Package: sbom2doc
SBOM2DOCSBOM2DOC documents and summarises the components within an SBOM (Software Bill of Materials). SBOMS are supported in a number of formats includingSPDXandCycloneDX.InstallationTo install use the following command:pip install sbom2docAlternatively, just clone the repo and install dependencies using the following command:pip install -U -r requirements.txtThe tool requires Python 3 (3.7+). It is recommended to use a virtual python environment especially
if you are using different versions of python.virtualenvis a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.Usageusage: sbom2doc [-h] [-i INPUT_FILE] [--debug] [--include-license] [-f {console,json,markdown,pdf}] [-o OUTPUT_FILE] [-V]

SBOM2doc generates documentation for a SBOM.

options:
  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit

Input:
  -i INPUT_FILE, --input-file INPUT_FILE
                        Name of SBOM file

Output:
  --debug               add debug information
  --include-license     add license text
  -f {console,json,markdown,pdf}, --format {console,json,markdown,pdf}
                        Output format (default: output to console)
  -o OUTPUT_FILE, --output-file OUTPUT_FILE
                        output filename (default: output to stdout)OperationThe--input-fileoption is used to specify the SBOM to be processed. The format of the SBOM is determined according to
the following filename conventions.SBOMFormatFilename extensionSPDXTagValue.spdxSPDXJSON.spdx.jsonSPDXYAML.spdx.yamlSPDXYAML.spdx.ymlCycloneDXJSON.jsonThe--output-fileoption is used to control the destination of the output generated by the tool. The
default is to report to the console, but it can also be stored in a file (specified using--output-fileoption).The--include-licenseoption is used to indicate if the text for the licenses is to be included in the output.ExampleGiven the following SBOM (flask.spdx)SPDXVersion:SPDX-2.3
DataLicense:CC0-1.0
SPDXID:SPDXRef-DOCUMENT
DocumentName:Python-flask
DocumentNamespace:http://spdx.org/spdxdocs/Python-flask-f95bd9a2-1442-4631-9b13-870422204ed4
LicenseListVersion:3.21
Creator:Tool:sbom4python-0.10.0
Created:2023-08-17T20:28:31Z
CreatorComment:<text>Thisdocumenthasbeenautomaticallygenerated.</text>#####PackageName:flask
SPDXID:SPDXRef-Package-1-flask
PackageVersion:2.2.2
PrimaryPackagePurpose:APPLICATION
PackageSupplier:Person:ArminRonacher(armin.ronacher@active-4.com)PackageDownloadLocation:https://pypi.org/project/Flask/2.2.2
FilesAnalyzed:falsePackageLicenseDeclared:BSD-3-Clause
PackageLicenseConcluded:BSD-3-Clause
PackageCopyrightText:NOASSERTION
PackageSummary:<text>Asimpleframeworkforbuildingcomplexwebapplications.</text>
ExternalRef:PACKAGE-MANAGERpurlpkg:pypi/flask@2.2.2
ExternalRef:SECURITYcpe23Typecpe:2.3:a:armin_ronacher:flask:2.2.2:*:*:*:*:*:*:*#####PackageName:click
SPDXID:SPDXRef-Package-2-click
PackageVersion:8.0.3
PrimaryPackagePurpose:LIBRARY
PackageSupplier:Person:ArminRonacher(armin.ronacher@active-4.com)PackageDownloadLocation:https://pypi.org/project/click/8.0.3
FilesAnalyzed:falsePackageLicenseDeclared:BSD-3-Clause
PackageLicenseConcluded:BSD-3-Clause
PackageCopyrightText:NOASSERTION
PackageSummary:<text>Composablecommandlineinterfacetoolkit</text>
ExternalRef:PACKAGE-MANAGERpurlpkg:pypi/click@8.0.3
ExternalRef:SECURITYcpe23Typecpe:2.3:a:armin_ronacher:click:8.0.3:*:*:*:*:*:*:*#####PackageName:itsdangerous
SPDXID:SPDXRef-Package-3-itsdangerous
PackageVersion:2.1.2
PrimaryPackagePurpose:LIBRARY
PackageSupplier:Person:ArminRonacher(armin.ronacher@active-4.com)PackageDownloadLocation:https://pypi.org/project/itsdangerous/2.1.2
FilesAnalyzed:falsePackageLicenseDeclared:BSD-3-Clause
PackageLicenseConcluded:BSD-3-Clause
PackageCopyrightText:NOASSERTION
PackageSummary:<text>Safelypassdatatountrustedenvironmentsandback.</text>
ExternalRef:PACKAGE-MANAGERpurlpkg:pypi/itsdangerous@2.1.2
ExternalRef:SECURITYcpe23Typecpe:2.3:a:armin_ronacher:itsdangerous:2.1.2:*:*:*:*:*:*:*#####PackageName:jinja2
SPDXID:SPDXRef-Package-4-jinja2
PackageVersion:3.0.2
PrimaryPackagePurpose:LIBRARY
PackageSupplier:Person:ArminRonacher(armin.ronacher@active-4.com)PackageDownloadLocation:https://pypi.org/project/Jinja2/3.0.2
FilesAnalyzed:falsePackageLicenseDeclared:BSD-3-Clause
PackageLicenseConcluded:BSD-3-Clause
PackageCopyrightText:NOASSERTION
PackageSummary:<text>Averyfastandexpressivetemplateengine.</text>
ExternalRef:PACKAGE-MANAGERpurlpkg:pypi/jinja2@3.0.2
ExternalRef:SECURITYcpe23Typecpe:2.3:a:armin_ronacher:jinja2:3.0.2:*:*:*:*:*:*:*#####PackageName:markupsafe
SPDXID:SPDXRef-Package-5-markupsafe
PackageVersion:2.1.1
PrimaryPackagePurpose:LIBRARY
PackageSupplier:Person:ArminRonacher(armin.ronacher@active-4.com)PackageDownloadLocation:https://pypi.org/project/MarkupSafe/2.1.1
FilesAnalyzed:falsePackageLicenseDeclared:BSD-3-Clause
PackageLicenseConcluded:BSD-3-Clause
PackageCopyrightText:NOASSERTION
PackageSummary:<text>SafelyadduntrustedstringstoHTML/XMLmarkup.</text>
ExternalRef:PACKAGE-MANAGERpurlpkg:pypi/markupsafe@2.1.1
ExternalRef:SECURITYcpe23Typecpe:2.3:a:armin_ronacher:markupsafe:2.1.1:*:*:*:*:*:*:*#####PackageName:werkzeug
SPDXID:SPDXRef-Package-6-werkzeug
PackageVersion:2.2.2
PrimaryPackagePurpose:LIBRARY
PackageSupplier:Person:ArminRonacher(armin.ronacher@active-4.com)PackageDownloadLocation:https://pypi.org/project/Werkzeug/2.2.2
FilesAnalyzed:falsePackageLicenseDeclared:BSD-3-Clause
PackageLicenseConcluded:BSD-3-Clause
PackageCopyrightText:NOASSERTION
PackageSummary:<text>ThecomprehensiveWSGIwebapplicationlibrary.</text>
ExternalRef:PACKAGE-MANAGERpurlpkg:pypi/werkzeug@2.2.2
ExternalRef:SECURITYcpe23Typecpe:2.3:a:armin_ronacher:werkzeug:2.2.2:*:*:*:*:*:*:*#####Relationship:SPDXRef-DOCUMENTDESCRIBESSPDXRef-Package-1-flask
Relationship:SPDXRef-Package-1-flaskDEPENDS_ONSPDXRef-Package-2-click
Relationship:SPDXRef-Package-1-flaskDEPENDS_ONSPDXRef-Package-3-itsdangerous
Relationship:SPDXRef-Package-1-flaskDEPENDS_ONSPDXRef-Package-4-jinja2
Relationship:SPDXRef-Package-1-flaskDEPENDS_ONSPDXRef-Package-6-werkzeug
Relationship:SPDXRef-Package-4-jinja2DEPENDS_ONSPDXRef-Package-5-markupsafe
Relationship:SPDXRef-Package-6-werkzeugDEPENDS_ONSPDXRef-Package-5-markupsafeThe following commands will generate a summary of the contents of the SBOM to the console.sbom2doc--inputflask.spdx╭──────────────╮
│SBOMSummary│
╰──────────────╯
┏━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃Item┃Details┃
┡━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│SBOMFile│/root/Downloads/flask.spdx│
│SBOMType│spdx│
│Version│SPDX-2.3│
│Name│Python-flask│
│Creator│Tool:sbom4python-0.10.0│
│Created│2023-08-17T20:28:31Z│
│Files│0│
│Packages│6│
│Relationships│7│
└───────────────┴────────────────────────────┘
╭─────────────────╮
│PackageSummary│
╰─────────────────╯
┏━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┓
┃Name┃Version┃Type┃Supplier┃License┃
┡━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━┩
│flask│2.2.2│APPLICATION│ArminRonacher(armin.ronacher@active-4.com)│BSD-3-Clause│
│click│8.0.3│LIBRARY│ArminRonacher(armin.ronacher@active-4.com)│BSD-3-Clause│
│itsdangerous│2.1.2│LIBRARY│ArminRonacher(armin.ronacher@active-4.com)│BSD-3-Clause│
│jinja2│3.0.2│LIBRARY│ArminRonacher(armin.ronacher@active-4.com)│BSD-3-Clause│
│markupsafe│2.1.1│LIBRARY│ArminRonacher(armin.ronacher@active-4.com)│BSD-3-Clause│
│werkzeug│2.2.2│LIBRARY│ArminRonacher(armin.ronacher@active-4.com)│BSD-3-Clause│
└──────────────┴─────────┴─────────────┴──────────────────────────────────────────────┴──────────────┘


┏━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┓
┃Name┃Version┃Ecosystem┃Download┃Copyright┃
┡━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━┩
│flask│2.2.2│pypi│https://pypi.org/project/Flask/2.2.2│NOASSERTION│
│click│8.0.3│pypi│https://pypi.org/project/click/8.0.3│NOASSERTION│
│itsdangerous│2.1.2│pypi│https://pypi.org/project/itsdangerous/2.1.2│NOASSERTION│
│jinja2│3.0.2│pypi│https://pypi.org/project/Jinja2/3.0.2│NOASSERTION│
│markupsafe│2.1.1│pypi│https://pypi.org/project/MarkupSafe/2.1.1│NOASSERTION│
│werkzeug│2.2.2│pypi│https://pypi.org/project/Werkzeug/2.2.2│NOASSERTION│
└──────────────┴─────────┴───────────┴─────────────────────────────────────────────┴─────────────┘
╭────────────────────────╮
│ComponentTypeSummary│
╰────────────────────────╯
┏━━━━━━━━━━━━━┳━━━━━━━┓
┃Type┃Count┃
┡━━━━━━━━━━━━━╇━━━━━━━┩
│APPLICATION│1│
│LIBRARY│5│
└─────────────┴───────┘
╭─────────────────╮
│LicenseSummary│
╰─────────────────╯
┏━━━━━━━━━━━━━━┳━━━━━━━┓
┃License┃Count┃
┡━━━━━━━━━━━━━━╇━━━━━━━┩
│BSD-3-Clause│6│
└──────────────┴───────┘
╭──────────────────╮
│SupplierSummary│
╰──────────────────╯
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━┓
┃Supplier┃Count┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━┩
│ArminRonacher(armin.ronacher@active-4.com)│6│
└───────────────────────────────────────────────┴───────┘
╭──────────────╮
│NTIASummary│
╰──────────────╯
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┓
┃Element┃Status┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━┩
│Allfileinformationprovided?│True│
│Allpackageinformationprovided?│True│
│Creatoridentified?│True│
│Creationtimeidentified?│True│
│Dependencyrelationshipsprovided?│True│
└────────────────────────────────────┴────────┘

NTIAconformantTrueLicenceLicenced under the Apache 2.0 Licence.LimitationsThe tool has the following limitationsSBOMs in RDF (SPDX) and XML (SPDX and CycloneDX) formats are not supported.Invalid SBOMs will result in unpredictable results.Feedback and ContributionsBugs and feature requests can be made via GitHub Issues.