You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This CycloneDX module for Python can generate valid CycloneDX bill-of-material document containing an aggregate of all
14
14
project dependencies.
15
15
16
-
This module is not designed for standalone use. If you're looking for a CycloneDX tool to run to generate (SBOM) software
17
-
bill-of-materials documents, why not checkout:
16
+
This module is not designed for standalone use.
17
+
If you're looking for a CycloneDX tool to run to generate (SBOM) software bill-of-materials documents, why not checkout:[CycloneDX Python][cyclonedx-python]
Additionally, the following tool can be used as well (and this library was written to help improve it) [Jake][jake].
23
20
24
21
Additionally, you can use this module yourself in your application to programmatically generate SBOMs.
25
22
@@ -29,7 +26,7 @@ CycloneDX is a lightweight BOM specification that is easily created, human-reada
29
26
30
27
Install from pypi.org as you would any other Python module:
31
28
32
-
```
29
+
```shell
33
30
pip install cyclonedx-python-lib
34
31
```
35
32
@@ -56,28 +53,28 @@ You can use one of the parsers to obtain information about your project or envir
56
53
| PipEnvFileParser |`from cyclonedx.parser.pipenv import PipEnvFileParser`| Parses the `Pipfile.lock` file at the supplied path. |
57
54
| PoetryParser |`from cyclonedx.parser.poetry import PoetryParser`| Parses `poetry.lock` content passed in as a string. |
58
55
| PoetryFileParser |`from cyclonedx.parser.poetry import PoetryFileParser`| Parses the `poetry.lock` file at the supplied path. |
59
-
| RequirementsParser |`from cyclonedx.parser.requirements import RequirementsParser`| Parses a multiline string that you provide that conforms to the `requirements.txt`[PEP-508](https://www.python.org/dev/peps/pep-0508/) standard. |
60
-
| RequirementsFileParser |`from cyclonedx.parser.requirements import RequirementsFileParser`| Parses a file that you provide the path to that conforms to the `requirements.txt`[PEP-508](https://www.python.org/dev/peps/pep-0508/) standard. |
56
+
| RequirementsParser |`from cyclonedx.parser.requirements import RequirementsParser`| Parses a multiline string that you provide that conforms to the `requirements.txt`[PEP-508] standard. |
57
+
| RequirementsFileParser |`from cyclonedx.parser.requirements import RequirementsFileParser`| Parses a file that you provide the path to that conforms to the `requirements.txt`[PEP-508] standard. |
61
58
62
59
#### Example
63
60
64
-
```
61
+
```py
65
62
from cyclonedx.parser.environment import EnvironmentParser
66
63
67
64
parser = EnvironmentParser()
68
65
```
69
66
70
67
#### Notes on Requirements parsing
71
68
72
-
CycloneDX software bill-of-materials require pinned versions of requirements. If your `requirements.txt` does not have
73
-
pinned versions, warnings will be recorded and the dependencies without pinned versions will be excluded from the
69
+
CycloneDX software bill-of-materials require pinned versions of requirements. If your `requirements.txt` does not have
70
+
pinned versions, warnings will be recorded and the dependencies without pinned versions will be excluded from the
74
71
generated CycloneDX. CycloneDX schemas (from version 1.0+) require a component to have a version when included in a
75
72
CycloneDX bill of materials (according to schema).
76
73
77
-
If you need to use a `requirements.txt` in your project that does not have pinned versions an acceptable workaround
74
+
If you need to use a `requirements.txt` in your project that does not have pinned versions an acceptable workaround
78
75
might be to:
79
76
80
-
```
77
+
```shell
81
78
pip install -r requirements.txt
82
79
pip freeze > requirements-frozen.txt
83
80
```
@@ -89,15 +86,15 @@ have `pip install`ed your dependencies.
89
86
90
87
You can create a BOM Model from either a Parser instance or manually using the methods avaialbel directly on the `Bom` class.
91
88
92
-
The model also supports definition of vulnerabilities for output using the CycloneDX schema extension for
89
+
The model also supports definition of vulnerabilities for output using the CycloneDX schema extension for
93
90
[Vulnerability Disclosures](https://cyclonedx.org/use-cases/#vulnerability-disclosure) as of version 0.3.0.
94
91
95
-
**Note:** Known vulnerabilities associated with Components can be sourced from various data sources, but this library
96
-
will not source them for you. Perhaps look at [Jake](https://github.com/sonatype-nexus-community/jake) if you're interested in this.
92
+
**Note:** Known vulnerabilities associated with Components can be sourced from various data sources, but this library
93
+
will not source them for you. Perhaps look at [Jake][jake] if you're interested in this.
97
94
98
95
#### Example from a Parser
99
96
100
-
```
97
+
```py
101
98
from cyclonedx.model.bom import Bom
102
99
from cyclonedx.parser.environment import EnvironmentParser
Once you have an instance of a `Bom` you can produce output in either `JSON` or `XML` against any of the supporting CycloneDX schema versions as you require.
111
108
112
109
We provide two helper methods:
113
-
1. Output to string (for you to do with as you require)
114
-
2. Output directly to a filename you provide
115
110
116
-
##### Example as JSON
111
+
* Output to string (for you to do with as you require)
112
+
* Output directly to a filename you provide
117
113
118
-
```
114
+
#### Example as JSON
115
+
116
+
```py
119
117
from cyclonedx.output import get_instance, OutputFormat
0 commit comments