Export a conda-workspaces environment

conda workspace export uses the same exporter plugin hook as conda export. Install conda-sboms and conda-workspaces into the environment that owns the conda executable before using these commands. The behavior described below requires conda-workspaces 0.8.0 or newer.

For a standard conda installation, activate base and install both plugins:

conda activate base
conda install --channel conda-forge "conda-workspaces>=0.8.0" "conda-sboms>=0.3.0"

The CycloneDX exporter requires exact package records. A declared workspace manifest contains requirements rather than a solved package inventory, so use either an existing conda.lock or an installed workspace prefix.

Export from conda.lock

Choose one environment and one platform represented in the lockfile:

conda workspace export \
  --environment default \
  --from-lockfile \
  --platform linux-64 \
  --format cyclonedx-json \
  --file default-linux-64.cdx.json

This path does not solve or install into the workspace prefix. Current conda-workspaces converts lock entries through conda-lockfiles, which may download and extract archives into conda’s package cache to construct exact package records. Network access may therefore be required.

Every locked conda package for default on linux-64 becomes a component. The CycloneDX exporter is single-platform, so passing multiple --platform values fails. Current conda-workspaces rejects a selected lockfile environment and platform containing pip or other external package references before conda-sboms runs. Lockfile export therefore currently requires an all-conda selection.

The current workspace lock model does not retain the manifest’s authoritative top-level requirements. The exporter therefore connects the environment root to inferred graph roots and records conda:environment:root-dependency-source as inferred-graph-roots.

Export an installed workspace prefix

Use the installed prefix when its conda history is the preferred source of requested package roots:

conda workspace export \
  --environment default \
  --from-prefix \
  --from-history \
  --format cyclonedx-json \
  --file default.cdx.json

--from-history asks conda to populate the requested package set. When that metadata is available, the root source is requested-packages. Otherwise the exporter falls back to graph-root inference.

Without --from-lockfile or --from-prefix, conda-workspaces supplies only declared requirements. For one selected platform, conda-sboms rejects that input because it does not contain exact package records. A multi-platform workspace can fail earlier because the CycloneDX exporter accepts one platform per document.