Tool name: CycloneDX Python SBOM Generation Tool

[jkowalleck]

homepage_url

https://github.com/CycloneDX/cyclonedx-python/tree/main#readme-ov-file

contact_email

jan.kowalleck [at] owasp.org

code_view_url

https://github.com/CycloneDX/cyclonedx-python

spdx_license_expression

Apache-2.0

description

TLDR: a polyglot SBOM generator for all python things.

This tool generates Software Bill of material (SBOM) documents in OWASP CycloneDX format.
Supported data sources are:

• Python (virtual) environment
• Poetry manifest and lockfile
• Pipenv manifest and lockfile
• Pip's requirements.txt format
• PDM manifest and lockfile are not explicitly supported.
  However, PDM's Python virtual environments are fully supported. See the docs for an example.
• Conda as a package manager is no longer supported since version 4.
  However, conda's Python environments are fully supported via the methods listed above. See the docs for an example.

Based on OWASP Software Component Verification Standard for Software Bill of Materials'
criteria, this tool is capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).

The resulting SBOM documents follow official specifications and standards,
and might have properties following
cdx:python Namespace Taxonomy,
cdx:pipenv Namespace Taxonomy,
cdx:poetry Namespace Taxonomy
.

primary_languages

Python

short_term_roadmap

all things are community efforts - come and help/contribute

• feat(environment): finalize and enable PEP-639 der default CycloneDX/cyclonedx-python#843
• [META] chore: revisit PEP compliances CycloneDX/cyclonedx-python#833
• feat: support poetry v2 CycloneDX/cyclonedx-python#839
• Have known bugs fixed
• Continue supporting the community in contributing new features

long_term_roadmap

all things are community efforts - come and help/contribute

• [IDEA] feat: support PEP-770 - bundled (phantom) dependencies  CycloneDX/cyclonedx-python#831
• feat: include component.evidence.identity in the SBOM CycloneDX/cyclonedx-python#829
• feat: mark dev-dependencies component.scope as "excluded" CycloneDX/cyclonedx-python#675
• feat: populate component.authors CycloneDX/cyclonedx-python#648
• feat: support hatch ecosystem CycloneDX/cyclonedx-python#645
• feat: improve PDM reports reading lock and only report production dependencies CycloneDX/cyclonedx-python#777
• Maintenance, refactoring, etc
• Continue supporting the community in contributing new features

proprietary_data

• Yes, the tool depends on proprietary data sources

commercial_features

• Yes, the tool has a commercial version with different/additional features

capabilities

• Identifiers - Use Package-URL (PURL) identifiers
• Identifiers - Use SPDX license expressions
• Scanning - Analyze package manifests and lockfiles
• Scanning - Analyze package files
• Scanning - Scan for copyright
• Scanning - Scan for license
• Scanning - Analyze source code
• Scanning - Analyze containers
• Scanning - Analyze installed system packages (linux distros)
• Scanning - Analyze installed application packages
• Scanning - Other analysis
• Packages - Inventory packages
• Packages - Inventory packages dependencies
• Packages - Resolve dependencies
• Packages - Navigate or display dependency graph
• Compliance - Generate CycloneDX SBOMs
• Compliance - Generate SPDX SBOMs
• Compliance - Validate CycloneDX SBOM
• Compliance - Validate SPDX SBOMs
• Compliance - Generate CycloneDX VEX
• Compliance - Generate CSAF VEX
• Compliance - Generate OpenVex
• Compliance - Generate other compliance documents
• Policies - Define and check license policies
• Policies - Define and check security policies
• Policies - Define and check other policies
• Data - Database of Package metadata
• Data - Database of Package dependency relationships
• Data - Database of License obligations
• Data - Database of Licenses
• Data - Database of Vulnerabilities
• License - Help triage license issues
• License - Generate license credit and attribution notices
• License - Generate source code redistribution lists
• Vulnerabilities - Detect vulnerable code in packages
• Vulnerabilities - Find known vulnerabilities for package
• Vulnerabilities - Determine reachable vulnerabilities
• Vulnerabilities - Help triage vulnerabilities
• Binaries - Analyze binaries
• Binaries - Analyze ELF binaries
• Binaries - Analyze Windows binaries
• Binaries - Analyze firmware binaries
• Binaries - Analyze Other binaries
• Matching - Match source code
• Matching - Match binary code
• Tracing - Trace code execution
• Tracing - Trace build
• Code Security - Analyze code statically (SAST/linting)
• Code Security - Analyze code dynamically (DAST)
• Download - Source package
• Download - Source repositories
• Download - Binary package
• Deployment - Deployable as containers (Docker/OCI/k8s/etc)
• Deployment - Deployable in CI/CD pipelines
• Deployment - Deployable as a library
• Run - Run as a command line tool
• Run - Run as a web application
• Run - Run as an API service

other_capabilities

No response