{"categories":[{"label":"Build Tools","url":"https://skillfed.io/packages/category/software-development-build-tools/3"}],"enrichment":{"capability":"Lib4sbom parses and generates Software Bill of Materials (SBOMs) in SPDX and CycloneDX formats, providing a unified abstraction layer to work with SBOMs regardless of their underlying format.","skillfed_tags":["sbom","supply-chain-security","devops"],"use_cases":["Parse SBOMs from different tools (e.g., Syft, CycloneDX generators) into a unified data model for analysis.","Convert between SPDX and CycloneDX formats by parsing one and generating the other.","Extract vulnerability, package, and relationship data from SBOMs for compliance or risk reporting.","Build DevSecOps automation that ingests SBOMs from CI/CD pipelines without caring which format they use.","Embed SBOM parsing into security scanning tools that need to work with multiple SBOM standards."],"what_it_does":"Lib4sbom is a Python library that abstracts away the differences between SPDX and CycloneDX SBOM formats, letting you parse and generate bills of materials without rewriting code for each format. It handles SPDX versions 2.2, 2.3, and 3.0 in TagValue, JSON, YAML, XML, RDF, and JSON-LD formats, plus CycloneDX versions 1.4 through 1.7 in JSON and XML. The library also supports parsing SBOMs embedded in In-Toto attestations and Protobom objects.\n\nYou work with a common set of SBOM data objects\u2014files, packages, relationships, vulnerabilities, services, and cryptography metadata\u2014regardless of which format you're reading or writing. This is useful for DevSecOps pipelines, supply-chain security tooling, and any workflow that needs to consume or produce SBOMs from multiple sources without format-specific branching logic.","worth_installing":"Yes. Lib4sbom is actively maintained, has no known vulnerabilities, and solves a real problem for anyone working with multiple SBOM formats. The low install friction and broad Python version support (3.9\u20133.14) make it a straightforward dependency. The alpha status reflects ongoing development, but the API is stable enough for production use in supply-chain and DevSecOps workflows."},"id":"lib4sbom","links":{"html":"https://skillfed.io/packages/lib4sbom","md":"https://skillfed.io/packages/lib4sbom.md","pypi":"https://pypi.org/project/lib4sbom/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-04-17","license_spdx":null,"license_treatment":"permissive","name":"lib4sbom","python_support":"supports_current","summary":"Software Bill of Material (SBOM) generator and consumer library"},"popularity":{"monthly_downloads":317001,"position":7668,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.10.4"}