Metadata-Version: 2.5
Name: python-sbom
Version: 0.1.2
Import-Name: python_sbom
Summary: SBOMs for Python distributions: write PEP 770 CycloneDX SBOMs into wheels.
Project-URL: Changelog, https://python-sbom.readthedocs.io/en/latest/changelog.html
Project-URL: Documentation, https://python-sbom.readthedocs.io
Project-URL: Homepage, https://github.com/tox-dev/python-sbom
Project-URL: Source, https://github.com/tox-dev/python-sbom
Project-URL: Tracker, https://github.com/tox-dev/python-sbom/issues
Maintainer-email: Bernát Gábor <gaborjbernat@gmail.com>
License-Expression: MIT AND Apache-2.0
License-File: LICENSE
License-File: src/python_sbom/_validate/schemas/LICENSE
Keywords: cyclonedx,hatch,pep770,sbom,spdx
Classifier: Development Status :: 4 - Beta
Classifier: Framework :: Hatch
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3.15
Classifier: Programming Language :: Python :: Implementation :: CPython
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Build Tools
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: installer>=1.1
Requires-Dist: packageurl-python>=0.11.1
Requires-Dist: packaging>=26.3
Requires-Dist: zipremove>=0.10
Provides-Extra: hatch
Requires-Dist: hatchling>=1.28; extra == 'hatch'
Provides-Extra: validate
Requires-Dist: jsonschema-rs>=0.60.3; extra == 'validate'
Requires-Dist: license-expression>=30; extra == 'validate'
Requires-Dist: spdx-tools>=0.8.5; extra == 'validate'
Description-Content-Type: text/markdown

# python-sbom

[![PyPI](https://img.shields.io/pypi/v/python-sbom?style=flat-square)](https://pypi.org/project/python-sbom/)
[![Supported Python versions](https://img.shields.io/pypi/pyversions/python-sbom.svg)](https://pypi.org/project/python-sbom/)
[![check](https://github.com/tox-dev/python-sbom/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/python-sbom/actions/workflows/check.yaml)
[![Documentation Status](https://readthedocs.org/projects/python-sbom/badge/?version=latest)](https://python-sbom.readthedocs.io/en/latest/?badge=latest)
[![Downloads](https://static.pepy.tech/badge/python-sbom/month)](https://pepy.tech/project/python-sbom)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/python-sbom/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/python-sbom)

SBOMs for Python distributions. python-sbom writes a [CycloneDX](https://cyclonedx.org/) SBOM into every wheel you
build, where [PEP 770](https://peps.python.org/pep-0770/) tells installers to keep it. The SBOM records your project,
the runtime dependencies it declares, any wheels it bundles, and the build toolchain, and a rebuild with the same inputs
reproduces it byte for byte.

## Install

A hatchling project names `python-sbom[hatch]` in its build requirements, as shown below. To embed an SBOM into a wheel
another backend built, install the command line into the environment that built the wheel, since the SBOM lists that
environment's packages as the build tools (or point `--build-env` at it):

```console
python -m pip install python-sbom
```

To convert and validate SBOMs in CI, a separate tool environment is fine:

```console
pipx install 'python-sbom[validate]'
```

## Use

With [hatchling](https://hatch.pypa.io/latest/), add the hook to the build requirements and enable it:

```toml
[build-system]
build-backend = "hatchling.build"
requires = ["hatchling>=1.28", "python-sbom[hatch]>=0.1"]

[tool.hatch.build.hooks.python-sbom]
```

With another build backend, such as meson-python, embed the SBOM after the build:

```console
python-sbom embed dist/*.whl
```

Describe another zip archive the project publishes, such as a zipapp, with `python-sbom archive`. The
[documentation](https://python-sbom.readthedocs.io) covers the options, adding project knowledge through a content
provider, rendering an SBOM as SPDX and validating it.
