conda-sboms

Generate a CycloneDX software bill of materials (SBOM) for an existing conda environment.

conda-sboms is an exporter plugin for conda. It adds the cyclonedx-json format to conda export and writes conda's exact package records and dependency graph as CycloneDX 1.7 JSON. Because it uses conda's standard exporter hook, clients such as conda-workspaces can use the same format.

The project is alpha software. Questions, bug reports, and contributions are welcome on GitHub.

Quick start

conda-sboms requires conda 26.3 or newer. conda 26.5 and newer include the conda-pypi plugin. For a standard conda installation, activate base and install conda-sboms from PyPI as a conda package:

conda activate base
conda pypi install "conda-sboms>=0.2.0"

If conda pypi is not available, follow the installation guide to install the wheel with pip.

Generate an SBOM for an installed environment:

conda export --name my-environment --from-history \
  --format cyclonedx-json \
  --file my-environment.cdx.json

--from-history asks conda to preserve the requested package roots when its history contains them. The SBOM still contains every resolved conda package.

With conda-sboms 0.2.0 or newer, use the product metadata guide to identify a shipped product, its manufacturer, and the person or organization that authored the SBOM.

For a disposable example, follow the getting-started tutorial. The installation guide also covers source checkouts.

What the SBOM contains

The environment is represented as the root application and each resolved conda package as a library component. When available, the SBOM includes package hashes, build and platform data, license text, sanitized distribution URLs, conda package URLs, and dependency relationships.

Scope and limitations

The exporter does not inspect package contents, discover vendored or statically linked software, include packages from other ecosystems, infer a manufacturer, scan for vulnerabilities, or establish Cyber Resilience Act conformity. The root composition marks overall coverage as unproven. Conda-specific properties record known external-package, virtual-package, and missing-dependency counts supplied by the input.

Read the documentation for product metadata, the format reference, conda-workspaces integration, reproducible output, and coverage limits.

Development

Install the locked development environment and confirm that conda discovers the exporter:

pixi install --locked -e dev
pixi run --locked -e dev conda export --help

Run the checks and documentation build:

pixi run --locked -e dev check
pixi run --locked -e docs docs

License

BSD-3-Clause. See LICENSE.