meta_package_manager.sbom.base module

Format-agnostic SBOM base class and export-format enum.

Kept deliberately free of SPDX or CycloneDX dependencies: instantiating SBOM directly is meaningless, but importing the symbols here is safe even when the optional [sbom-offline] extra is not installed.

class meta_package_manager.sbom.base.ExportFormat(*values)

Bases: StrEnum

A user-friendly version of spdx_tools.spdx.formats.FileFormat.

Map format to user-friendly IDs.

JSON = 'json'

XML = 'xml'

YAML = 'yaml'

TAG_VALUE = 'tag'

RDF_XML = 'rdf'

class meta_package_manager.sbom.base.SBOM(export_format=ExportFormat.JSON)

Bases: object

Utilities shared by all SBOM classes.

See also

Anchore’s Syft and Microsoft’s sbom-tool are mature SPDX and CycloneDX emitters, useful references for field-population conventions. Both inventory packages by parsing on-disk databases and lockfiles, whereas mpm queries the live managers directly.

Defaults to JSON export format.

packages_per_manager: dict[str, int]

enriched_per_manager: dict[str, int]

vulnerabilities_by_purl: dict[str, tuple[Vulnerability, ...]]

all_purls()

Yield every package purl present in the document.

Powers the vulnerability scan: the network layer queries OSV once with the full purl set rather than once per package. Subclasses implement this against their own component index.

Return type:

Iterator[str]

attach_vulnerabilities(vulnerabilities)

Bind cross-package vulnerability data to the document.

Called by the CLI between the per-package add_package loop and finalize, only in --network mode. Renderers read the stored data in their finalize override and project it into the format-native vulnerability surface (CycloneDX vulnerabilities array, SPDX security externalRefs).

Return type:

None

stats()

Return a summary of what landed in the document.

Format-agnostic counters live in the base implementation; SPDX and CycloneDX subclasses extend the returned dict with their own merged-documents, dependency-graph, and any other format-specific counts. Surfaced by the CLI as a post-run INFO-level summary and usable by tests or programmatic consumers without re-parsing the rendered document.

Return type:

dict[str, object]

finalize()

Resolve any deferred state before export().

Some constructs cannot be emitted at add_package() time because they reference packages that may not have been added yet: a Homebrew formula’s runtime dependency on another formula listed later in the scan, for example. Subclasses queue those during add_package and flush them here. The base implementation is a no-op so subclasses can rely on it being called exactly once.

Return type:

None

static autodetect_export_format(file_path)

Better version of spdx_tools.spdx.formats.file_name_to_format which is based on Path objects and is case-insensitive.

Todo

Contribute generic autodetection method to Click Extra?

Return type:

ExportFormat | None