Linux workstation

Fedora 44 native package

bomtool

Simple SBOM generator using pc(5) files

Packages / Fedora 44 / Unspecified / bomtool

[Source: pkgconf]

Package: bomtool

External Resources:

Homepage: [pkgconf.org]

Similar packages:

Simple SBOM generator using pc(5) files

bomtool is a program which helps generate a Software Bill of Materials manifest using data from installed .pc files.

No published records match this suite and architecture filter.

Package file paths (7)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

  • /usr/bin/bomtool
  • /usr/lib/.build-id
  • /usr/lib/.build-id/18
  • /usr/lib/.build-id/18/44f7640a03d7c73af7afe91d78ac5fc81d40bc
  • /usr/lib/.build-id/bd
  • /usr/lib/.build-id/bd/a326369b7d92e47ce1859addec184e3430f8e9
  • /usr/share/man/man1/bomtool.1.gz

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Fedora 44 in the browserBuild an image that includes bomtool

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

No published records match this suite and architecture filter.

Checksums and observation dates

For an APT source, signature verification authenticates the repository metadata chain and the Packages index containing this source-reported artifact digest. It does not certify package safety.

Catalog record completeness

The completeness score measures metadata coverage, not software quality, security, compatibility, or suitability.

Summary and description
25/25
Artifact path and source digest
25/25
Dependency metadata
15/15
Package-file index
15/15
Homepage
5/5
License text
5/5
Source package or maintainer
10/10

Recorded total: 100/100

Field source: Fedora 44 Everything aarch64 revision 44-everything-aarch64:ad124f8125666e9059d7a8180427bdaea80f6286f71140457e5c7edd95883eee, Fedora 44 Everything x86_64 revision 44-everything-x86_64:da3845427d188097f6fd71b417a039bdfb8efefc4f38ca44b5cbb94f95a18991. The cross-OS mapping is catalog-derived from the source-reported homepage; it does not establish authorship or publisher identity

Sources and provenance

Field-source links above resolve here. Each source entry names the metadata publisher, trust tier, exact snapshot revision, signature result, and observation time; catalog-derived mappings are labeled separately.

  • Fedora 44 Everything aarch64Sep 1, 2026

    Authoritative source; repository metadata signature verified, revision 44-everything-aarch64:ad124f8125666e9059d7a8180427bdaea80f6286f71140457e5c7edd95883eee

    Signature verification covers the configured repository metadata chain. It does not certify that the package is safe or suitable.

    Repository-signature verification record
    Signed-object SHA-256
    236514c32119ab3c85b81fbb9e5e9d92b07aeba0d19d64c9b4fc9117a1863769
    Signer fingerprint
    Not recorded
    Keyring revision
    RPM-GPG-KEY-fedora-44-primary
    SHA-256 93642aec521a1e5e96dd715f7ae0ec0850ebc9de09a94ce03cae5263f26cc18a
    Tool and policy
    1
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Signed Release → package-index hash linkage

    Path: Not recorded
    Expected SHA-256: Not recorded
    Observed SHA-256: Not recorded
    Result: match verified

  • Fedora 44 Everything x86_64Sep 1, 2026

    Authoritative source; repository metadata signature verified, revision 44-everything-x86_64:da3845427d188097f6fd71b417a039bdfb8efefc4f38ca44b5cbb94f95a18991

    Signature verification covers the configured repository metadata chain. It does not certify that the package is safe or suitable.

    Repository-signature verification record
    Signed-object SHA-256
    1300b99ac5d04b5561ad901320c8bd59ed1553f4971c3ce2ca48c40242c66676
    Signer fingerprint
    Not recorded
    Keyring revision
    RPM-GPG-KEY-fedora-44-primary
    SHA-256 93642aec521a1e5e96dd715f7ae0ec0850ebc9de09a94ce03cae5263f26cc18a
    Tool and policy
    1
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Signed Release → package-index hash linkage

    Path: Not recorded
    Expected SHA-256: Not recorded
    Observed SHA-256: Not recorded
    Result: match verified