64.** Local collection is independent of an account. Remote operations require Awarely Monitor Pro and a scoped machine credential created by an organization manager with MFA. The Jenkins integration is maintained in the dedicated [awarely-scan-plugin repository](https://github.com/jenkinsci/awarely-scan-plugin) with separate versions and verified releases.

| Workflow | Available |
| --- | --- |
| Guided Linux / npm / Python / Java setup | Yes, with input checks and optional verified Syft |
| Local SBOM file | Yes |
| CVE check through the Awarely API | Yes, without changing saved inventory |
| Inventory synchronization through the Awarely API | Yes, replaces one configured source |
| Verified CLI updates and local rollback | Yes; Syft follows the tested CLI release |
| Jenkins plugin using the same CLI | [Jenkins integration and walkthrough](https://github.com/jenkinsci/awarely-scan-plugin) |

## Complete walkthroughs

Follow the **[English guide](docs/how-to.md)** or **[ghidul în română](docs/how-to.ro.md)** for installation and release verification, account setup, MFA, source credentials, local upload, API check/sync, reports, aler

Community Rating
0

Login to rate this exploit

Quick Actions