Tool name: CycloneDX Python SBOM Generation Tool

### homepage_url

https://github.com/CycloneDX/cyclonedx-python/tree/main#readme-ov-file

### contact_email

jan.kowalleck [at] owasp.org

### code_view_url

https://github.com/CycloneDX/cyclonedx-python

### spdx_license_expression

Apache-2.0

### description

> **TLDR**: a polyglot SBOM generator for all python things.

This tool generates Software Bill of material (SBOM) documents in OWASP [CycloneDX](https://cyclonedx.org/) format.
Supported data sources are:

* Python (virtual) environment
* `Poetry` manifest and lockfile
* `Pipenv` manifest and lockfile
* Pip's `requirements.txt` format
* `PDM` manifest and lockfile are not explicitly supported.
However, PDM's Python virtual environments are fully supported. See the docs for an example.
* `Conda` as a package manager is no longer supported since version 4.
However, conda's Python environments are fully supported via the methods listed above. See the [docs](https://cyclonedx-bom-tool.readthedocs.io/) for an example.

Based on [OWASP Software Component Verification Standard for Software Bill of Materials](https://scvs.owasp.org/scvs/v2-software-bill-of-materials/)'
criteria, this tool is capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).

The resulting SBOM documents follow [official specifications and standards](https://github.com/CycloneDX/specification),
and might have properties following
[`cdx:python` Namespace Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/python.md),
[`cdx:pipenv` Namespace Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/pipenv.md),
[`cdx:poetry` Namespace Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/poetry.md)
.

### primary_languages

Python

### short_term_roadmap

all things are community efforts - come and help/contribute

- https://github.com/CycloneDX/cyclonedx-python/issues/843
- https://github.com/CycloneDX/cyclonedx-python/issues/833
- https://github.com/CycloneDX/cyclonedx-python/issues/839
- Have known bugs fixed
- Continue supporting the community in contributing new features

### long_term_roadmap

all things are community efforts - come and help/contribute

- https://github.com/CycloneDX/cyclonedx-python/issues/831
- https://github.com/CycloneDX/cyclonedx-python/issues/829
- https://github.com/CycloneDX/cyclonedx-python/issues/675
- https://github.com/CycloneDX/cyclonedx-python/issues/648
- https://github.com/CycloneDX/cyclonedx-python/issues/645
- https://github.com/CycloneDX/cyclonedx-python/issues/777
- Maintenance, refactoring, etc
- Continue supporting the community in contributing new features

### proprietary_data

- [ ] Yes, the tool depends on proprietary data sources

### commercial_features

- [ ] Yes, the tool has a commercial version with different/additional features

### capabilities

- [x] Identifiers - Use Package-URL (PURL) identifiers
- [x] Identifiers - Use SPDX license expressions
- [x] Scanning - Analyze package manifests and lockfiles
- [x] Scanning - Analyze package files
- [ ] Scanning - Scan for copyright
- [x] Scanning - Scan for license
- [ ] Scanning - Analyze source code
- [ ] Scanning - Analyze containers
- [x] Scanning - Analyze installed system packages (linux distros)
- [x] Scanning - Analyze installed application packages
- [x] Scanning - Other analysis
- [x] Packages - Inventory packages
- [x] Packages - Inventory packages dependencies
- [ ] Packages - Resolve dependencies
- [ ] Packages - Navigate or display dependency graph
- [x] Compliance - Generate CycloneDX SBOMs
- [ ] Compliance - Generate SPDX SBOMs
- [ ] Compliance - Validate CycloneDX SBOM
- [x] Compliance - Validate SPDX SBOMs
- [ ] Compliance - Generate CycloneDX VEX
- [ ] Compliance - Generate CSAF VEX
- [ ] Compliance - Generate OpenVex
- [ ] Compliance - Generate other compliance documents
- [ ] Policies - Define and check license policies
- [ ] Policies - Define and check security policies
- [ ] Policies - Define and check other policies
- [ ] Data - Database of Package metadata
- [ ] Data - Database of Package dependency relationships
- [ ] Data - Database of License obligations
- [ ] Data - Database of Licenses
- [ ] Data - Database of Vulnerabilities
- [ ] License - Help triage license issues
- [ ] License - Generate license credit and attribution notices
- [ ] License - Generate source code redistribution lists
- [ ] Vulnerabilities - Detect vulnerable code in packages
- [ ] Vulnerabilities - Find known vulnerabilities for package
- [ ] Vulnerabilities - Determine reachable vulnerabilities
- [ ] Vulnerabilities - Help triage vulnerabilities
- [ ] Binaries - Analyze binaries
- [ ] Binaries - Analyze ELF binaries
- [ ] Binaries - Analyze Windows binaries
- [ ] Binaries - Analyze firmware binaries
- [ ] Binaries - Analyze Other binaries
- [ ] Matching - Match source code
- [ ] Matching - Match binary code
- [ ] Tracing - Trace code execution
- [ ] Tracing - Trace build
- [ ] Code Security - Analyze code statically (SAST/linting)
- [ ] Code Security - Analyze code dynamically (DAST)
- [ ] Download - Source package
- [ ] Download - Source repositories
- [ ] Download - Binary package
- [x] Deployment - Deployable as containers (Docker/OCI/k8s/etc)
- [x] Deployment - Deployable in CI/CD pipelines
- [x] Deployment - Deployable as a library
- [x] Run - Run as a command line tool
- [ ] Run - Run as a web application
- [ ] Run - Run as an API service

### other_capabilities

_No response_