• Stars
    star
    234
  • Rank 170,871 (Top 4 %)
  • Language
    Python
  • License
    Apache License 2.0
  • Created almost 6 years ago
  • Updated about 1 month ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

CycloneDX Python SBOM Generation Tool

shield_gh-workflow-test shield_rtfd shield_pypi-version shield_docker-version shield_license
shield_website shield_slack shield_groups shield_twitter-follow


This project provides a runnable Python-based application for generating CycloneDX bill-of-material documents from either:

  • Your current Python Environment
  • Your project's manifest (e.g. Pipfile.lock, poetry.lock or requirements.txt)
  • Conda as a Package Manager

The BOM will contain an aggregate of all your current project's dependencies, or those defined by the manifest you supply.

CycloneDX is a lightweight BOM specification that is easily created, human-readable, and simple to parse.

Read the full documentation for more details.

Installation

Install this from PyPi.org using your preferred Python package manager.

Example using pip:

pip install cyclonedx-bom

Example using poetry:

poetry add cyclonedx-bom

Usage

Call via one of commands:

cyclonedx-py
python3 -m cyclonedx_py

Basic usage

$ cyclonedx-py --help
usage: cyclonedx-py [-h] (-c | -cj | -e | -p | -pip | -r) [-i FILE_PATH]
                 [--format {json,xml}] [--schema-version {1.4,1.3,1.2,1.1,1.0}]
                 [-o FILE_PATH] [-F] [-X]

CycloneDX SBOM Generator

optional arguments:
  -h, --help            show this help message and exit
  -c, --conda           Build a SBOM based on the output from `conda list
                        --explicit` or `conda list --explicit --md5`
  -cj, --conda-json     Build a SBOM based on the output from `conda list
                        --json`
  -e, --e, --environment
                        Build a SBOM based on the packages installed in your
                        current Python environment (default)
  -p, --p, --poetry     Build a SBOM based on a Poetry poetry.lock's contents.
                        Use with -i to specify absolute path to a `poetry.lock`
                        you wish to use, else we'll look for one in the
                        current working directory.
  -pip, --pip           Build a SBOM based on a PipEnv Pipfile.lock's
                        contents. Use with -i to specify absolute path to a
                        `Pipfile.lock` you wish to use, else we'll look for
                        one in the current working directory.
  -r, --r, --requirements
                        Build a SBOM based on a requirements.txt's contents.
                        Use with -i to specify absolute path to a
                        `requirements.txt` you wish to use, else we'll look
                        for one in the current working directory.
  -X                    Enable debug output

Input Method:
  Flags to determine how this tool obtains its input

  -i FILE_PATH, --in-file FILE_PATH
                        File to read input from. Use "-" to read from STDIN.

SBOM Output Configuration:
  Choose the output format and schema version

  --format {json,xml}   The output format for your SBOM (default: xml)
  --schema-version {1.4,1.3,1.2,1.1,1.0}
                        The CycloneDX schema version for your SBOM (default:
                        1.4)
  -o FILE_PATH, --o FILE_PATH, --output FILE_PATH
                        Output file path for your SBOM (set to '-' to output
                        to STDOUT)
  -F, --force           If outputting to a file and the stated file already
                        exists, it will be overwritten.
  -pb, --purl-bom-ref   Use a component's PURL for the bom-ref value, instead
                        of a random UUID

Advanced usage and details

See the full documentation for advanced usage and details on input formats, switches and options.

Python Support

We endeavour to support all functionality for all current actively supported Python versions. However, some features may not be possible/present in older Python versions due to their lack of support.

Contributing

Feel free to open issues, bugreports or pull requests.
See the CONTRIBUTING file for details.

Copyright & License

CycloneDX BOM is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the LICENSE file for the full license.

More Repositories

1

cdxgen

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. Slack: https://cyclonedx.slack.com/archives/C04NFFE1962
JavaScript
503
star
2

specification

CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, OBOM, VDR, and VEX
XSLT
252
star
3

cyclonedx-cli

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
C#
245
star
4

cyclonedx-maven-plugin

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
Java
209
star
5

cyclonedx-dotnet

Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
C#
119
star
6

cyclonedx-node-module

creates CycloneDX Software Bill of Materials (SBOM) from node-based projects
108
star
7

bom-examples

A repository with examples of CycloneDX BOMs (SBOM, SaaSBOM, OBOM, VEX, etc)
105
star
8

cyclonedx-gradle-plugin

Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects
Java
92
star
9

cyclonedx-rust-cargo

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects
Rust
90
star
10

cyclonedx-gomod

Creates CycloneDX Software Bill of Materials (SBOM) from Go modules
Go
90
star
11

cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs
Java
76
star
12

cyclonedx-node-npm

Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.
TypeScript
69
star
13

cyclonedx-bom-repo-server

A BOM repository server for distributing CycloneDX BOMs
C#
68
star
14

cyclonedx-python-lib

Python implementation of OWASP CycloneDX
Python
65
star
15

cyclonedx-php-composer

Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects
PHP
48
star
16

transparency-exchange-api

A standard API specification for exchanging supply chain artifacts and intelligence
43
star
17

cyclonedx-go

Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)
Go
42
star
18

cyclonedx-linux-generator

Lockheed Martin developed utility to generate CycloneDX SBOMs for Linux distributions
Java
32
star
19

sbom-utility

Utility that provides an API platform for validating, querying and managing BOM data
Go
30
star
20

cyclonedx-conan

Creates CycloneDX Software Bill of Materials (SBOM) documents for C/C++ projects using Conan
Python
23
star
21

license-scanner

Utility that provides an API and CLI to identify licenses and legal terms
Go
20
star
22

gh-node-module-generatebom

GitHub action to generate a CycloneDX SBOM for Node.js
JavaScript
20
star
23

cyclonedx-webpack-plugin

Create CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.
TypeScript
18
star
24

cyclonedx-node-yarn

Create CycloneDX Software Bill of Materials (SBOM) from Node.js Yarn projects.
JavaScript
18
star
25

cyclonedx-ruby-gem

Creates CycloneDX Software Bill of Materials (SBOM) from Ruby projects
Ruby
17
star
26

cyclonedx-javascript-library

Core functionality of OWASP CycloneDX for JavaScript (Node.js or WebBrowser) written in TypeScript.
TypeScript
15
star
27

cyclonedx-web-tool

A web based tool for working with CycloneDX BOMs
HTML
15
star
28

cyclonedx-dotnet-library

.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)
C#
14
star
29

cyclonedx-cocoapods

Creates CycloneDX Software Bill-of-Materials (SBOM) from Objective-C and Swift projects that use CocoaPods.
Ruby
14
star
30

sbom-comparator

Lockheed Martin developed utility to compare two CycloneDX SBOMs
Java
14
star
31

gh-python-generate-sbom

GitHub action to generate a CycloneDX SBOM for Python
JavaScript
12
star
32

cyclonedx-node-pnpm

Create CycloneDX Software Bill of Materials (SBOM) from Node.js PNPM projects.
12
star
33

cdxgen-action

GitHub action for CycloneDX BOM generator (cdxgen). cdxgen produced bom xml file can be uploaded to dependency track, AppThreat and other commercial Software Composition Analysis (SCA) products
JavaScript
9
star
34

gh-gomod-generate-sbom

GitHub action to generate a CycloneDX SBOM for Go modules
JavaScript
9
star
35

gh-dotnet-generate-sbom

GitHub action to generate a CycloneDX SBOM for .NET
JavaScript
8
star
36

cyclonedx-property-taxonomy

A taxonomy of all official property namespaces and names
8
star
37

sbom-combiner

Lockheed Martin developed utility to combine multiple CycloneDX SBOMs
Java
7
star
38

cyclonedx-authoring-tool

An experimental user interface for manually creating, editing, and viewing CycloneDX SBOMs
Vue
7
star
39

cyclonedx-php-library

PHP Implementation of CycloneDX Bill of Materials (BOM)
PHP
6
star
40

cyclonedx.org

Public website
HTML
5
star
41

guides

CSS
5
star
42

cyclonedx-nuget

Creates CycloneDX Software Bill-of-Materials (SBoM) from NuGet projects
Java
3
star
43

cyclonedx-buildroot

Create CycloneDX Software Bill of Materials (SBOM) for Buildroot projects
Python
2
star
44

cdxgen-plugins-bin

Binary plugins for @cyclonedx/cdxgen npm package
PowerShell
2
star
45

sbom-commons

Lockheed Martin developed common SBOM library
Java
1
star
46

homebrew-cyclonedx

CycloneDX Homebrew Tap
Ruby
1
star
47

cyclonedx-conda

conda plugin to generate CycloneDX SBOM
1
star
48

cyclonedx-otm-java

EXPERIMENTAL CycloneDX library and utility to convert BOMs into Open Threat Model (OTM) format
Java
1
star
49

gh-php-composer-generate-sbom

GitHub action to generate a CycloneDX SBOM for PHP Composer
JavaScript
1
star
50

sbom-commons-combiner

Lockheed Martin developed common library to combine multiple SBOMs
Java
1
star
51

gh-cocoapods-generate-sbom

GitHub action to generate a CycloneDX SBOM for Swift and Objective-C projects that use CocoaPods.
1
star
52

cyclonedx-esbuild-plugin

Create CycloneDX Software Bill of Materials (SBOM) from esbuild bundles at compile time.
1
star