meta_package_manager.cli_sbom module

The SBOM subcommand: export the package inventory as a standard document.

sbom renders the installed inventory as a SPDX or CycloneDX file, with optional metadata enrichment and an opt-in OSV vulnerability scan.

The mpm group itself, and the plumbing shared with the other subcommand modules, live in meta_package_manager.cli.

Important

The two writer modules are imported inside sbom(), the one place in the codebase deliberately breaking the imports-at-module-level rule. meta_package_manager.sbom.spdx and meta_package_manager.sbom.cyclonedx each pull a heavy third-party library at import time (spdx-tools, itself dragging beartype and license-expression, plus cyclonedx-python-lib), and cli.py imports every subcommand module up front to register it. So a module-level import here spent that cost on every mpm invocation, mpm --version included, for a library only this subcommand ever touches: deferring them took mpm --version from 750 ms to 440 ms on a machine carrying the optional [sbom-offline] extra.

Both are cheap no-ops for anyone without that extra, and the rest of this module still imports at the top: meta_package_manager.sbom.base costs under a millisecond and holds the ExportFormat enum the option declarations need at decoration time. tests.test_cli_sbom.test_cli_import_defers_sbom_libraries fails if the imports migrate back up.