CycloneDX Editor/Validator
This command-line tool performs various actions on CycloneDX SBOMs. It allows you to modify, merge and validate your Software Bill of Materials (SBOM).
The tool is built with automation in mind, i.e. usage within CI/CD. We try to be as scriptable as possible with various command-line flags, avoiding interactive prompts, providing multiple output options and fine-grained exit codes.
Command overview
| Command | Description |
|---|---|
| amend | Accepts a single input file and will apply one or multiple operations to it. Each operation modifies certain aspects of the SBOM. These modifications cannot be targeted at individual components in the SBOM which sets the amend command apart from set. Its use-case is ensuring an SBOM fulfils certain requirements in an automated fashion. |
| build-public | Creates a redacted version of an SBOM fit for publication. |
| init-sbom | Provides a first draft of an SBOM for manual completion. |
| list | Lists content of the SBOM. |
| merge | Merges two or more CycloneDX documents into one. |
| set | Sets properties on specified components to specified values. If a component in an SBOM is missing a particular property or the property is present but has a wrong value, this command can be used to modify just the affected properties without changing the rest of the SBOM. |
| validate | Validate the SBOM against a built-in or user-provided JSON schema. |
| vex | Apply different operations on VEX-files. |
Installation and usage
This tool is published on PyPi.
For detailed installation and usage guides, please refer to our official documentation.
Contributing
See our contribution guidelines.
License
This software is made available under the GNU General Public License v3 (GPL-3.0-or-later).
1 maintainer
Metadata
1 maintainer
Release files for cyclonedx-editor-validator 1.0.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| cyclonedx_editor_validator-1.0.3.tar.gz | 689.5 kB | Without provenance | Details for cyclonedx_editor_validator-1.0.3.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| cyclonedx_editor_validator-1.0.3-py3-none-any.whl | Python 3 | none | any | Details for cyclonedx_editor_validator-1.0.3-py3-none-any.whl |
Total release size: 1.1 MB
Release files / cyclonedx_editor_validator-1.0.3.tar.gz
| Download URL | cyclonedx_editor_validator-1.0.3.tar.gz |
|---|---|
| Size | 689.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
33bc4fa9696d7adc56d3658fc6996c75c9f2d7c2b1a9f02fa2730004c8eaab9c
|
|
BLAKE2b-256 checksum How to use checksums |
a22d13056e048c04a09574f84bebf719e706fb68b724cb33dac263a0bedb38bb
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / cyclonedx_editor_validator-1.0.3-py3-none-any.whl
| Download URL | cyclonedx_editor_validator-1.0.3-py3-none-any.whl |
|---|---|
| Size | 459.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ecc0c9cfe276c56af0733db9bd8219fc255cb280906e3377cd856a12384134ee
|
|
BLAKE2b-256 checksum How to use checksums |
d03435a7345cc20fe5bb5947bb176046b9369f7ac8554551fbb18fa5ac19369f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Security for cyclonedx-editor-validator 1.0.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
