Command line interface¶

Write, convert and check the CycloneDX SBOMs of wheels.

python-sbom [-h] [--version] {embed,archive,spdx,validate} ...

options¶

-h, --help - show this help message and exit
--version - show program’s version number and exit

embed¶

Write the SBOM the hatchling hook writes into wheels another build backend built, such as meson-python. Options come from the [tool.python-sbom] table of the project’s pyproject.toml.

python-sbom embed [-h] [--root DIR] [--commit SHA] [--build-env DIR]
                  [--content-provider MODULE:ATTRIBUTE]
                  WHEEL [WHEEL ...]

embed positional arguments¶

WHEEL - wheel to rewrite in place

embed options¶

-h, --help - show this help message and exit
--root DIR - project directory of the artifact (default: current directory)
--commit SHA - source revision to record, for an artifact built from an sdist
--build-env DIR - site-packages directory of the environment that built the artifact; repeat it per directory (default: this interpreter’s)
--content-provider MODULE:ATTRIBUTE - content provider, overriding the content-provider option

archive¶

Describe a zip archive that holds the project’s .dist-info at its top level, such as a zipapp: the archive’s own files, the project’s distribution, and every wheel it bundles, as a file or unpacked, described as the wheel’s SBOM describes them. Options come from [tool.python-sbom].

python-sbom archive [-h] [--root DIR] [--commit SHA] [--build-env DIR]
                    [--content-provider MODULE:ATTRIBUTE] [--build-script PATH]
                    [--output FILE] [--embed]
                    ARCHIVE

archive positional arguments¶

ARCHIVE - archive to describe

archive options¶

-h, --help - show this help message and exit
--root DIR - project directory of the artifact (default: current directory)
--commit SHA - source revision to record, for an artifact built from an sdist
--build-env DIR - site-packages directory of the environment that built the artifact; repeat it per directory (default: this interpreter’s)
--content-provider MODULE:ATTRIBUTE - content provider, overriding the content-provider option
--build-script PATH - script, relative to the project, that built the archive; repeat it per script
--output FILE - SBOM file to write (default: <archive>.cdx.json next to it)
--embed - also add the SBOM to the archive, at its top level as <archive>.cdx.json

spdx¶

Render a CycloneDX JSON SBOM, such as one python-sbom wrote, as an SPDX 2.3 JSON document. It checks only the fields the rendering reads, so it needs no extra; python-sbom validate checks the whole document.

python-sbom spdx [-h] SOURCE TARGET

spdx positional arguments¶

SOURCE - CycloneDX JSON file to read
TARGET - SPDX JSON file to write

spdx options¶

-h, --help - show this help message and exit

validate¶

Check every CycloneDX SBOM a wheel or archive holds against the CycloneDX 1.6 schema; for one python-sbom wrote, also its serial number, references, SPDX rendering and, with --allow-license, the licenses of what it ships. Needs the validate extra: python-sbom[validate].

python-sbom validate [-h] [--allow-license SPDX-ID] [--max-components N] PATH [PATH ...]

validate positional arguments¶

PATH - wheel, archive, or directory holding wheels

validate options¶

-h, --help - show this help message and exit
--allow-license SPDX-ID - SPDX license id shipped components may use; repeat it per id, leave it out to skip the license policy
--max-components N - reject an SBOM listing more than N components, nested ones included, or larger than 1 MiB plus 1 KiB per component, without checking it further, which bounds the work an untrusted SBOM can ask for (default: 100000)