Metadata-Version: 2.5
Name: python-sbom
Version: 0.2.0
Import-Name: python_sbom
Summary: SBOMs for Python distributions: write PEP 770 CycloneDX SBOMs into wheels.
Project-URL: Changelog, https://python-sbom.readthedocs.io/en/latest/changelog.html
Project-URL: Documentation, https://python-sbom.readthedocs.io
Project-URL: Homepage, https://github.com/tox-dev/python-sbom
Project-URL: Source, https://github.com/tox-dev/python-sbom
Project-URL: Tracker, https://github.com/tox-dev/python-sbom/issues
Maintainer-email: Bernát Gábor <gaborjbernat@gmail.com>
License-Expression: MIT AND Apache-2.0
License-File: LICENSE
License-File: src/python_sbom/_validate/schemas/LICENSE
Keywords: cyclonedx,hatch,maturin,meson-python,pdm-backend,pep517,pep770,sbom,setuptools,spdx
Classifier: Development Status :: 4 - Beta
Classifier: Framework :: Hatch
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3.15
Classifier: Programming Language :: Python :: Implementation :: CPython
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Build Tools
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: installer>=1.1
Requires-Dist: packageurl-python>=0.11.1
Requires-Dist: packaging>=26.3
Requires-Dist: zipremove>=0.10
Provides-Extra: hatch
Requires-Dist: hatchling>=1.28; extra == 'hatch'
Provides-Extra: pdm
Requires-Dist: pdm-backend>=2.4; extra == 'pdm'
Provides-Extra: setuptools
Requires-Dist: setuptools>=77; extra == 'setuptools'
Provides-Extra: validate
Requires-Dist: jsonschema-rs>=0.60.3; extra == 'validate'
Requires-Dist: license-expression>=30; extra == 'validate'
Requires-Dist: spdx-tools>=0.8.5; extra == 'validate'
Description-Content-Type: text/markdown

<picture>
  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/tox-dev/python-sbom/main/docs/_static/logo-horizontal-dark.svg">
  <img alt="python-sbom" src="https://raw.githubusercontent.com/tox-dev/python-sbom/main/docs/_static/logo-horizontal-light.svg" width="480">
</picture>

# python-sbom

[![PyPI](https://img.shields.io/pypi/v/python-sbom?style=flat-square)](https://pypi.org/project/python-sbom/)
[![Supported Python versions](https://img.shields.io/pypi/pyversions/python-sbom.svg)](https://pypi.org/project/python-sbom/)
[![check](https://github.com/tox-dev/python-sbom/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/python-sbom/actions/workflows/check.yaml)
[![Documentation Status](https://readthedocs.org/projects/python-sbom/badge/?version=latest)](https://python-sbom.readthedocs.io/en/latest/?badge=latest)
[![Downloads](https://static.pepy.tech/badge/python-sbom/month)](https://pepy.tech/project/python-sbom)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/python-sbom/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/python-sbom)

Software bills of materials (SBOMs) for Python distributions. python-sbom writes a [CycloneDX](https://cyclonedx.org/)
SBOM into every [wheel](https://packaging.python.org/en/latest/specifications/binary-distribution-format/) you build,
where [PEP 770](https://peps.python.org/pep-0770/) (a Python Enhancement Proposal) tells installers to keep it. The SBOM
records your project, the runtime dependencies it declares, any wheels it bundles, and the build toolchain, and a
rebuild with the same inputs reproduces it byte for byte.

## Use

python-sbom works with every [build backend](https://peps.python.org/pep-0517/). Pick the integration for yours:

| Backend                                                                                                                                                                                                           | Add to `[build-system] requires` | Turn it on                                                                        |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | --------------------------------------------------------------------------------- |
| [hatchling](https://hatch.pypa.io/latest/)                                                                                                                                                                        | `python-sbom[hatch]`             | `[tool.hatch.build.hooks.python-sbom]`                                            |
| [pdm-backend](https://backend.pdm-project.org/)                                                                                                                                                                   | `python-sbom[pdm]`               | `[tool.python-sbom]`                                                              |
| [setuptools](https://setuptools.pypa.io/)                                                                                                                                                                         | `python-sbom[setuptools]`        | `[tool.python-sbom]`                                                              |
| any other, such as [meson-python](https://mesonbuild.com/meson-python/), [maturin](https://www.maturin.rs/), [scikit-build-core](https://scikit-build-core.readthedocs.io/) or [flit-core](https://flit.pypa.io/) | `python-sbom`                    | `build-backend = "python_sbom.backend"`, and your backend in `[tool.python-sbom]` |

With hatchling:

```toml
[build-system]
build-backend = "hatchling.build"
requires = ["hatchling>=1.28", "python-sbom[hatch]>=0.2"]

[tool.hatch.build.hooks.python-sbom]
```

With meson-python, or any backend without a plugin, python-sbom wraps it:

```toml
[build-system]
build-backend = "python_sbom.backend"
requires = ["meson-python>=0.18", "python-sbom>=0.2"]

[tool.python-sbom]
build-backend = "mesonpy"
```

For a wheel built outside the build interface, such as with [`maturin build`](https://www.maturin.rs/), or renamed after
it by [`auditwheel repair`](https://github.com/pypa/auditwheel), embed the SBOM afterwards:

```console
python-sbom embed dist/*.whl
```

To convert and validate SBOMs in continuous integration (CI), install the command line in a tool environment of its own
with [pipx](https://pipx.pypa.io/) or [uv](https://docs.astral.sh/uv/):

```console
pipx install 'python-sbom[validate]'
python-sbom validate dist/
```

The [documentation](https://python-sbom.readthedocs.io) starts with a tutorial, then has a guide per backend, the
options and commands, and how the SBOM is built. It also covers describing a
[zipapp](https://docs.python.org/3/library/zipapp.html), adding project knowledge through a content provider, and
rendering an SBOM as [SPDX](https://spdx.dev/) (Software Package Data Exchange).
