lib4sbom
Software Bill of Material (SBOM) generator and consumer library
Decision gist · record as of 2026-08-14
Yes. Lib4sbom is actively maintained, has no known vulnerabilities, and solves a real problem for anyone working with multiple SBOM formats. The low install friction and broad Python version support (3.9–3.14) make it a straightforward dependency. The alpha status reflects ongoing development, but the API is stable enough for production use in supply-chain and DevSecOps workflows.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.9 or later.
- Low install friction; pure Python wheel with seven runtime dependencies (pyyaml, semantic_version, defusedxml, fastjsonschema, jsonschema, xmlschema, packageurl-python).
- Active maintenance with recent releases; last commit 2026-08-10.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license; you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.
last release 2026-04-17 (119 days) · last repo commit 2026-08-10 · 44 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 317,001 downloads/mo, #7,668 on PyPI
Alternatives
Verify before relying
pip install lib4sbom
from lib4sbom.parser import SBOMParser
parser = SBOMParser()
parser.parse_file('sbom.spdx')
packages = parser.get_packages()- Whether the library can round-trip SBOMs (parse and regenerate) without data loss across all supported formats.
- Performance characteristics when parsing very large SBOMs with thousands of packages.
- Completeness of SPDX RDF and XML support beyond the noted 'few package attributes'.
What it is and what it does
Lib4sbom is a Python library that abstracts away the differences between SPDX and CycloneDX SBOM formats, letting you parse and generate bills of materials without rewriting code for each format. It handles SPDX versions 2.2, 2.3, and 3.0 in TagValue, JSON, YAML, XML, RDF, and JSON-LD formats, plus CycloneDX versions 1.4 through 1.7 in JSON and XML. The library also supports parsing SBOMs embedded in In-Toto attestations and Protobom objects.
You work with a common set of SBOM data objects—files, packages, relationships, vulnerabilities, services, and cryptography metadata—regardless of which format you're reading or writing. This is useful for DevSecOps pipelines, supply-chain security tooling, and any workflow that needs to consume or produce SBOMs from multiple sources without format-specific branching logic.
Use it for
- Parse SBOMs from different tools (e.g., Syft, CycloneDX generators) into a unified data model for analysis.
- Convert between SPDX and CycloneDX formats by parsing one and generating the other.
- Extract vulnerability, package, and relationship data from SBOMs for compliance or risk reporting.
- Build DevSecOps automation that ingests SBOMs from CI/CD pipelines without caring which format they use.
- Embed SBOM parsing into security scanning tools that need to work with multiple SBOM standards.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
Lib4sbom is actively maintained, has no known vulnerabilities, and solves a real problem for anyone working with multiple SBOM formats. The low install friction and broad Python version support (3.9–3.14) make it a straightforward dependency. The alpha status reflects ongoing development, but the API is stable enough for production use in supply-chain and DevSecOps workflows.
Install
lib4sbom on PyPI
Before you install
Low install friction; pure Python wheel with seven runtime dependencies (pyyaml, semantic_version, defusedxml, fastjsonschema, jsonschema, xmlschema, packageurl-python). Active maintenance with recent releases; last commit 2026-08-10.
Requires Python 3.9 or later.
License in practice
Apache-2.0 permissive license; you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.
Quickstart
pip install lib4sbom
from lib4sbom.parser import SBOMParser
parser = SBOMParser()
parser.parse_file('sbom.spdx')
packages = parser.get_packages()Verify before relying
- Whether the library can round-trip SBOMs (parse and regenerate) without data loss across all supported formats.
- Performance characteristics when parsing very large SBOMs with thousands of packages.
- Completeness of SPDX RDF and XML support beyond the noted 'few package attributes'.
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 7 packagespyyamlsemantic_versiondefusedxmlfastjsonschemajsonschemaxmlschemapackageurl-python |
| Maintenance | Actively maintained 119 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 317,001 / month, #7,668 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 3 - AlphaIntended Audience :: DevelopersNatural Language :: EnglishOperating System :: OS IndependentProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.9Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPy |
Evidence: lib4sbom-0.10.4-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “SBOM parser generator”
- lib4sbomLib4sbom parses and generates Software Bill of Materials (SBOMs) in…
- lib4vexLib4VEX parses and generates VEX (Vulnerability Exploitability…
- cyclonedx-pyGenerates Software Bill of Materials (SBOM) documents in CycloneDX…
Give your agent the search over MCP, or paste the wish link into any chat.
More Build Tools packages
Provides reusable utilities for Python packaging interoperability, including version handling, specifiers, markers, requirements, tags, and metadata parsing according to standards like PEP 440 and PEP 425.
Wraps any iterable to display a real-time progress bar in the terminal or Jupyter notebook, showing iteration count, elapsed time, and estimated time remaining.
pip is the standard installer for Python packages, enabling you to download and install packages from the Python Package Index and other indexes into your Python environment.
Hatchling is a standards-compliant Python build backend that handles packaging, metadata, and distribution of Python projects when configured in a project's pyproject.toml file.
Generates Python gRPC service stubs and message classes from Protocol Buffer definitions, enabling developers to build gRPC clients and servers.
pre-commit is a framework for installing and running git hooks written in any language before commits are made, automating code quality and validation checks across multi-language projects.
Install it if your team needs consistent, automated validation at commit time.
See also distro2sbom · lib4vex · spdx-python-model · cyclonedx-bom · cyclonedx-python-lib · cyclonedx-py · spdx-tools · scancode-toolkit · socketdev · spdx3-validate