lib4sbom

What it is and what it does

Lib4sbom is a Python library that abstracts away the differences between SPDX and CycloneDX SBOM formats, letting you parse and generate bills of materials without rewriting code for each format. It handles SPDX versions 2.2, 2.3, and 3.0 in TagValue, JSON, YAML, XML, RDF, and JSON-LD formats, plus CycloneDX versions 1.4 through 1.7 in JSON and XML. The library also supports parsing SBOMs embedded in In-Toto attestations and Protobom objects.

You work with a common set of SBOM data objects—files, packages, relationships, vulnerabilities, services, and cryptography metadata—regardless of which format you're reading or writing. This is useful for DevSecOps pipelines, supply-chain security tooling, and any workflow that needs to consume or produce SBOMs from multiple sources without format-specific branching logic.

Use it for:

• Parse SBOMs from different tools (e.g., Syft, CycloneDX generators) into a unified data model for analysis.
• Convert between SPDX and CycloneDX formats by parsing one and generating the other.
• Extract vulnerability, package, and relationship data from SBOMs for compliance or risk reporting.
• Build DevSecOps automation that ingests SBOMs from CI/CD pipelines without caring which format they use.
• Embed SBOM parsing into security scanning tools that need to work with multiple SBOM standards.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Lib4sbom parses and generates Software Bill of Materials (SBOMs) in SPDX and CycloneDX formats, providing a unified abstraction layer to work with SBOMs regardless of their underlying format.

Yes. Lib4sbom is actively maintained, has no known vulnerabilities, and solves a real problem for anyone working with multiple SBOM formats. The low install friction and broad Python version support (3.9–3.14) make it a straightforward dependency. The alpha status reflects ongoing development, but the API is stable enough for production use in supply-chain and DevSecOps workflows.

Install

lib4sbom on PyPI

pip install lib4sbom

uv add lib4sbom

poetry add lib4sbom

Installing lib4sbom

Before you install

Low install friction; pure Python wheel with seven runtime dependencies (pyyaml, semantic_version, defusedxml, fastjsonschema, jsonschema, xmlschema, packageurl-python). Active maintenance with recent releases; last commit 2026-08-10.

License in practice

Apache-2.0 permissive license; you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install lib4sbom

from lib4sbom.parser import SBOMParser

parser = SBOMParser()
parser.parse_file('sbom.spdx')
packages = parser.get_packages()

Requires Python 3.9 or later.

Verify before relying

• Whether the library can round-trip SBOMs (parse and regenerate) without data loss across all supported formats.
• Performance characteristics when parsing very large SBOMs with thousands of packages.
• Completeness of SPDX RDF and XML support beyond the noted 'few package attributes'.

Package facts

Evidence: lib4sbom-0.10.4-py3-none-any.whl

Keywords: security, tools, SBOM, DevSecOps, SPDX, CycloneDX, library

Tags

More Build Tools packages