1.安装方式

https://cyclonedx.org/tool-center/介绍了多种工具，适用于各种语言的，
https://pypi.org/project/cyclonedx-bom/此为python支持的版本，
参数：

$ cyclonedx-py --help
usage: cyclonedx-py [-h] (-c | -cj | -e | -p | -pip | -r) [-i FILE_PATH]
                 [--format {json,xml}] [--schema-version {1.4,1.3,1.2,1.1,1.0}]
                 [-o FILE_PATH] [-F] [-X]

CycloneDX SBOM Generator

optional arguments:
  -h, --help            show this help message and exit
  -c, --conda           Build a SBOM based on the output from `conda list
                        --explicit` or `conda list --explicit --md5`
  -cj, --conda-json     Build a SBOM based on the output from `conda list
                        --json`
  -e, --e, --environment
                        Build a SBOM based on the packages installed in your
                        current Python environment (default)
  -p, --p, --poetry     Build a SBOM based on a Poetry poetry.lock's contents.
                        Use with -i to specify absolute path to a `poetry.lock`
                        you wish to use, else we'll look for one in the
                        current working directory.
  -pip, --pip           Build a SBOM based on a PipEnv Pipfile.lock's
                        contents. Use with -i to specify absolute path to a
                        `Pipfile.lock` you wish to use, else we'll look for
                        one in the current working directory.
  -r, --r, --requirements
                        Build a SBOM based on a requirements.txt's contents.
                        Use with -i to specify absolute path to a
                        `requirements.txt` you wish to use, else we'll look
                        for one in the current working directory.
  -X                    Enable debug output

Input Method:
  Flags to determine how this tool obtains it's input

  -i FILE_PATH, --in-file FILE_PATH
                        File to read input from. Use "-" to read from STDIN.

SBOM Output Configuration:
  Choose the output format and schema version

  --format {json,xml}   The output format for your SBOM (default: xml)
  --schema-version {1.4,1.3,1.2,1.1,1.0}
                        The CycloneDX schema version for your SBOM (default:
                        1.4)
  -o FILE_PATH, --o FILE_PATH, --output FILE_PATH
                        Output file path for your SBOM (set to '-' to output
                        to STDOUT)
  -F, --force           If outputting to a file and the stated file already
                        exists, it will be overwritten.
  -pb, --purl-bom-ref   Use a component's PURL for the bom-ref value, instead
                        of a random UUID

2.使用示例

 cyclonedx-py -i requirements.txt --format json  -o file.json -r

这里指定了requirements.txt和格式为json,生成file.json为bom

{"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:2c9d5c4a-bc15-4a0e-b860-98a15387f05b", "version": 1, "metadata": {"timestamp": "2023-07-11T05:24:51.380241+00:00", "tools": [{"vendor": "CycloneDX", "name": "cyclonedx-bom", "version": "3.11.0"}, {"vendor": "CycloneDX", "name": "cyclonedx-python-lib", "version": "3.1.5", "externalReferences": [{"url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions", "type": "build-system"}, {"url": "https://pypi.org/project/cyclonedx-python-lib/", "type": "distribution"}, {"url": "https://cyclonedx.github.io/cyclonedx-python-lib/", "type": "documentation"}, {"url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues", "type": "issue-tracker"}, {"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE", "type": "license"}, {"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md", "type": "release-notes"}, {"url": "https://github.com/CycloneDX/cyclonedx-python-lib", "type": "vcs"}, {"url": "https://cyclonedx.org", "type": "website"}]}]}, "components": [{"type": "library", "bom-ref": "5da16235-360d-4296-aab1-c280a1bcfa1e", "name": "Flask", "version": "2.3.2", "purl": "pkg:pypi/flask@2.3.2"}, {"type": "library", "bom-ref": "10d0faac-8eaf-4c52-afd6-21ac99c6c8f1", "name": "Flask-Cors", "version": "4.0.0", "purl": "pkg:pypi/flask-cors@4.0.0"}, {"type": "library", "bom-ref": "96cf3814-4588-4cb3-9e52-b0e9a3b85a87", "name": "Flask-Migrate", "version": "4.0.4", "purl": "pkg:pypi/flask-migrate@4.0.4"}, {"type": "library", "bom-ref": "95af8ed7-debc-483b-b35e-1d5b7cad4637", "name": "Flask-RESTful", "version": "0.3.10", "purl": "pkg:pypi/flask-restful@0.3.10"}, {"type": "library", "bom-ref": "513a3ef2-8d45-4f74-b58f-3f68f9cfa57c", "name": "Flask-SQLAlchemy", "version": "3.0.5", "purl": "pkg:pypi/flask-sqlalchemy@3.0.5"}, {"type": "library", "bom-ref": "d5df013d-642b-4b6a-990f-f49c27a2c6f8", "name": "Flask-SSE", "version": "1.0.0", "purl": "pkg:pypi/flask-sse@1.0.0"}, {"type": "library", "bom-ref": "a6c27aff-2dc1-4155-96c9-1e4d33ee3e56", "name": "Flask-Script", "version": "2.0.6", "purl": "pkg:pypi/flask-script@2.0.6"}, {"type": "library", "bom-ref": "c20ed5dd-090e-4dec-9674-8faa1779faf3", "name": "Flask-Session", "version": "0.5.0", "purl": "pkg:pypi/flask-session@0.5.0"}, {"type": "library", "bom-ref": "5ebea659-a02c-41dd-bce3-c4042337da30", "name": "Flask-WTF", "version": "1.1.1", "purl": "pkg:pypi/flask-wtf@1.1.1"}, {"type": "library", "bom-ref": "d15de5a1-c276-46af-8eab-403cf291f4d2", "name": "Jinja2", "version": "3.1.2", "purl": "pkg:pypi/jinja2@3.1.2"}, {"type": "library", "bom-ref": "b9adcebe-9604-4ca9-b61b-3ce1db567918", "name": "Mako", "version": "1.2.4", "purl": "pkg:pypi/mako@1.2.4"}, {"type": "library", "bom-ref": "ab5d1104-d8a1-4c9b-8906-e58c0e44ba61", "name": "MarkupSafe", "version": "2.1.3", "purl": "pkg:pypi/markupsafe@2.1.3"}, {"type": "library", "bom-ref": "f0883500-f188-4070-a636-0e23f91aa7c9", "name": "PyMySQL", "version": "1.1.0", "purl": "pkg:pypi/pymysql@1.1.0"}, {"type": "library", "bom-ref": "40681da4-2acd-44db-a025-63661385bd5b", "name": "SQLAlchemy", "version": "2.0.17", "purl": "pkg:pypi/sqlalchemy@2.0.17"}, {"type": "library", "bom-ref": "f0d94395-8d1a-4245-a37a-575aa801c52e", "name": "WTForms", "version": "3.0.1", "purl": "pkg:pypi/wtforms@3.0.1"}, {"type": "library", "bom-ref": "1b62ba04-9371-4614-8e66-4a26947c5cf0", "name": "Werkzeug", "version": "2.3.6", "purl": "pkg:pypi/werkzeug@2.3.6"}, {"type": "library", "bom-ref": "9a1ac150-d19c-49dc-a794-0ee479071497", "name": "alembic", "version": "1.11.1", "purl": "pkg:pypi/alembic@1.11.1"}, {"type": "library", "bom-ref": "92d2d5f5-113b-46e6-ad7b-19c3bcb652eb", "name": "aniso8601", "version": "9.0.1", "purl": "pkg:pypi/aniso8601@9.0.1"}, {"type": "library", "bom-ref": "6f126359-477d-44f9-968c-070913fa993d", "name": "arrow", "version": "1.2.3", "purl": "pkg:pypi/arrow@1.2.3"}, {"type": "library", "bom-ref": "a75256c4-8b19-426f-ae29-8623bb5b924f", "name": "async-timeout", "version": "4.0.2", "purl": "pkg:pypi/async-timeout@4.0.2"}, {"type": "library", "bom-ref": "403bdad0-b880-435f-a014-b28d7f0b36f0", "name": "blinker", "version": "1.6.2", "purl": "pkg:pypi/blinker@1.6.2"}, {"type": "library", "bom-ref": "f33d8bd7-beb6-4aab-bd30-f243465605a4", "name": "cachelib", "version": "0.10.2", "purl": "pkg:pypi/cachelib@0.10.2"}, {"type": "library", "bom-ref": "5d146930-cd6f-4aa1-ba18-dd7fb57d8ebc", "name": "cffi", "version": "1.15.1", "purl": "pkg:pypi/cffi@1.15.1"}, {"type": "library", "bom-ref": "d745a921-f251-42e3-a484-b98ee09fe88a", "name": "click", "version": "8.1.3", "purl": "pkg:pypi/click@8.1.3"}, {"type": "library", "bom-ref": "c4048333-46b9-42a7-9ec7-e0a77b694db5", "name": "colorama", "version": "0.4.6", "purl": "pkg:pypi/colorama@0.4.6"}, {"type": "library", "bom-ref": "7ccdd3b4-3212-498b-ab9f-c4a1b597ce08", "name": "cryptography", "version": "41.0.1", "purl": "pkg:pypi/cryptography@41.0.1"}, {"type": "library", "bom-ref": "b81208b6-5f7e-48f2-80b4-00e0cf66a253", "name": "greenlet", "version": "2.0.2", "purl": "pkg:pypi/greenlet@2.0.2"}, {"type": "library", "bom-ref": "4e0d0d57-19b6-4c3e-ae78-033c9aebae4c", "name": "httplib2", "version": "0.22.0", "purl": "pkg:pypi/httplib2@0.22.0"}, {"type": "library", "bom-ref": "880dd909-9767-4b98-b875-9b1643295d8d", "name": "importlib-metadata", "version": "6.7.0", "purl": "pkg:pypi/importlib-metadata@6.7.0"}, {"type": "library", "bom-ref": "4505e74f-7a1f-4e02-9ee1-78ce2c9e0b2c", "name": "itsdangerous", "version": "2.1.2", "purl": "pkg:pypi/itsdangerous@2.1.2"}, {"type": "library", "bom-ref": "afcbd332-e9b2-47e9-a361-fa89e5d412d5", "name": "mysql-connector", "version": "2.2.9", "purl": "pkg:pypi/mysql-connector@2.2.9"}, {"type": "library", "bom-ref": "4df62a2b-f7c0-4b55-99e0-cea07fa444f7", "name": "numpy", "version": "1.25.0", "purl": "pkg:pypi/numpy@1.25.0"}, {"type": "library", "bom-ref": "7357f19c-1e24-4a45-9a48-77d87009845b", "name": "pandas", "version": "2.0.3", "purl": "pkg:pypi/pandas@2.0.3"}, {"type": "library", "bom-ref": "58499599-5eb2-400b-94dd-162c99cc6ad1", "name": "psutil", "version": "5.9.5", "purl": "pkg:pypi/psutil@5.9.5"}, {"type": "library", "bom-ref": "b15ef46c-d4b5-4218-9bc9-42dc08e62953", "name": "pyOpenSSL", "version": "23.2.0", "purl": "pkg:pypi/pyopenssl@23.2.0"}, {"type": "library", "bom-ref": "f1304177-89c7-4257-a369-98e44f52255d", "name": "pycparser", "version": "2.21", "purl": "pkg:pypi/pycparser@2.21"}, {"type": "library", "bom-ref": "c8a3b98b-faed-46bb-85e3-b45c01afd1d2", "name": "pyparsing", "version": "3.1.0", "purl": "pkg:pypi/pyparsing@3.1.0"}, {"type": "library", "bom-ref": "004746cb-65af-47c1-a32a-ff5dd39608a9", "name": "python-dateutil", "version": "2.8.2", "purl": "pkg:pypi/python-dateutil@2.8.2"}, {"type": "library", "bom-ref": "98f107ce-ccbb-4779-9398-8bf9fe5f965d", "name": "pytz", "version": "2023.3", "purl": "pkg:pypi/pytz@2023.3"}, {"type": "library", "bom-ref": "4d1ee2c0-06df-454b-87e1-94172561c034", "name": "redis", "version": "4.6.0", "purl": "pkg:pypi/redis@4.6.0"}, {"type": "library", "bom-ref": "4fd6bbb5-104b-4d42-a229-2812629e5300", "name": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0"}, {"type": "library", "bom-ref": "6f881966-62aa-4597-9049-ab28b7f6d137", "name": "typing_extensions", "version": "4.7.1", "purl": "pkg:pypi/typing-extensions@4.7.1"}, {"type": "library", "bom-ref": "d1066cf3-344d-4ce8-946b-604eccd0977a", "name": "tzdata", "version": "2023.3", "purl": "pkg:pypi/tzdata@2023.3"}, {"type": "library", "bom-ref": "59db8c1a-6c49-4729-925e-848093a34274", "name": "zipp", "version": "3.15.0", "purl": "pkg:pypi/zipp@3.15.0"}], "dependencies": [{"ref": "5da16235-360d-4296-aab1-c280a1bcfa1e", "dependsOn": []}, {"ref": "10d0faac-8eaf-4c52-afd6-21ac99c6c8f1", "dependsOn": []}, {"ref": "96cf3814-4588-4cb3-9e52-b0e9a3b85a87", "dependsOn": []}, {"ref": "95af8ed7-debc-483b-b35e-1d5b7cad4637", "dependsOn": []}, {"ref": "513a3ef2-8d45-4f74-b58f-3f68f9cfa57c", "dependsOn": []}, {"ref": "d5df013d-642b-4b6a-990f-f49c27a2c6f8", "dependsOn": []}, {"ref": "a6c27aff-2dc1-4155-96c9-1e4d33ee3e56", "dependsOn": []}, {"ref": "c20ed5dd-090e-4dec-9674-8faa1779faf3", "dependsOn": []}, {"ref": "5ebea659-a02c-41dd-bce3-c4042337da30", "dependsOn": []}, {"ref": "d15de5a1-c276-46af-8eab-403cf291f4d2", "dependsOn": []}, {"ref": "b9adcebe-9604-4ca9-b61b-3ce1db567918", "dependsOn": []}, {"ref": "ab5d1104-d8a1-4c9b-8906-e58c0e44ba61", "dependsOn": []}, {"ref": "f0883500-f188-4070-a636-0e23f91aa7c9", "dependsOn": []}, {"ref": "40681da4-2acd-44db-a025-63661385bd5b", "dependsOn": []}, {"ref": "f0d94395-8d1a-4245-a37a-575aa801c52e", "dependsOn": []}, {"ref": "1b62ba04-9371-4614-8e66-4a26947c5cf0", "dependsOn": []}, {"ref": "9a1ac150-d19c-49dc-a794-0ee479071497", "dependsOn": []}, {"ref": "92d2d5f5-113b-46e6-ad7b-19c3bcb652eb", "dependsOn": []}, {"ref": "6f126359-477d-44f9-968c-070913fa993d", "dependsOn": []}, {"ref": "a75256c4-8b19-426f-ae29-8623bb5b924f", "dependsOn": []}, {"ref": "403bdad0-b880-435f-a014-b28d7f0b36f0", "dependsOn": []}, {"ref": "f33d8bd7-beb6-4aab-bd30-f243465605a4", "dependsOn": []}, {"ref": "5d146930-cd6f-4aa1-ba18-dd7fb57d8ebc", "dependsOn": []}, {"ref": "d745a921-f251-42e3-a484-b98ee09fe88a", "dependsOn": []}, {"ref": "c4048333-46b9-42a7-9ec7-e0a77b694db5", "dependsOn": []}, {"ref": "7ccdd3b4-3212-498b-ab9f-c4a1b597ce08", "dependsOn": []}, {"ref": "b81208b6-5f7e-48f2-80b4-00e0cf66a253", "dependsOn": []}, {"ref": "4e0d0d57-19b6-4c3e-ae78-033c9aebae4c", "dependsOn": []}, {"ref": "880dd909-9767-4b98-b875-9b1643295d8d", "dependsOn": []}, {"ref": "4505e74f-7a1f-4e02-9ee1-78ce2c9e0b2c", "dependsOn": []}, {"ref": "afcbd332-e9b2-47e9-a361-fa89e5d412d5", "dependsOn": []}, {"ref": "4df62a2b-f7c0-4b55-99e0-cea07fa444f7", "dependsOn": []}, {"ref": "7357f19c-1e24-4a45-9a48-77d87009845b", "dependsOn": []}, {"ref": "58499599-5eb2-400b-94dd-162c99cc6ad1", "dependsOn": []}, {"ref": "b15ef46c-d4b5-4218-9bc9-42dc08e62953", "dependsOn": []}, {"ref": "f1304177-89c7-4257-a369-98e44f52255d", "dependsOn": []}, {"ref": "c8a3b98b-faed-46bb-85e3-b45c01afd1d2", "dependsOn": []}, {"ref": "004746cb-65af-47c1-a32a-ff5dd39608a9", "dependsOn": []}, {"ref": "98f107ce-ccbb-4779-9398-8bf9fe5f965d", "dependsOn": []}, {"ref": "4d1ee2c0-06df-454b-87e1-94172561c034", "dependsOn": []}, {"ref": "4fd6bbb5-104b-4d42-a229-2812629e5300", "dependsOn": []}, {"ref": "6f881966-62aa-4597-9049-ab28b7f6d137", "dependsOn": []}, {"ref": "d1066cf3-344d-4ce8-946b-604eccd0977a", "dependsOn": []}, {"ref": "59db8c1a-6c49-4729-925e-848093a34274", "dependsOn": []}]}