Hatch SBOM

CI/CD
Package
Meta

A Hatchling build hook plugin to automatically generate a Software Bill of Materials (SBOM) during wheel creation.

Usage

To use this plugin, configure your pyproject.toml to require both hatchling (>=1.28.0) and hatch-sbom in your build-system.

For a requirements.txt SBOM:

[build-system]
requires = ["hatchling>=1.28.0", "hatch-sbom[cdx]"]
build-backend = "hatchling.build"

The base install is minimal. Install extras only for the backend used by your selected source:

requirements, poetry, pipenv, and environment use cyclonedx-py and need hatch-sbom[cdx].
uv uses uv export directly and needs hatch-sbom[uv].
pdm uses both pdm export and cyclonedx-py, so it needs hatch-sbom[pdm,cdx].

Next, configure the build hook specifically for the wheel target:

[tool.hatch.build.targets.wheel.hooks.sbom]
source = "requirements"
path = "requirements.txt"
format = "json"        # Optional, defaults to "json"
spec-version = "1.6"   # Optional, defaults to "1.6"

Supported Sources

The source field determines how the SBOM is built.

Source	Requires	Backend	Path behavior
`requirements`	`hatch-sbom[cdx]`	`cyclonedx-py requirements`	Optional; defaults to `requirements.txt` when present.
`poetry`	`hatch-sbom[cdx]`	`cyclonedx-py poetry`	Optional; defaults to the current directory.
`pipenv`	`hatch-sbom[cdx]`	`cyclonedx-py pipenv`	Optional; defaults to the current directory.
`environment`	`hatch-sbom[cdx]`	`cyclonedx-py environment`	Optional; defaults to the current directory.
`uv`	`hatch-sbom[uv]`	`uv export`	Optional; defaults to the current directory. Requires `uv.lock`.
`pdm`	`hatch-sbom[pdm,cdx]`	`pdm export`, then `cyclonedx-py requirements`	Optional; defaults to the current directory. Requires `pdm.lock`.

The uv source only supports json format and CycloneDX 1.5.

Source-Specific Arguments

You can pass extra arguments to the underlying tool (e.g., uv export, pdm export, or cyclonedx-py <source>) by creating a nested table named after the source.

This is useful for passing flags like --without, --no-dev, etc.

For example, to omit the dev and test groups when using Poetry:

[tool.hatch.build.targets.wheel.hooks.sbom.poetry]
without = ["dev", "test"]  # Appends `--without dev --without test`

To include all extras when using uv:

[tool.hatch.build.targets.wheel.hooks.sbom.uv]
all-extras = true  # Appends `--all-extras`

You can use the extra-args key to pass an arbitrary list of raw arguments:

[tool.hatch.build.targets.wheel.hooks.sbom.pipenv]
extra-args = ["--mc-type", "firmware"]

The generated SBOM file (e.g., sbom.cdx.json) will be automatically placed in the .dist-info/sboms/ directory of the resulting wheel.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

hatch_sbom-0.4.1.tar.gz (107.6 kB view details)

Uploaded Aug 2, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

hatch_sbom-0.4.1-py3-none-any.whl (7.6 kB view details)

Uploaded Aug 2, 2026 Python 3

File details

Details for the file hatch_sbom-0.4.1.tar.gz.

File metadata

Download URL: hatch_sbom-0.4.1.tar.gz
Upload date: Aug 2, 2026
Size: 107.6 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for hatch_sbom-0.4.1.tar.gz
Algorithm	Hash digest
SHA256	`d8704bb9edb79788a2b5a47d318d6dd55e85f4fff80fea0d57e4626855ee0d4a`
MD5	`2e216958144ceb1d94cdd89468bab2de`
BLAKE2b-256	`a18036e41fdcf9921e0d02d9880bfcfb03d0417727b87e1b4d7804d14ce2dcb4`

See more details on using hashes here.

Provenance

The following attestation bundles were made for hatch_sbom-0.4.1.tar.gz:

Publisher: cd-publish.yml on Ichunjo/hatch-sbom

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: hatch_sbom-0.4.1.tar.gz
- Subject digest: d8704bb9edb79788a2b5a47d318d6dd55e85f4fff80fea0d57e4626855ee0d4a
- Sigstore transparency entry: 2325104814
- Sigstore integration time: Aug 2, 2026
Source repository:
- Permalink: Ichunjo/hatch-sbom@d446ea8a38a505c28074dd4c91ead1cfd50373ea
- Branch / Tag: refs/tags/v0.4.1
- Owner: https://github.com/Ichunjo
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: cd-publish.yml@d446ea8a38a505c28074dd4c91ead1cfd50373ea
- Trigger Event: push