conda-sboms
Generate a CycloneDX software bill of materials (SBOM) for an existing conda environment.
conda-sboms is an exporter plugin for conda. It adds the cyclonedx-json
format to conda export and writes conda's exact package records and dependency
graph as CycloneDX 1.7 JSON. Because it uses conda's standard exporter hook,
clients such as conda-workspaces can use the same format.
The project is alpha software. Questions, bug reports, and contributions are welcome on GitHub.
Quick start
conda-sboms requires conda 26.3 or newer. conda 26.5 and newer include the
conda-pypi plugin. For a
standard conda installation, activate base and install conda-sboms from
PyPI as a conda package:
conda activate base
conda pypi install "conda-sboms>=0.2.0"
If conda pypi is not available, follow the
installation guide to
install the wheel with pip.
Generate an SBOM for an installed environment:
conda export --name my-environment --from-history \
--format cyclonedx-json \
--file my-environment.cdx.json
--from-history asks conda to preserve the requested package roots when its
history contains them. The SBOM still contains every resolved conda package.
With conda-sboms 0.2.0 or newer, use the
product metadata guide
to identify a shipped product, its manufacturer, and the person or organization
that authored the SBOM.
For a disposable example, follow the getting-started tutorial. The installation guide also covers source checkouts.
What the SBOM contains
The environment is represented as the root application and each resolved conda package as a library component. When available, the SBOM includes package hashes, build and platform data, license text, sanitized distribution URLs, conda package URLs, and dependency relationships.
Scope and limitations
The exporter does not inspect package contents, discover vendored or statically linked software, include packages from other ecosystems, infer a manufacturer, scan for vulnerabilities, or establish Cyber Resilience Act conformity. The root composition marks overall coverage as unproven. Conda-specific properties record known external-package, virtual-package, and missing-dependency counts supplied by the input.
Read the documentation for product metadata, the format reference, conda-workspaces integration, reproducible output, and coverage limits.
Development
Install the locked development environment and confirm that conda discovers the exporter:
pixi install --locked -e dev
pixi run --locked -e dev conda export --help
Run the checks and documentation build:
pixi run --locked -e dev check
pixi run --locked -e docs docs
License
BSD-3-Clause. See LICENSE.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file conda_sboms-0.2.0.tar.gz.
File metadata
- Download URL: conda_sboms-0.2.0.tar.gz
- Upload date:
- Size: 115.3 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
9c33114cfd20af9c8d5122ac72aacb1cd1f585b0b8c397793a34f3489de71548
|
|
| MD5 |
a349c9dd72670bc8df605c4646e7d34c
|
|
| BLAKE2b-256 |
bbfeb9a0b21aebe1ad155a88b5f488839663196b361e428b0ae27377edbf30f6
|
Provenance
The following attestation bundles were made for conda_sboms-0.2.0.tar.gz:
Publisher:
release.yml on jezdez/conda-sboms
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
conda_sboms-0.2.0.tar.gz -
Subject digest:
9c33114cfd20af9c8d5122ac72aacb1cd1f585b0b8c397793a34f3489de71548 - Sigstore transparency entry: 2549045819
- Sigstore integration time:
-
Permalink:
jezdez/conda-sboms@9c34018d9e838a6053cfbbb405d158cdef40e507 -
Branch / Tag:
refs/tags/0.2.0 - Owner: https://github.com/jezdez
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@9c34018d9e838a6053cfbbb405d158cdef40e507 -
Trigger Event:
push
-
Statement type:
File details
Details for the file conda_sboms-0.2.0-py3-none-any.whl.
File metadata
- Download URL: conda_sboms-0.2.0-py3-none-any.whl
- Upload date:
- Size: 10.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
9d303670f3625786c5b035736962fe8e2dfeda8964dea3dfd046987f9429e458
|
|
| MD5 |
fc411eedf363633681284a1d94ee0ef2
|
|
| BLAKE2b-256 |
76ae3b20a91c56c596b30f20afe8ca1ca2eff8dd07266df46f6a5bc13b55ca0b
|
Provenance
The following attestation bundles were made for conda_sboms-0.2.0-py3-none-any.whl:
Publisher:
release.yml on jezdez/conda-sboms
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
conda_sboms-0.2.0-py3-none-any.whl -
Subject digest:
9d303670f3625786c5b035736962fe8e2dfeda8964dea3dfd046987f9429e458 - Sigstore transparency entry: 2549046552
- Sigstore integration time:
-
Permalink:
jezdez/conda-sboms@9c34018d9e838a6053cfbbb405d158cdef40e507 -
Branch / Tag:
refs/tags/0.2.0 - Owner: https://github.com/jezdez
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@9c34018d9e838a6053cfbbb405d158cdef40e507 -
Trigger Event:
push
-
Statement type:
