Installation

Bomly ships as a release binary, package-manager entry, and Linux package. Pick the method that matches how you normally manage developer tools.

Quick install

macOS / Linuxbrew

brew install bomly-dev/tap/bomly
bomly version

Linux / macOS script

curl -fsSL https://bomly.dev/install.sh | sh
bomly version

Windows

winget install Bomly.BomlyCLI
bomly version

If you're ready to scan, jump to Getting Started.

Install methods

Homebrew

Homebrew is the preferred macOS path and also works for Linuxbrew users:

brew install bomly-dev/tap/bomly

Upgrade and uninstall:

brew upgrade bomly
brew uninstall bomly

WinGet

WinGet is the preferred Windows package-manager path:

winget install Bomly.BomlyCLI

Upgrade and uninstall:

winget upgrade Bomly.BomlyCLI
winget uninstall Bomly.BomlyCLI

Scoop

Scoop is a good fit for Windows developers who already manage CLI tools with buckets:

scoop bucket add bomly https://github.com/bomly-dev/scoop-bucket
scoop install bomly

Upgrade and uninstall:

scoop update bomly
scoop uninstall bomly

Install scripts

The install scripts download a GitHub Release archive, verify it against SHA256SUMS, and place bomly on your PATH.

Linux / macOS:

curl -fsSL https://bomly.dev/install.sh | sh

Windows PowerShell:

irm https://bomly.dev/install.ps1 | iex

Pin a version or install the lite binary:

curl -fsSL https://bomly.dev/install.sh | BOMLY_VERSION=v0.20.2 sh
curl -fsSL https://bomly.dev/install.sh | BOMLY_BINARY=bomly-lite sh

$env:BOMLY_VERSION = "v0.20.2"; irm https://bomly.dev/install.ps1 | iex
$env:BOMLY_BINARY = "bomly-lite"; irm https://bomly.dev/install.ps1 | iex

By default, Unix installs to /usr/local/bin. Set BOMLY_INSTALL_DIR to choose another directory. Windows installs to %LOCALAPPDATA%\Bomly\bin and adds that directory to the user PATH.

Linux packages

Each release publishes native package artifacts for Linux amd64 and arm64:

• .deb for Debian and Ubuntu families.
• .rpm for Fedora, RHEL, Rocky, AlmaLinux, and SUSE families.
• .apk for Alpine.
• Arch Linux package artifacts for users who prefer pacman-compatible local packages.

Examples:

sudo dpkg -i bomly_VERSION_linux_amd64.deb
sudo rpm -i bomly_VERSION_linux_amd64.rpm
sudo apk add --allow-untrusted bomly_VERSION_linux_amd64.apk
sudo pacman -U bomly_VERSION_linux_amd64.pkg.tar.zst

Use your package manager's normal remove command to uninstall, for example sudo apt remove bomly or sudo rpm -e bomly.

GitHub Releases

GitHub Releases remain the canonical distribution point for all release artifacts. Each release publishes:

• bomly archives for Linux, macOS, and Windows.
• bomly-lite archives for users who prefer external syft and grype binaries on PATH.
• Linux .deb, .rpm, .apk, and Arch package artifacts.
• SHA256SUMS for checksum verification.

Archive naming:

• bomly_<version>_<os>_<arch>.tar.gz
• bomly-lite_<version>_<os>_<arch>.tar.gz
• Windows archives use .zip.

Manual Linux / macOS install:

curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/bomly_0.20.2_linux_amd64.tar.gz
curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/SHA256SUMS
sha256sum --check SHA256SUMS --ignore-missing
tar -xzf bomly_0.20.2_linux_amd64.tar.gz
sudo install -m 0755 bomly /usr/local/bin/

Manual Windows install:

$archive = "bomly_0.20.2_windows_amd64.zip"
Invoke-WebRequest -Uri "https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/$archive" -OutFile $archive
Invoke-WebRequest -Uri "https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/SHA256SUMS" -OutFile SHA256SUMS
Get-FileHash .\$archive -Algorithm SHA256
Expand-Archive -Path $archive -DestinationPath .
# Move bomly.exe somewhere on your PATH.

Each archive also contains LICENSE, NOTICE, and a licenses/ directory with third-party license text.

go install

Use this path if you already have Go on PATH:

go install github.com/bomly-dev/bomly-cli/cmd/bomly@latest

go install builds the full Bomly binary with builtin Syft and Grype support. It does not install bomly-lite.

bomly vs bomly-lite

Most users want bomly. Pick bomly-lite only if you already manage syft and grype across your fleet.

If you choose bomly-lite, install Syft and Grype with Anchore's official scripts:

curl -sSfL https://get.anchore.io/syft  | sh -s -- -b /usr/local/bin
curl -sSfL https://get.anchore.io/grype | sh -s -- -b /usr/local/bin

Verify release checksums

Releases include SHA256SUMS alongside every archive and package. The commands below use v0.20.2 and one archive per platform — substitute the release and artifact you are verifying, and download both the archive and the checksum file first.

Linux (GNU coreutils):

curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/bomly_0.20.2_linux_amd64.tar.gz
curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/SHA256SUMS
sha256sum --check SHA256SUMS --ignore-missing

macOS (the system shasum; select the artifact's line first):

curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/bomly_0.20.2_darwin_arm64.tar.gz
curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/SHA256SUMS
grep " bomly_0.20.2_darwin_arm64.tar.gz$" SHA256SUMS | shasum -a 256 -c

Either way, each verified archive prints one OK line and the command exits 0:

bomly_0.20.2_darwin_arm64.tar.gz: OK

PowerShell:

Get-FileHash .\bomly_0.20.2_windows_amd64.zip -Algorithm SHA256
# Compare the printed hash against the matching line in SHA256SUMS.

Verify the signature

SHA256SUMS is itself signed keylessly with cosign, tying the release to the exact GitHub Actions workflow run that built it:

curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/SHA256SUMS.sigstore.json
cosign verify-blob \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp "^https://github.com/bomly-dev/bomly-cli/.github/workflows/release.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS

A valid signature prints exactly:

Verified OK

Verify SLSA provenance

Each release also publishes a single multiple.intoto.jsonl SLSA Build Level 3 provenance file covering every release artifact, attesting which source commit and workflow produced them:

curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/bomly_0.20.2_linux_amd64.tar.gz
curl -L -O https://github.com/bomly-dev/bomly-cli/releases/download/v0.20.2/multiple.intoto.jsonl
slsa-verifier verify-artifact bomly_0.20.2_linux_amd64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/bomly-dev/bomly-cli \
  --source-tag v0.20.2

slsa-verifier is available from the slsa-framework/slsa-verifier releases.

CI installation

For pinned CI recipes, see CI integration. Prefer a package-manager install when your CI environment supports it. If you download archives directly, pin a specific tag rather than latest.

Upgrading

Use the package manager that installed Bomly:

• Homebrew: brew upgrade bomly
• WinGet: winget upgrade Bomly.BomlyCLI
• Scoop: scoop update bomly
• Linux packages: install the newer package artifact with your system package manager.
• Go: re-run go install github.com/bomly-dev/bomly-cli/cmd/bomly@latest.
• Install script: re-run the same script, optionally with BOMLY_VERSION.

Check the current version before and after:

bomly version

Uninstall

Use the package manager that installed Bomly. For manual archive or install-script installs, remove the binary from its install directory:

rm "$(command -v bomly)"

Bomly does not write configuration or cache state during install. To also clear runtime state:

rm -rf ~/.bomly

Remove-Item -Recurse $env:USERPROFILE\.bomly

Next

• Getting Started - run your first scan in five minutes.
• CI integration - drop-in recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, CircleCI.
• Plugins - install and enable external detectors, matchers, and auditors.