---
id: distro2sbom
version: "0.6.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# distro2sbom — SBOM generator for system distribution

License: permissive · Maintenance: active · Downloads: 108.9K/mo

## What it is and what it does

Distro2sbom is a command-line tool that scans system package managers or input files to generate standardized SBOMs in SPDX or CycloneDX format. It works by querying installed distributions (rpm, deb, windows, freebsd, or auto-detected) and extracting package metadata, then serializing the results as JSON, YAML, or tag-value output. The tool is designed for integration into CI/CD pipelines to maintain auditable records of software components and versions used in deployments.

The package depends on lib4sbom for SBOM generation and serialization. It supports scanning either a specific installed package, all packages on a running system, or a pre-generated package list from a file. Metadata like product name, version, author, and component type can be customized via command-line flags. The tool is classified as Alpha and actively maintained, with support for modern Python versions (3.7 through 3.11).

Use it for:

- Generate SBOMs for CI/CD pipelines to track software components and versions deployed in production systems.
- Audit installed packages on a running system to support compliance and security reviews.
- Convert distribution package lists (rpm -qa, dpkg -l output) into standardized SBOM formats for supply chain analysis.
- Create SBOMs for containerized or virtualized environments to document all dependencies at deployment time.
- Support vulnerability tracking workflows by maintaining versioned records of all installed components.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates a Software Bill of Materials (SBOM) for installed packages or complete system distributions in SPDX and CycloneDX formats, identifying all dependent components.

Yes. The package fills a clear need for SBOM generation across multiple distribution types with low install friction, active maintenance, no known vulnerabilities, and a permissive license. It is suitable for security-conscious teams building CI/CD pipelines or conducting supply chain audits. The Alpha status and modest download volume suggest it is not yet widely adopted, so verify compatibility with your specific distribution and use case before production deployment.

## Install

pip install distro2sbom
uv add distro2sbom
poetry add distro2sbom

## Installing distro2sbom

Before you install: Low friction installation with a single runtime dependency (lib4sbom). Active maintenance with recent commits and regular releases since initial launch.

License in practice: Apache-2.0 permissive license allows commercial and private use with minimal restrictions; suitable for most deployment contexts.

Quickstart:

pip install distro2sbom

distro2sbom --system --sbom spdx --format json -o sbom.json

Requires Python 3.7 or later; tool relies on system package managers (rpm, dpkg, etc.) being present and accessible for the target distribution type.

Verify before relying:

- Actual performance and completeness when scanning large system installations with thousands of packages.
- Compatibility and accuracy across all supported distribution types (rpm, deb, windows, freebsd) in production environments.
- Whether lib4sbom dependency introduces additional system-level requirements or constraints.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 108.9K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

SBOM generator, software bill of materials, SPDX CycloneDX export, system package inventory, distribution SBOM, supply chain security, package dependency audit, sbom-generation, supply-chain-security, devops

[View on SkillFed](https://skillfed.io/packages/distro2sbom) · [View on PyPI](https://pypi.org/project/distro2sbom/)