Generate a workspace SBOM

Install conda-sboms into conda’s base environment so conda can discover the plugin:

conda install -n base "conda-forge::conda-sboms>=0.3.0"

Generate from a lockfile

Create or refresh conda.lock, then export the default environment for the current platform:

conda workspace lock
conda workspace sbom --file exports/default.cdx.json

To export a different environment or platform:

conda workspace sbom \
  --environment test \
  --platform linux-64 \
  --file exports/test-linux-64.cdx.json

The command reads conda.lock as-is. It does not solve, update the lockfile, or fetch package archives. For a named platform such as linux-64-cuda, pass either its declared name or its backing subdir. Use the declared name when multiple variants share one subdir.

Generate from an installed prefix

Use --from-prefix to inventory an installed workspace environment:

conda workspace sbom \
  --environment test \
  --from-prefix \
  --file exports/test-installed.cdx.json

Prefix mode supports the host platform only. If --platform names another platform, the command stops with an error.

Add product and author metadata

Only add product and author details you can verify:

conda workspace sbom \
  --file exports/acme-runtime.cdx.json \
  --product-name "Acme Runtime" \
  --product-version "2026.08" \
  --product-manufacturer "Acme GmbH" \
  --product-manufacturer-url "https://acme.example" \
  --author-name "Alice Example" \
  --author-email "alice@acme.example" \
  --author-organization "Acme Product Security" \
  --author-organization-url "https://acme.example/security"

Pass --product-name and --product-version together. --product-manufacturer requires both, and --product-manufacturer-url also requires --product-manufacturer. --author-email requires --author-name, while --author-organization-url requires --author-organization.

Without metadata flags, conda-sboms uses its configured plugin values. Once any metadata flag is present, only values given on this command are used. Omitted fields stay unset.

Make the output reproducible

Pass --reproducible to omit metadata.timestamp and record cdx:reproducible=true:

conda workspace sbom --reproducible \
  --file exports/default.cdx.json

The flag takes precedence over SOURCE_DATE_EPOCH. If the SBOM needs a stable timestamp instead, set SOURCE_DATE_EPOCH:

SOURCE_DATE_EPOCH=1787184000 conda workspace sbom \
  --file exports/default.cdx.json

Without --reproducible, conda-sboms rejects an invalid, negative, or unsupported SOURCE_DATE_EPOCH before writing output. Matching output byte for byte also depends on unchanged inputs and the same conda-sboms and serializer versions.

See Export and format interoperability for how lockfile and prefix input differ and which packages each mode includes. See CLI Reference for every command option.