Skip to content

Commit

Permalink
doc: cleanup
Browse files Browse the repository at this point in the history
Signed-off-by: Paul Horton <phorton@sonatype.com>
  • Loading branch information
madpah committed Jan 10, 2022
1 parent 5a7c61b commit baf955d
Showing 1 changed file with 0 additions and 107 deletions.
107 changes: 0 additions & 107 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -93,114 +93,7 @@ SBOM Output Configuration:
exists, it will be overwritten.
```

### Building CycloneDX for your current Python environment

This will produce the most accurate and complete CycloneDX BOM as it will include all transitive dependencies required
by the packages defined in your project's manifest (think `requriements.txt`).

When using _Environment_ as the source, any license information available from the installed packages will also be
included in the generated CycloneDX BOM.

Simply run:

```shell
cyclonedx-bom -e -o -
```

This will generate a CycloneDX including all packages installed in your current Python environment and output to STDOUT
in XML using the latest schema version `1.3` by default.

### Building CycloneDX from your Manifest / Package Manager

_Note: Manifest scanning limits the amount of information available. Each manifest type contains different information
but all are significantly less complete than scanning your actual Python Environment._

#### Conda

We support parsing output from Conda in various formats:

* Explict output (run `conda list --explicit` or `conda list --explicit --md5`)
* JSON output (run `conda list --json`)

As example:

```shell
conda list --explicit --md5 | cyclonedx-bom -c -o cyclonedx.xml
```

#### Poetry

We support parsing your `poetry.lock` file which should be committed along with your `pyrpoject.toml` and details
exact pinned versions.

You can then run `cyclonedx-bom` as follows:

```shell
cyclonedx-bom -p -i PATH/TO/poetry.lock -o sbom.xml
```

If your `poetry.lock` is in the current working directory, you can also shorten this to:

```shell
cyclonedx-bom -p -o sbom.xml
```

#### Pip

We currently support `Pipfile.lock` manifest files.

You can then run `cyclonedx-bom` as follows:

```shell
cyclonedx-bom -pip -i PATH/TO/Pipfile.lock -o sbom.xml
```

If your `Pipfile.lock` is in the current working directory, you can also shorten this to:

```shell
cyclonedx-bom -pip -o sbom.xml
```

#### Requirements

We currently support `requirements.txt` manifest files. Note that a BOM such as CycloneDX expects exact version numbers,
therefore if you wish to generate a BOM from a `requirements.txt`, these must be frozen. This can be accomplished via:

```shell
pip freeze > requirements.txt
```

You can then run `cyclonedx-bom` as follows:

```shell
cyclonedx-bom -r -i PATH/TO/requirements.txt -o sbom.xml
```

If your `requirements.txt` is in the current working directory, you can also shorten this to:

```shell
cyclonedx-bom -r -o sbom.xml
```

This will generate a CycloneDX and output to STDOUT in XML using the latest schema version `1.3` by default.

**Note:** If you failed to freeze your dependencies before passing the `requirements.txt` data to `cyclonedx-bom`,
you'll be warned about this and the dependencies that do not have pinned versions WILL NOT be included in the resulting
CycloneDX output.

```text
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! Some of your dependencies do not have pinned version !!
!! numbers in your requirements.txt !!
!! !!
!! -> idna !!
!! -> requests !!
!! -> urllib3 !!
!! !!
!! The above will NOT be included in the generated !!
!! CycloneDX as version is a mandatory field. !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
```

## Python Support

Expand Down

0 comments on commit baf955d

Please sign in to comment.