Air-Gapped Environments

lynkctl can generate SBOMs without network access. The only component that normally needs the network is the OSS-index database used for vendored open-source identification. Pre-fetch it on a connected machine, then point lynkctl at the local copy.

---

Step 1 — Fetch the Database on a Connected Machine

lynkctl db download

Find where it was stored:

lynkctl db path

Step 2 — Transfer the Database

Copy the oss-index.db file to the air-gapped environment by whatever transfer mechanism you use — removable media, an internal artifact store, a base container image:

DB=$(lynkctl db path)
cp "$DB" /transfer/oss-index.db

Step 3 — Run lynkctl Against the Local Database

Pass the database path explicitly with --oss-index-db:

lynkctl generate . --oss-index-db /opt/oss-index.db -o sbom.cdx.json

Verifying the Database

db info inspects a cached database without touching the network — format version, build date, sha256, size, and index statistics:

lynkctl db info

Generating Without Vendored Identification

If you do not need vendored open-source identification at all, skip the database entirely with --no-oss-index:

lynkctl generate . --no-oss-index -o sbom.cdx.json

This drops the OSS-index enrichment step; build-system analysis and other enrichment still run.

Related

• OSS-Index Database — full db subcommand reference

• Running in CI/CD — air-gapped runners