CycloneDX Python SBOM Generation Tool
This tool generates Software Bill of material (SBOM) documents in OWASP CycloneDX format.
This is probably the most accurate, complete SBOM generator for any python-related projects.
Supported data sources are:
- Python (virtual) environment
Poetrymanifest and lockfilePipenvmanifest and lockfile- Pip's
requirements.txtformat PDMmanifest and lockfile are not explicitly supported.
However, PDM's Python virtual environments are fully supported. See the docs for an example.uvmanifest and lockfile are not explicitly supported.
However, uv's Python virtual environments are fully supported. See the docs for an example.Condaas a package manager is no longer supported since version 4.
However, conda's Python environments are fully supported via the methods listed above. See the docs for an example.
Based on OWASP Software Component Verification Standard for Software Bill of Materials' criteria, this tool is capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).
The resulting SBOM documents follow official specifications and standards,
and might have properties following
cdx:python Namespace Taxonomy,
cdx:pipenv Namespace Taxonomy,
cdx:poetry Namespace Taxonomy
.
Read the full documentation for more details.
Requirements
- Python
>=3.9,<4
However, there are older versions of this tool available, which
support Python >=2.7.
Installation
Install this from Python Package Index (PyPI) using your preferred Python package manager.
install via one of commands:
python -m pip install cyclonedx-bom # install via pip
pipx install cyclonedx-bom # install via pipx
poetry add cyclonedx-bom # install via poetry
uv tool install cyclonedx-bom # install via uv
# ... you get the hang
Usage
Call via one of commands:
cyclonedx-py # call script
python3 -m cyclonedx_py # call python module CLI
Basic usage
$ cyclonedx-py --help
usage: cyclonedx-py [-h] [--version] <command> ...
Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.
positional arguments:
<command>
environment (env, venv)
Build an SBOM from Python (virtual) environment
requirements Build an SBOM from Pip requirements
pipenv Build an SBOM from Pipenv manifest
poetry Build an SBOM from Poetry project
options:
-h, --help show this help message and exit
--version show program's version number and exit
Advanced usage and details
See the full documentation for advanced usage and details on input formats, switches and options.
Python Support
We endeavour to support all functionality for all current actively supported Python versions.
However, some features may not be possible/present in older Python versions due to their lack of support.
However, there are older versions of this tool, that support python>=2.7.
Internals
This tool utilizes the CycloneDX Python library to generate the actual data structures, and serialize and validate them.
This tool does not expose any additional public API or symbols - all code is intended to be internal and might change without any notice during version upgrades. However, the CLI is stable - you might call it programmatically. See the documentation for an example.
Contributing
Feel free to open issues, bugreports or pull requests.
See the CONTRIBUTING file for details, and how to run/setup locally.
Copyright & License
CycloneDX BOM is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the LICENSE file for the full license.
5 maintainers
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file cyclonedx_bom-7.3.1.tar.gz.
File metadata
- Download URL: cyclonedx_bom-7.3.1.tar.gz
- Upload date:
- Size: 4.4 MB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ebd99dc2cf62a7067e327bef2b2ffada99d57ed3fda2db6c4c8f3004e5bfd3cf
|
|
| MD5 |
d7e4208d5104d5e3708b314f62f44ec0
|
|
| BLAKE2b-256 |
c7a2ab75601071afb20352758ef20fd7983cd290f807cabd672eaa28eed45018
|
Provenance
The following attestation bundles were made for cyclonedx_bom-7.3.1.tar.gz:
Publisher:
release.yml on CycloneDX/cyclonedx-python
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
cyclonedx_bom-7.3.1.tar.gz -
Subject digest:
ebd99dc2cf62a7067e327bef2b2ffada99d57ed3fda2db6c4c8f3004e5bfd3cf - Sigstore transparency entry: 2225921733
- Sigstore integration time:
-
Permalink:
CycloneDX/cyclonedx-python@6715bd9f8df0afe609a479d2965ea2b866bf5f5b -
Branch / Tag:
refs/heads/main - Owner: https://github.com/CycloneDX
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@6715bd9f8df0afe609a479d2965ea2b866bf5f5b -
Trigger Event:
workflow_dispatch
-
Statement type:
File details
Details for the file cyclonedx_bom-7.3.1-py3-none-any.whl.
File metadata
- Download URL: cyclonedx_bom-7.3.1-py3-none-any.whl
- Upload date:
- Size: 60.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
8c5adccefd593e89c0500463649c232625cee8e38dae1a433e057dfa495eff08
|
|
| MD5 |
48a12909092edde75375663219648e87
|
|
| BLAKE2b-256 |
1a8de464ae953209f1379e50f704fdc86b9695883e7d6f25464796981261bb1f
|
Provenance
The following attestation bundles were made for cyclonedx_bom-7.3.1-py3-none-any.whl:
Publisher:
release.yml on CycloneDX/cyclonedx-python
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
cyclonedx_bom-7.3.1-py3-none-any.whl -
Subject digest:
8c5adccefd593e89c0500463649c232625cee8e38dae1a433e057dfa495eff08 - Sigstore transparency entry: 2225922129
- Sigstore integration time:
-
Permalink:
CycloneDX/cyclonedx-python@6715bd9f8df0afe609a479d2965ea2b866bf5f5b -
Branch / Tag:
refs/heads/main - Owner: https://github.com/CycloneDX
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@6715bd9f8df0afe609a479d2965ea2b866bf5f5b -
Trigger Event:
workflow_dispatch
-
Statement type:
