Package: sbom4python
SBOM4PythonThe SBOM4Python is a free, open source tool to generate a
SBOM (Software Bill of Materials) for an installed Python module in a number of formats includingSPDXandCycloneDX.
It identifies all of the dependent components which are
explicity defined (typically via requirements.txt file) or implicitly as a
hidden dependency.It is intended to be used as part of a continuous integration system to enable accurate records of SBOMs to be maintained
and also to support subsequent audit needs to determine if a particular component (and version) has been used.InstallationTo install use the following command:pip install sbom4pythonAlternatively, just clone the repo and install dependencies using the following command:pip install -U -r requirements.txtThe tool requires Python 3 (3.7+). It is recommended to use a virtual python environment especially
if you are using different versions of python.virtualenvis a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.Issues with Windows InstallationWhen running on Windows, if you get the following errorImportError: failed to find libmagic.  Check your installationThis is because of a mismatch with the installation of the magic library. To resolve, please issue the following commandspipuninstallpython-magic
pipuninstallpython-magic-bin

pipinstallpython-magic
pipinstallpython-magic-binUsageusage:sbom4python[-h][-mMODULE][--exclude-license][--include-file][-d][--sbom{spdx,cyclonedx}][--format{tag,json,yaml}][-oOUTPUT_FILE][-gGRAPH][-V]optionalarguments:-h,--helpshowthishelpmessageandexit-V,--versionshowprogram'sversionnumberandexitInput:-mMODULE,--moduleMODULEidentityofpythonmodule--exclude-licensesuppressdetectingthelicenseofcomponents--include-fileincludereportingfilesassociatedwithmodule

Output:-d,--debugadddebuginformation--sbom{spdx,cyclonedx}specifytypeofsoftwarebillofmaterials(sbom)togenerate(default:spdx)--format{tag,json,yaml}specifyformatofsoftwarebillofmaterials(sbom)(default:tag)-oOUTPUT_FILE,--output-fileOUTPUT_FILEoutputfilename(default:outputtostdout)-gGRAPH,--graphGRAPHfilenamefordependencygraphOperationThe--moduleoption is used to identify the Python module.The--sbomoption is used to specify the format of the generated SBOM (the default is SPDX). The--formatoption
can be used to specify the formatting of the SBOM (the default is Tag Value format for a SPDX SBOM). JSON format is supported for both
SPDX and CycloneDX SBOMs).The--output-fileoption is used to control the destination of the output generated by the tool. The
default is to report to the console but can be stored in a file (specified using--output-fileoption).The tool attempts to determine the license of each module. This can be suppressed using the--exclude-licenseoption in
which case all licences are reported as 'NOASSERTION'.The tool can optionally include the files associated with the installed module. This can be specified using the--include-fileoption. As the filenames are
relative to the directory in which the tool is invoked, it is recommended that the tool is launched in a directory where the source files are available.The--graphoption is used to generate a dependency graph of the components within the SBOM. The format of the graph
file is compatible with theDOT languageused by theGraphVizapplication.LicenceLicenced under the Apache 2.0 Licence.The tool uses a local copy of theSPDX Licenses Listwhich is released underCreative Commons Attribution 3.0 (CC-BY-3.0).LimitationsThis tool is meant to support software development and security audit functions. However the usefulness of the tool is dependent on the SBOM data
which is provided to the tool. Unfortunately, the tool is unable to determine the validity or completeness of such a SBOM file; users of the tool
are therefore reminded that they should assert the quality of any data which is provided to the tool.When processing and validating licenses, the application will use a set of synonyms to attempt to map some license identifiers to the correctSPDX License Identifiers. However, the
user of the tool is reminded that they should assert the quality of any data which is provided by the tool particularly where the license identifier has been modified.WhilstPURLandCPEreferences are automatically generated for each Python module, the accuracy
of such references cannot be guaranteed as they are dependent on the validity of the data associated with the Python module.Feedback and ContributionsBugs and feature requests can be made via GitHub Issues.