meta_package_manager.sbom.cyclonedx module

CycloneDX 1.7 writer.

Heavy cyclonedx-python-lib imports are guarded behind a try/except block; cyclonedx_support reports whether the CycloneDX class can actually be used.

The license-normalization helper is shared with spdx and is imported from there rather than duplicated: SPDX license expressions are the lingua franca CycloneDX builds on, so the dependency direction is intentional and acyclic.

class meta_package_manager.sbom.cyclonedx.CycloneDX(export_format=ExportFormat.JSON)

Bases: SBOM

Generates a CycloneDX document from a list of packages.

CycloneDX 1.7 specifications.

Defaults to JSON export format.

document: Bom

component_index: dict[tuple[str, str], Component]

pending_dependencies: list[tuple[Component, str, str]]

init_doc()

CycloneDX document metadata specifications.

Return type:

None

add_package(manager, package, metadata=PackageMetadata(download_url=None, homepage=None, vcs_url=None, issue_tracker_url=None, distribution_url=None, license_declared=None, license_concluded=None, copyright_text=None, supplier=None, originator=None, description=None, summary=None, cpe=None, dependencies=(), checksums=(), files=(), files_analyzed=False, install_date=None, build_date=None, release_date=None, external_sbom_path=None, extra_purls=(), extras={}))

CycloneDX package metadata specifications.

Return type:

None

all_purls()

Yield every component purl in insertion order.

Each component’s bom_ref is its purl string, so the same values double as the vulnerability affects targets in finalize().

Return type:

Iterator[str]

finalize()

Resolve queued dependency edges and attach vulnerability records.

Mirrors meta_package_manager.sbom.spdx.SPDX.finalize(). Dangling references (the dependency target is not in the inventory) are dropped silently.

Vulnerability data bound via meta_package_manager.sbom.base.SBOM.attach_vulnerabilities() is projected into the CycloneDX vulnerabilities array. Each advisory is described once at the document level with an affects list pointing at every component (by bom_ref, which equals the purl) it impacts.

Return type:

None

stats()

Extend the base stats with CycloneDX-specific counters.

CycloneDX has no merge-content equivalent: per-package upstream SBOMs are linked through externalReferences[type=bom] rather than spliced in. The merged-document count therefore reports the number of components carrying a BOM external reference. The dependency-edge total walks the registered dependency graph and sums the dependsOn collection size across every entry.

Return type:

dict[str, object]

export()

Serialize the document to its string representation.

Note

Unlike meta_package_manager.sbom.spdx.SPDX.export(), the generated document is not validated against its schema here. CycloneDX schema validation relies on cyclonedx-python-lib’s [validation] extra, which pulls in jsonschema and, transitively, rfc3987-syntax, lark, and lxml. To keep that stack out of mpm’s runtime dependencies, the validation runs in the test suite instead. See tests/test_cli_sbom.py.

Return type:

str