Package: cyclonedx-bom
CycloneDX Python SBOM Generation ToolThis tool generates Software Bill of material (SBOM) documents in OWASPCycloneDXformat.Supported data sources are:Python (virtual) environmentPoetrymanifest and lockfilePipenvmanifest and lockfilePip'srequirements.txtformatPDMmanifest and lockfile are not explicitly supported.However, PDM's Python virtual environments are fully supported. See the docs for an example.Condaas a package manager is no longer supported since version 4.However, conda's Python environments are fully supported via the methods listed above. See the docs for an example.Based onOWASP Software Component Verification Standard for Software Bill of Materials's
criteria, this tool is capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).The resulting SBOM documents followofficial specifications and standards,
and might have properties followingcdx:pythonNamespace Taxonomy,cdx:pipenvNamespace Taxonomy,cdx:poetryNamespace Taxonomy.Read the fulldocumentationfor more details.RequirementsPython>=3.8,<4However, there are older versions of this tool available, which
support Python>=2.7.InstallationInstall this fromPython Package Index (PyPI)using your preferred Python package manager.install via one of commands:python-mpipinstallcyclonedx-bom# install via pippipxinstallcyclonedx-bom# install via pipxpoetryaddcyclonedx-bom# install via poetry# ... you get the hangUsageCall via one of commands:cyclonedx-py# call scriptpython3-mcyclonedx_py# call python module CLIBasic usage$ cyclonedx-py --help
usage: cyclonedx-py [-h] [--version] command ...

Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.

positional arguments:
  command
    environment   Build an SBOM from Python (virtual) environment
    requirements  Build an SBOM from Pip requirements
    pipenv        Build an SBOM from Pipenv manifest
    poetry        Build an SBOM from Poetry project

options:
  -h, --help      show this help message and exit
  --version       show program's version number and exitAdvanced usage and detailsSee the fulldocumentationfor advanced usage and details on input formats, switches and options.Python SupportWe endeavour to support all functionality for allcurrent actively supported Python versions.
However, some features may not be possible/present in older Python versions due to their lack of support.
However, there are older versions of this tool, that supportpython>=2.7.InternalsThis tool utilizes theCycloneDX Python libraryto generate the actual data structures, and serialize and validate them.This tool doesnotexpose any additionalpublicAPI or symbols - all code is intended to be internal and might change without any notice during version upgrades.
However, the CLI is stable - you might call it programmatically. See the documentation for an example.ContributingFeel free to open issues, bugreports or pull requests.See theCONTRIBUTINGfile for details.Copyright & LicenseCycloneDX BOM is Copyright (c) OWASP Foundation. All Rights Reserved.Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.See theLICENSEfile for the full license.