Installation

AIROM is a single static binary built with CGO_ENABLED=0. There are no runtime dependencies and no shared libraries to chase.

AIROM is at v0.4.6. It includes the AI-native risk overlay, a default-on CVE overlay backed by OSV.dev, a default-on model lifecycle overlay, compliance framework mapping, test-scope filtering, SPDX 3.0.1 and OpenVEX export, and a signed rule-update channel that also carries lifecycle catalogs. Early but real; expect rough edges.New in v0.4.0: --fix rewrites a vulnerable pin in the manifest that declares it, and --fix-verify dry-runs the ecosystem’s resolver to confirm the result still resolves. Both are opt-in and off by default. This is the first thing AIROM writes to your tree; anything it cannot pin from a declared manifest is reported with a reason rather than edited.v0.4.6 changes how a fetched rule bundle applies. Until v0.4.5 a bundle installed by airom rules update was used instead of the packs built into the binary; now it layers over them, merged by rule ID. If you run rules update, upgrade: a bundle that does not carry a pack no longer removes that pack’s detection. With a bundle installed, rulesVersion now reads builtin+v0.1.9 rather than v0.1.9, since both layers answer. The same release stops litellm and instructor appearing as two components (one with a version, one with a provider) — regenerate if you archived an AIBOM of a tree using either.v0.4.4 fixes CycloneDX schema validity. v0.4.2 and v0.4.3 emitted evidence.identity[].field: "versionConstraint", which is not in the spec’s closed enum, so strict validators rejected those documents. Declared ranges now travel as an airom:evidence.versionConstraint property instead. If you archived CycloneDX output from either version, regenerate it.New in v0.4.2: every scan carries an assurance account saying what it could not prove (files excluded, reads truncated at the size cap, which overlays actually ran), and airom bench measures detection against a public benchmark corpus. Local model files are also named differently now: a GGUF takes the name its own header declares, and weights files drop the serialization extension, so airom diff shows them as removed+added once across the v0.4.1 line.Upgrade from v0.4.0. In that release the fix flags could also be set from a checked-in .airom.yaml, so a repository could make a plain scan rewrite your manifests. v0.4.1 refuses them from anywhere but the command line. If you scanned an untrusted tree with v0.4.0, check git status for manifest edits you did not ask for.The airom command is on PyPI. Cosign-signed static binaries for every supported platform ship on the releases page with each tagged release. A Homebrew tap is planned but not available yet.

pip

The easiest path, and no Go toolchain required. The wheel bundles the static airom binary and installs the Python SDK, so one command gives you both the CLI and import airom. Requires Python 3.10 or newer.

Install the CLI + SDK

pip install airom

Prefer an isolated install that is always on your PATH? Use pipx:

Isolated install

pipx install airom

pip places airom on your PATH automatically inside an active virtualenv; pipx does so globally. Then airom --version works from any directory. Wheels are published for macOS (Intel + Apple Silicon), Linux (x86-64 + arm64, glibc + musl), and Windows (x86-64 + arm64). Each one is installed and run on the platform it targets before it is published.

go install

Requires Go 1.26 or newer (every golang.org/x module the scanner depends on now needs it; Go 1.25 is out of support). Reach for this if you already have a Go toolchain.

Install

go install github.com/airomhq/airom/cmd/airom@latest

@latest resolves to the newest release tag (v0.4.6 today).

Put it on your PATH

This is the single most common installation problem, so handle it up front. go install places the binary in $(go env GOPATH)/bin. If that directory is not on your PATH, running airom gives you command not found. The install succeeded; your shell just cannot see it. Check where it went:

Find the install directory

go env GOPATH

Then add bin under that path to your shell profile:

echo 'export PATH="$(go env GOPATH)/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

echo 'export PATH="$(go env GOPATH)/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

fish_add_path (go env GOPATH)/bin

If you have set GOBIN, the binary goes there instead of $(go env GOPATH)/bin. Check with go env GOBIN and put that directory on your PATH.

Prebuilt binaries

Every tagged release publishes cosign-signed, CGO_ENABLED=0 static binaries for all supported platforms on the releases page, with a checksums.txt covering all of them. Download, verify, and drop the binary on your PATH. There is no runtime and nothing else to install.

Build from source

Clone and build. The build target produces a static, version-stamped binary at ./airom in the repo root.

Clone

git clone https://github.com/airomhq/airom.git
cd airom

Build

make build

This runs a CGO_ENABLED=0 build with -trimpath and stamps the version, commit, and build date into the binary. The result is ./airom. Run it in place, or move it somewhere on your PATH.

Or install to GOBIN

Install with the same version stamp

make install

Same static build and version stamp as make build, but installed into GOBIN rather than left in the working tree.

make help lists every target. The build, test, lint, and codegen entry points are all self-documenting.

Overriding the version stamp

The version defaults to git describe, falling back to v0.1.0-dev. Override it from the environment when you need a specific stamp:

Custom version stamp

make build VERSION=v0.1.0

Verify the install

Verify

airom version

What you see depends on how you installed:

pip / pipx
go install
make build

airom 0.4.6
  commit: ad4c6e2
  built:  2026-09-18T15:31:39+05:30
  go:     go1.26.8 (darwin/arm64)

The wheel ships a fully version-stamped binary, so a pip or pipx install reports the exact release it came from. The SDK carries its own version, visible with pip show airom, which can lead the tagged CLI release.

airom dev
  commit: none
  built:  unknown
  go:     go1.26.5 (darwin/arm64)

The build metadata is injected at build time with ldflags. A plain go install does not set it, so the binary honestly reports itself as an unstamped development build. The scanner is fully functional.

airom 0fb8a93-dirty
  commit: 0fb8a93
  built:  2026-07-17T06:20:56Z
  go:     go1.26.5 (darwin/arm64)

make stamps the version from git describe --tags --always --dirty. On a commit after the latest tag that resolves to something like v0.4.6-4-g0fb8a93, with -dirty appended if your working tree has uncommitted changes.

Either way, if airom version prints at all, the install worked. This is exactly the ToolInfo block AIROM embeds in every AIBOM it writes, which is what lets a document be traced back to the build that produced it.

airom: command not found

It installed fine; your shell cannot find it. Where it went depends on how you installed:

pip: the binary is in your environment’s bin/, which is on PATH automatically inside an active virtualenv. Outside one, activate the environment or use pipx, which is always global. pip show -f airom lists the installed files.
pipx: always on PATH. If not, run pipx ensurepath and restart your shell.
go install: run go env GOPATH, confirm $(go env GOPATH)/bin/airom exists, and add that directory to your PATH. See Put it on your PATH above.
make build: the binary is at ./airom in the repo root and is not on your PATH until you move it.

Quickstart

Your first scan, and emitting CycloneDX + SARIF.

CLI reference

Every command, flag, and exit code.

Get started

Concepts

Scanning

Output

CI/CD

Rules

Reference

Installation

pip

go install

Put it on your PATH

Prebuilt binaries

Build from source

Overriding the version stamp

Verify the install

Next

Quickstart

CLI reference

​pip

​go install

​Put it on your PATH

​Prebuilt binaries

​Build from source

​Overriding the version stamp

​Verify the install

​Next

Quickstart

CLI reference

pip

go install

Put it on your PATH

Prebuilt binaries

Build from source

Overriding the version stamp

Verify the install

Next