cyclonedx-py

What it is and what it does

cyclonedx-py is a command-line tool that generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects and environments. It reads from multiple sources—Python virtual environments, Poetry manifests and lockfiles, Pipenv manifests and lockfiles, and pip requirements.txt files—and produces standardized SBOM output that follows official CycloneDX specifications and taxonomies. The tool is designed to be accurate and comprehensive for Python-related projects.

The package wraps the CycloneDX Python library and exposes a stable CLI interface. It does not provide a public Python API; all code is internal and subject to change. The tool aims to produce SBOMs that nearly meet OWASP Software Component Verification Standard Level-2 criteria (signing must be done externally). It is actively maintained and runs on Python >=3.9,<4.

Use it for:

• Generate a complete SBOM from a Poetry or Pipenv project for supply-chain security audits.
• Create an SBOM from a Python virtual environment to document all installed dependencies.
• Convert pip requirements.txt files into standardized CycloneDX SBOM format for compliance.
• Produce SBOMs that comply with OWASP SCVS criteria for software component verification.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates Software Bill of Materials (SBOM) documents in CycloneDX format from Python projects, virtual environments, and package managers like Poetry, Pipenv, and pip.

Yes, if you need to generate SBOMs for Python projects. The tool is actively maintained, has low install friction, and covers the most common Python dependency sources. Verify the license terms before use in proprietary contexts, and confirm it supports your specific package manager or environment setup.

Install

cyclonedx-py on PyPI

pip install cyclonedx-py

uv add cyclonedx-py

poetry add cyclonedx-py

Installing cyclonedx-py

Before you install

Low friction installation as a pure Python wheel. Actively maintained with recent commits and a stable repository; no notable install concerns.

License in practice

License treatment is unclear from the package metadata, though the description excerpt mentions Apache 2.0 terms. Verify the actual license before use in proprietary or restricted contexts.

Quickstart

pip install cyclonedx-bom
cyclonedx-py environment --output-file sbom.xml
# or: python3 -m cyclonedx_py environment --output-file sbom.xml

Requires Python >=3.9,<4 as stated in the description.

Verify before relying

• Exact license identifier and terms (description mentions Apache 2.0 but metadata shows 'unclear').
• Whether the package exposes a stable public API for programmatic use beyond the CLI.
• Support for additional Python package managers or lock file formats beyond those listed.

Package facts

Evidence: cyclonedx_py-1.0.1-py3-none-any.whl

Tags

More Build Tools packages