---
id: lib4sbom
version: "0.10.4"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# lib4sbom — Software Bill of Material (SBOM) generator and consumer library

License: permissive · Maintenance: active · Downloads: 317.0K/mo

## What it is and what it does

Lib4sbom is a Python library that abstracts away the differences between SPDX and CycloneDX SBOM formats, letting you parse and generate bills of materials without rewriting code for each format. It handles SPDX versions 2.2, 2.3, and 3.0 in TagValue, JSON, YAML, XML, RDF, and JSON-LD formats, plus CycloneDX versions 1.4 through 1.7 in JSON and XML. The library also supports parsing SBOMs embedded in In-Toto attestations and Protobom objects.

You work with a common set of SBOM data objects—files, packages, relationships, vulnerabilities, services, and cryptography metadata—regardless of which format you're reading or writing. This is useful for DevSecOps pipelines, supply-chain security tooling, and any workflow that needs to consume or produce SBOMs from multiple sources without format-specific branching logic.

Use it for:

- Parse SBOMs from different tools (e.g., Syft, CycloneDX generators) into a unified data model for analysis.
- Convert between SPDX and CycloneDX formats by parsing one and generating the other.
- Extract vulnerability, package, and relationship data from SBOMs for compliance or risk reporting.
- Build DevSecOps automation that ingests SBOMs from CI/CD pipelines without caring which format they use.
- Embed SBOM parsing into security scanning tools that need to work with multiple SBOM standards.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Lib4sbom parses and generates Software Bill of Materials (SBOMs) in SPDX and CycloneDX formats, providing a unified abstraction layer to work with SBOMs regardless of their underlying format.

Yes. Lib4sbom is actively maintained, has no known vulnerabilities, and solves a real problem for anyone working with multiple SBOM formats. The low install friction and broad Python version support (3.9–3.14) make it a straightforward dependency. The alpha status reflects ongoing development, but the API is stable enough for production use in supply-chain and DevSecOps workflows.

## Install

pip install lib4sbom
uv add lib4sbom
poetry add lib4sbom

## Installing lib4sbom

Before you install: Low install friction; pure Python wheel with seven runtime dependencies (pyyaml, semantic_version, defusedxml, fastjsonschema, jsonschema, xmlschema, packageurl-python). Active maintenance with recent releases; last commit 2026-08-10.

License in practice: Apache-2.0 permissive license; you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install lib4sbom

from lib4sbom.parser import SBOMParser

parser = SBOMParser()
parser.parse_file('sbom.spdx')
packages = parser.get_packages()

Requires Python 3.9 or later.

Verify before relying:

- Whether the library can round-trip SBOMs (parse and regenerate) without data loss across all supported formats.
- Performance characteristics when parsing very large SBOMs with thousands of packages.
- Completeness of SPDX RDF and XML support beyond the noted 'few package attributes'.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 317.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

SBOM parser generator, software bill of materials library, SPDX CycloneDX parsing, SBOM format conversion, supply chain component tracking, DevSecOps SBOM tools, vulnerability tracking SBOM, sbom, supply-chain-security, devops

[View on SkillFed](https://skillfed.io/packages/lib4sbom) · [View on PyPI](https://pypi.org/project/lib4sbom/)