Troubleshooting SBOM Export

When an SBOM export does not look right, the cause is usually simple: the command ran in the wrong place, dependencies were not resolved, or the wrong format or output path was used. This guide walks through the common issues and their fixes. It is written for developers debugging their SBOM generation.

Start with a known-good command

Always begin from the project root with explicit flags so behavior is predictable:

vg sbom export --format cyclonedx --out sbom.cdx.json

If this works, you can layer in CI or monorepo specifics afterward.

Problem: empty or very small component list

The most common cause is that dependencies are not installed or resolved, so there is little for Vibgrate to inventory.

• Confirm you ran the command from the directory containing your lockfile or manifest.
• Install/resolve dependencies first (for example via your package manager) so a lockfile exists and packages are present.
• In a monorepo, run from the package directory or the workspace root depending on the scope you want.

Problem: missing licenses for many components

License data is read from package metadata. If dependencies are not fully installed, that metadata may be unavailable.

• Ensure a complete install before exporting.
• Treat genuinely undeclared licenses as items to investigate, not as benign.

Problem: output file not where you expected

The --out value is a file path relative to where you run the command.

• Pass an explicit path, for example --out sbom.cdx.json, and check that directory after the run.
• In CI, make sure the export runs before any step that uploads or references the file.

Problem: a tool cannot read the file

This is usually a format mismatch.

• Confirm --format matches what the consumer expects (cyclonedx or spdx).
• If a consumer needs both, export each separately:

vg sbom export --format cyclonedx --out sbom.cdx.json
vg sbom export --format spdx --out sbom.spdx.json

Problem: results differ between runs

Non-deterministic dependency resolution leads to different SBOMs.

• Use lockfiles and a deterministic install so the dependency set is stable.
• Always specify --format and --out rather than relying on defaults in automation.

Trying without installing

If you suspect a local install issue, run the no-install form to compare:

npx @vibgrate/cli sbom export --format cyclonedx --out sbom.cdx.json

Tips

• Reproduce locally with the known-good command before debugging CI.
• Check the component count as a fast sanity signal.
• Keep dependency installation and SBOM export in the same job so they share state.

Related

• "Export a CycloneDX SBOM with Vibgrate CLI" for the baseline workflow.
• "Reading and Understanding Vibgrate SBOM Output" to verify the result.
• See the vg sbom command documentation for all options.