AIROM is a single static binary — CGO_ENABLED=0, no runtime dependencies, no shared libraries to chase.
AIROM is at v0.3.6 — the AI-native risk overlay, a default-on CVE overlay (OSV.dev), a default-on model lifecycle overlay, compliance framework mapping, test-scope filtering, and a signed rule-update channel that now carries lifecycle catalogs too, plus SPDX 3.0.1 and OpenVEX export. Early but real; expect rough edges. The airom command is on PyPI, and cosign-signed static binaries for every supported platform ship on the releases page with each tagged release. A Homebrew tap is planned.

​
pip

The easiest path — no Go toolchain required. The wheel bundles the static airom binary and installs the Python SDK, so one command gives you both the CLI and import airom. Requires Python 3.10 or newer.
Install the CLI + SDK
Prefer an isolated install that is always on your PATH? Use pipx:
Isolated install
pip places airom on your PATH automatically inside an active virtualenv; pipx does so globally. Then airom --version works from any directory. Wheels are published for macOS (Intel + Apple Silicon), Linux (x86-64 + arm64, glibc + musl), and Windows (x86-64).

​
go install

Requires Go 1.25 or newer — reach for this if you already have a Go toolchain.
Install
@latest resolves to the newest release tag (v0.3.6 today).

​
Put it on your PATH

This is the single most common installation problem, so handle it up front. go install places the binary in $(go env GOPATH)/bin. If that directory is not on your PATH, running airom gives you command not found — the install succeeded, your shell just cannot see it. Check where it went:
Find the install directory
Then add bin under that path to your shell profile:
If you have set GOBIN, the binary goes there instead of $(go env GOPATH)/bin. Check with go env GOBIN and put that directory on your PATH.

​
Prebuilt binaries

Every tagged release publishes cosign-signed, CGO_ENABLED=0 static binaries for all supported platforms on the releases page, each with a checksum and its own SBOM. Download, verify, and drop the binary on your PATH — no runtime, no shared libraries to install.

​
Build from source

Clone and build. The build target produces a static, version-stamped binary at ./airom in the repo root.
1

Clone

Clone
2

Build

Build
This runs a CGO_ENABLED=0 build with -trimpath and stamps the version, commit, and build date into the binary. The result is ./airom — run it in place, or move it somewhere on your PATH.
3

Or install to GOBIN

Install with the same version stamp
Same static build and version stamp as make build, but installed into GOBIN rather than left in the working tree.
make help lists every target — the build, test, lint, and codegen entry points are all self-documenting.

​
Overriding the version stamp

The version defaults to git describe, falling back to v0.1.0-dev. Override it from the environment when you need a specific stamp:
Custom version stamp

​
Verify the install

Verify
What you see depends on how you installed:
The wheel ships a fully version-stamped binary, so a pip or pipx install reports the exact release it came from. (The SDK carries its own version — pip show airom — which can lead the tagged CLI release.)
Either way, if airom version prints at all, the install worked. This is exactly the ToolInfo block AIROM embeds in every AIBOM it writes, which is what lets a document be traced back to the build that produced it.
It installed fine; your shell cannot find it. Where it went depends on how you installed:
  • pip — the binary is in your environment’s bin/, on PATH automatically inside an active virtualenv. Outside one, activate the environment (or use pipx, which is always global). pip show -f airom lists the installed files.
  • pipx — always on PATH; if not, run pipx ensurepath and restart your shell.
  • go install — run go env GOPATH, confirm $(go env GOPATH)/bin/airom exists, and add that directory to your PATH (see Put it on your PATH above).
  • make build — the binary is at ./airom in the repo root and is not on your PATH at all until you move it.

​
Next

Quickstart

Your first scan, and emitting CycloneDX + SARIF.

CLI reference

Every command, flag, and exit code.