CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

Navigation

Verified details

These details have been verified by PyPI
Project links
GitHub Statistics
Maintainers
Avatar for coderpatros from gravatar.com coderpatros Avatar for CycloneDX from gravatar.com CycloneDX Avatar for jkowalleck from gravatar.com jkowalleck Avatar for madpah from gravatar.com madpah Avatar for sspringett from gravatar.com sspringett

Unverified details

These details have not been verified by PyPI
Project links
Meta
  • License: Apache Software License (Apache-2.0)
  • Author: Jan Kowalleck
  • Maintainer: Jan Kowalleck
  • Tags OWASP, CycloneDX, bill-of-materials, BOM, software-bill-of-materials, SBOM, environment, virtualenv, venv, Poetry, Pipenv, requirements, PDM, Conda, SPDX, licenses, PURL, package-url, dependency-graph
  • Requires: Python <4.0, >=3.8
Classifiers

Project description

CycloneDX Python SBOM Generation Tool

shield_pypi-version shield_docker-version shield_rtfd shield_gh-workflow-test shield_coverage shield_ossf-best-practices shield_license
shield_website shield_slack shield_groups shield_twitter-follow

This tool generates Software Bill of material (SBOM) documents in OWASP CycloneDX format.
Supported data sources are:

  • Python (virtual) environment
  • Poetry manifest and lockfile
  • Pipenv manifest and lockfile
  • Pip's requirements.txt format
  • PDM manifest and lockfile are not explicitly supported.
    However, PDM's Python virtual environments are fully supported. See the docs for an example.
  • Conda as a package manager is no longer supported since version 4.
    However, conda's Python environments are fully supported via the methods listed above. See the docs for an example.

Based on OWASP Software Component Verification Standard for Software Bill of Materials' criteria, this tool is capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).

The resulting SBOM documents follow official specifications and standards, and might have properties following cdx:python Namespace Taxonomy, cdx:pipenv Namespace Taxonomy, cdx:poetry Namespace Taxonomy .

Read the full documentation for more details.

Requirements

  • Python >=3.8,<4

However, there are older versions of this tool available, which support Python >=2.7.

Installation

Install this from Python Package Index (PyPI) using your preferred Python package manager.

install via one of commands:

python -m pip install cyclonedx-bom   # install via pip
pipx install cyclonedx-bom            # install via pipx
poetry add cyclonedx-bom              # install via poetry
# ... you get the hang

Usage

Call via one of commands:

cyclonedx-py             # call script
python3 -m cyclonedx_py  # call python module CLI

Basic usage

$ cyclonedx-py --help
usage: cyclonedx-py [-h] [--version] command ...

Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.

positional arguments:
  command
    environment   Build an SBOM from Python (virtual) environment
    requirements  Build an SBOM from Pip requirements
    pipenv        Build an SBOM from Pipenv manifest
    poetry        Build an SBOM from Poetry project

options:
  -h, --help      show this help message and exit
  --version       show program's version number and exit

Advanced usage and details

See the full documentation for advanced usage and details on input formats, switches and options.

Python Support

We endeavour to support all functionality for all current actively supported Python versions. However, some features may not be possible/present in older Python versions due to their lack of support. However, there are older versions of this tool, that support python>=2.7.

Internals

This tool utilizes the CycloneDX Python library to generate the actual data structures, and serialize and validate them.

This tool does not expose any additional public API or symbols - all code is intended to be internal and might change without any notice during version upgrades. However, the CLI is stable - you might call it programmatically. See the documentation for an example.

Contributing

Feel free to open issues, bugreports or pull requests.
See the CONTRIBUTING file for details, and how to run/setup locally.

Copyright & License

CycloneDX BOM is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the LICENSE file for the full license.

Project details

Verified details

These details have been verified by PyPI
Project links
GitHub Statistics
Maintainers
Avatar for coderpatros from gravatar.com coderpatros Avatar for CycloneDX from gravatar.com CycloneDX Avatar for jkowalleck from gravatar.com jkowalleck Avatar for madpah from gravatar.com madpah Avatar for sspringett from gravatar.com sspringett

Unverified details

These details have not been verified by PyPI
Project links
Meta
  • License: Apache Software License (Apache-2.0)
  • Author: Jan Kowalleck
  • Maintainer: Jan Kowalleck
  • Tags OWASP, CycloneDX, bill-of-materials, BOM, software-bill-of-materials, SBOM, environment, virtualenv, venv, Poetry, Pipenv, requirements, PDM, Conda, SPDX, licenses, PURL, package-url, dependency-graph
  • Requires: Python <4.0, >=3.8
Classifiers

Release history Release notifications | RSS feed

5.1.1

5.1.0

5.0.0

This version

4.6.1

4.6.1a1 pre-release

4.6.0

4.5.1

4.5.0

4.4.3

4.4.2

4.4.1

4.4.0

4.3.4a1 pre-release

4.3.3a1 pre-release

4.3.2a1 pre-release

4.3.1a1 pre-release

4.3.0

4.2.0

4.1.6

4.1.5

4.1.4

4.1.3

4.1.2

4.1.1

4.1.0

4.0.0

4.0.0rc6 pre-release

4.0.0rc5 pre-release

4.0.0rc4 pre-release

4.0.0rc2 pre-release

4.0.0rc1 pre-release

3.11.7

3.11.6

3.11.5

3.11.4

3.11.3

3.11.2

3.11.1

3.11.0

3.10.1

3.10.0

3.9.0

3.8.0

3.7.4

3.7.3

3.7.2

3.7.1

3.7.0

3.6.4

3.6.3

3.6.2

3.6.1

3.6.0

3.5.0

3.4.0

3.3.0

3.2.2

3.2.1

3.2.0

3.1.1

3.1.0

3.0.0

3.0.0rc3 pre-release

3.0.0rc2 pre-release

3.0.0rc1 pre-release

3.0.0rc0 pre-release

2.1.0 yanked

Reason this release was yanked:

Should have been 3.0.0

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0rc1 pre-release

2.0.0rc0 pre-release

1.5.3

1.5.2

1.5.1

1.5.0

1.4.3

1.4.2

1.4.1

1.4.0

1.3.1

1.3.0

1.2.0

1.1.0

1.0.5

1.0.4

1.0.3

1.0.2

0.4.3

0.4.2

0.4.1

0.4.0

0.3.5

0.3.4

0.3.3

0.3.2

0.3.1

0.3.0

0.2.0

0.1.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cyclonedx_bom-4.6.1.tar.gz (2.3 MB view details)

Uploaded Source

Built Distribution

cyclonedx_bom-4.6.1-py3-none-any.whl (54.5 kB view details)

Uploaded Python 3

File details

Details for the file cyclonedx_bom-4.6.1.tar.gz.

File metadata

  • Download URL: cyclonedx_bom-4.6.1.tar.gz
  • Upload date:
  • Size: 2.3 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/5.1.1 CPython/3.12.6

File hashes

Hashes for cyclonedx_bom-4.6.1.tar.gz
Algorithm Hash digest
SHA256 2fe72daadfd8addd824b235f8ea21ff6045ebe00bbb9da48ec07bfc5a3c39169
MD5 1555d1cdc3850c7a2265ab9cee933be4
BLAKE2b-256 7f99039d55af5fd11f096e37e6f3a87a922f597f2ee24e997f6b6b58478442a4

See more details on using hashes here.

Provenance

File details

Details for the file cyclonedx_bom-4.6.1-py3-none-any.whl.

File metadata

File hashes

Hashes for cyclonedx_bom-4.6.1-py3-none-any.whl
Algorithm Hash digest
SHA256 39600cb0fe9231285d9f6c234270e23200f9de28d63a2cc2c50d1f6fab75fe1b
MD5 52598f4236ec6186068be3b2245ca333
BLAKE2b-256 b029b81f99628ab6f4ce45e6540f6912ea6e0b16a1de40c0c6cf488db4eb2235

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page