conda-sboms
conda-sboms adds CycloneDX software bill of materials (SBOM) export to
conda export. It currently emits CycloneDX 1.7 JSON for a resolved conda
environment.
The project is alpha software. No package release has been published yet. The installation guide explains how to run it from source without changing a normal conda installation.
Use
After the plugin is installed in the environment that owns conda, export an
installed environment by name:
conda export --name my-environment --from-history \
--format cyclonedx-json \
--file my-environment.cdx.json
--from-history asks conda to preserve the requested package roots when its
history contains them. The SBOM still contains every resolved conda package.
What it records
The exporter represents the environment as the root application and each exact conda package record as a library component. It includes available package hashes, build and platform data, license text, sanitized distribution URLs, conda package URLs, and dependency edges.
Limitations
The exporter does not inspect package contents, discover vendored or statically linked software, include packages from other ecosystems, identify a manufacturer, scan for vulnerabilities, or establish Cyber Resilience Act conformity. The root composition marks overall coverage as unproven. Conda-specific properties record known external-package, virtual-package, and missing-dependency counts supplied by the input.
Read the documentation for the format reference, conda-workspaces integration, reproducible output, and coverage limits.
Development
Install the locked development environment and confirm that conda discovers the exporter:
pixi install --locked -e dev
pixi run --locked -e dev conda export --help
Run the checks and documentation build:
pixi run --locked -e dev check
pixi run --locked -e docs docs
License
BSD-3-Clause. See LICENSE.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file conda_sboms-0.1.0.tar.gz.
File metadata
- Download URL: conda_sboms-0.1.0.tar.gz
- Upload date:
- Size: 109.3 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
7b49f80f40ff2b0e0ae8b19a10397c8f535ea65ffc36c70c6bce2d39c8328d32
|
|
| MD5 |
93307ef9cdafdc5f293bf137b6a39b54
|
|
| BLAKE2b-256 |
c9b1b3926ff7df45b54c3572e61da685b197313ec97d124492d0162182c704d7
|
Provenance
The following attestation bundles were made for conda_sboms-0.1.0.tar.gz:
Publisher:
release.yml on jezdez/conda-sboms
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
conda_sboms-0.1.0.tar.gz -
Subject digest:
7b49f80f40ff2b0e0ae8b19a10397c8f535ea65ffc36c70c6bce2d39c8328d32 - Sigstore transparency entry: 2519674789
- Sigstore integration time:
-
Permalink:
jezdez/conda-sboms@77933404499efcbb1a8cf951e1341e66acfc4df2 -
Branch / Tag:
refs/tags/0.1.0 - Owner: https://github.com/jezdez
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@77933404499efcbb1a8cf951e1341e66acfc4df2 -
Trigger Event:
push
-
Statement type:
File details
Details for the file conda_sboms-0.1.0-py3-none-any.whl.
File metadata
- Download URL: conda_sboms-0.1.0-py3-none-any.whl
- Upload date:
- Size: 8.4 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ae17ff7b16b0e46f669aae6dcf3499a3bc2908442972069f438a4b3d96714305
|
|
| MD5 |
83f915294d8006c94a09671d0f3d4929
|
|
| BLAKE2b-256 |
16ae241778de259cf995c2860bd21ce92f5ee59f8b0882d7b2408b88dd75da11
|
Provenance
The following attestation bundles were made for conda_sboms-0.1.0-py3-none-any.whl:
Publisher:
release.yml on jezdez/conda-sboms
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
conda_sboms-0.1.0-py3-none-any.whl -
Subject digest:
ae17ff7b16b0e46f669aae6dcf3499a3bc2908442972069f438a4b3d96714305 - Sigstore transparency entry: 2519674857
- Sigstore integration time:
-
Permalink:
jezdez/conda-sboms@77933404499efcbb1a8cf951e1341e66acfc4df2 -
Branch / Tag:
refs/tags/0.1.0 - Owner: https://github.com/jezdez
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@77933404499efcbb1a8cf951e1341e66acfc4df2 -
Trigger Event:
push
-
Statement type:
