conda-sboms

conda-sboms adds CycloneDX software bill of materials (SBOM) export to conda export. The current exporter writes CycloneDX 1.7 JSON from the exact package records of one resolved conda environment.

This is alpha software. Install the conda-forge package into the environment that owns the conda executable by following the installation guide.

After the plugin is installed in the environment that owns conda, export an installed environment by name:

conda export --name my-environment --from-history \
  --format cyclonedx-json \
  --file my-environment.cdx.json

The output identifies each resolved conda package, its available hashes and source metadata, and the dependency relationships recorded by conda. It does not inspect package contents or claim complete product coverage.

Where to start

Tutorial

Generate and inspect a CycloneDX SBOM from a small conda environment.

Generate your first SBOM

How-to guides

• Install the plugin

• Add product and author metadata

• Export a conda-workspaces environment

• Produce reproducible output

Reference

Look up format names, fields, graph rules, errors, and privacy behavior.

CycloneDX JSON exporter

Explanation

Understand the coverage limits, conda metadata limits, and relationship to CRA requirements.

Coverage and compliance

What the output describes

The SBOM is an inventory of the resolved conda package graph supplied to the exporter. It can contribute to product technical documentation. It does not establish that every component in a product has been found or that the product conforms to the Cyber Resilience Act.