buildstream-sbom 1.1__tar.gz

buildstream_sbom-1.1/.gitignore

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv

buildstream_sbom-1.1/.gitlab-ci.yml

@@ -0,0 +1,57 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_TAG
+
+stages:
+  - build
+  - publish
+
+.ruff:
+  image:
+    name: ghcr.io/astral-sh/ruff:0.12.9-alpine
+  stage: build
+  interruptible: true
+
+Ruff Check:
+  extends: .ruff
+  script:
+    - ruff check --output-format=gitlab > code-quality-report.json
+  artifacts:
+    reports:
+      codequality: code-quality-report.json
+
+Ruff Format:
+  extends: .ruff
+  script:
+    - ruff format --diff
+
+REUSE Compliance Check:
+  stage: build
+  image:
+    name: fsfe/reuse:latest
+    entrypoint: [""]
+  script:
+    - reuse lint
+
+# publish to PyPi for pipelines run on tags
+pypi-release:
+  stage: publish
+  rules:
+    - if: $CI_COMMIT_TAG
+  id_tokens:
+    PYPI_ID_TOKEN:
+      aud: pypi
+  image: docker.io/library/python:3.14
+  before_script:
+    - |
+      python3 -mvenv venv
+      ./venv/bin/pip install twine build
+  script:
+    - ./venv/bin/python3 -m build .
+    - ./venv/bin/twine upload --skip-existing dist/*

buildstream_sbom-1.1/CHANGELOG.md

@@ -0,0 +1,28 @@
+<!--
+SPDX-FileCopyrightText: 2026 Codethink Limited
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Changelog
+
+## [1.1] - 2026-04-30
+
+### Added
+
+- Make use of a source's (optional) provenance field
+- Add license extraction support
+- Add --spdx-comment option
+- Add element name as externalRef
+
+### Changed
+
+- Don't use the BST environment variable
+- Check creators are in the spdx format
+- Drop special casing of patch sources
+- Set fallback package name to 'UNKNOWN' for sources
+  - docker images are currently the only known "unknown"
+
+## [1.0] - 2025-10-14
+
+Initial release.

buildstream_sbom-1.1/LICENSES/Apache-2.0.txt

@@ -0,0 +1,73 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

buildstream_sbom-1.1/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: buildstream-sbom
+Version: 1.1
+Summary: A tool to generate SPDX SBoMs from buildstream projects
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml
+
+<!--
+SPDX-FileCopyrightText: 2025 Codethink Limited
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# BuildStream SBOM generator
+
+This tool can be used to produce an SBoM (Software Bill of Materials)
+describing a BuildStream element and its dependencies. It currently
+generates [SPDX](https://spdx.dev/) version 2.3.
+
+The manifest contains useful information, such as the package name, version,
+source locations and dependencies.
+
+
+## Source provenance data
+
+This tool relies on the [Source Provenance API](https://docs.buildstream.build/2.5/buildstream.source.html#generating-sourceinfo-for-provenance-information)
+introduced in BuildStream 2.5. This API is implemented by buildstream-plugins
+version 2.5.0 and buildstream-plugins-community 2.1.0. Please make sure your
+project is using those (or more recent) versions. If your project uses custom
+source plugins, please make sure that they also implement this API.
+
+Version guessing is handled by individual source plugins, please check the
+individual plugin documentation for details. Most plugins that implement it
+do something similar to what [DownloadableFileSource](https://docs.buildstream.build/2.5/buildstream.downloadablefilesource.html#core-downloadable-source-builtins)
+does, so it is a good starting point for understanding how this works.
+
+The list of currently supported source provenance attributes that can be
+specified and used for a Buildstream project is as follows:
+
+| Attribute name | Corresponding SPDX attribute |
+| -------------- | ---------------------------- |
+| concluded-license | [licenseConcluded](https://spdx.github.io/spdx-spec/v2.3/package-information/#713-concluded-license-field) |
+| copyright-text | [copyrightText](https://spdx.github.io/spdx-spec/v2.3/package-information/#717-copyright-text-field) |
+| declared-license | [licenseDeclared](https://spdx.github.io/spdx-spec/v2.3/package-information/#715-declared-license-field) |
+| description | [summary](https://spdx.github.io/spdx-spec/v2.3/package-information/#718-package-summary-description-field) |
+| homepage | [homepage](https://spdx.github.io/spdx-spec/v2.3/package-information/#711-package-home-page-field) |
+| name | [name](https://spdx.github.io/spdx-spec/v2.3/package-information/#71-package-name-field) |
+| originator | [originator](https://spdx.github.io/spdx-spec/v2.3/package-information/#76-package-originator-field) |
+| supplier | [supplier](https://spdx.github.io/spdx-spec/v2.3/package-information/#75-package-supplier-field) |
+
+These can be used in projects by use of the `source-provenance-attributes`
+field in the project.conf, this is described in the provenance section of
+the [BuildStream documentation](https://docs.buildstream.build/master/buildstream.source.html#built-in-functionality).
+
+### source-provenance-attributes snippet
+
+```
+# project.conf
+
+source-provenance-attributes:
+  concluded-license: The license as determined by the evidence provided by the source project
+  copyright-text: Copyright text defined by the source project
+  declared-license: The license of the source project as decided by the authors
+  description: Description of the source project
+  homepage: The URL of the source project's homepage
+  name: The name of the source project
+  originator: The name of the person or organisation that created the source package originally
+  supplier: The name of the person or organisation that provided the source package
+```
+
+Should any BuildStream plugins implement tracking for source provenance attributes, similar to
+[source tracking](https://docs.buildstream.build/master/using_commands.html#bst-source-track),
+it is recommended for all projects and plugins to use the attribute names exactly as seen above.
+This ensures the source provenance attributes are always generated identically between different
+plugins and makes sure they align with projects' definitions in the same way.
+
+## Usage
+
+To install, clone this repository and install it using `pip` (or preferably a
+tool like [`uv tool`](https://docs.astral.sh/uv/#tools) or
+[`pipx`](https://pipx.pypa.io/stable/) which install it in a virtual
+environment).
+
+To use, run `buildstream-sbom` in a buildstream project passing in the name of
+elements like you would pass to `bst`. There are two additional required
+arguments `--spdx-name` and `--spdx-namespace`, to set the SPDX document name
+and document namespace respectively. See the [SPDX specification](https://spdx.github.io/spdx-spec/v2.3/document-creation-information/)
+for details.
+
+`buildstream-sbom` also accepts some buildstream options, notably `-o/--option`
+to set buildstream options, `-C/--directory` to set the directory containing
+the buildstream project, and `--deps` to choose whether to include only runtime
+dependencies or all dependencies.
+
+On the topic of runtime dependencies, two BuildStream core plugins are treated
+specially: `filter` and `compose`. All build dependencies of elements using
+these plugins are considered runtime dependencies. You can set the `depends-on`
+key in the `sbom` public domain data to a list of build dependencies to have
+`buildstream-sbom` treat these build dependencies as runtime dependencies. This
+is useful for a `script` or `manual` element that copies artifacts from a build
+dependency into its own artifact.
+
+You can also include licenses that have been extracted from the element's
+artifacts using `--include-licenses`. This uses license information installed
+with tooling such as [Freedesktop-SDK's install-extra script](https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/master/include/install-extra.yml?ref_type=heads). This option can
+also be used in conjunction with `--artifact-checkout-directory` (`-A`), to
+control where element artifacts are checked out to during processing; useful
+for if you are checking out larger artifacts and want to specify a different
+part of a filesystem with more available space (note that artifacts are removed
+once processed anyway to minimise required storage space).

buildstream_sbom-1.1/README.md

@@ -0,0 +1,103 @@
+<!--
+SPDX-FileCopyrightText: 2025 Codethink Limited
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# BuildStream SBOM generator
+
+This tool can be used to produce an SBoM (Software Bill of Materials)
+describing a BuildStream element and its dependencies. It currently
+generates [SPDX](https://spdx.dev/) version 2.3.
+
+The manifest contains useful information, such as the package name, version,
+source locations and dependencies.
+
+
+## Source provenance data
+
+This tool relies on the [Source Provenance API](https://docs.buildstream.build/2.5/buildstream.source.html#generating-sourceinfo-for-provenance-information)
+introduced in BuildStream 2.5. This API is implemented by buildstream-plugins
+version 2.5.0 and buildstream-plugins-community 2.1.0. Please make sure your
+project is using those (or more recent) versions. If your project uses custom
+source plugins, please make sure that they also implement this API.
+
+Version guessing is handled by individual source plugins, please check the
+individual plugin documentation for details. Most plugins that implement it
+do something similar to what [DownloadableFileSource](https://docs.buildstream.build/2.5/buildstream.downloadablefilesource.html#core-downloadable-source-builtins)
+does, so it is a good starting point for understanding how this works.
+
+The list of currently supported source provenance attributes that can be
+specified and used for a Buildstream project is as follows:
+
+| Attribute name | Corresponding SPDX attribute |
+| -------------- | ---------------------------- |
+| concluded-license | [licenseConcluded](https://spdx.github.io/spdx-spec/v2.3/package-information/#713-concluded-license-field) |
+| copyright-text | [copyrightText](https://spdx.github.io/spdx-spec/v2.3/package-information/#717-copyright-text-field) |
+| declared-license | [licenseDeclared](https://spdx.github.io/spdx-spec/v2.3/package-information/#715-declared-license-field) |
+| description | [summary](https://spdx.github.io/spdx-spec/v2.3/package-information/#718-package-summary-description-field) |
+| homepage | [homepage](https://spdx.github.io/spdx-spec/v2.3/package-information/#711-package-home-page-field) |
+| name | [name](https://spdx.github.io/spdx-spec/v2.3/package-information/#71-package-name-field) |
+| originator | [originator](https://spdx.github.io/spdx-spec/v2.3/package-information/#76-package-originator-field) |
+| supplier | [supplier](https://spdx.github.io/spdx-spec/v2.3/package-information/#75-package-supplier-field) |
+
+These can be used in projects by use of the `source-provenance-attributes`
+field in the project.conf, this is described in the provenance section of
+the [BuildStream documentation](https://docs.buildstream.build/master/buildstream.source.html#built-in-functionality).
+
+### source-provenance-attributes snippet
+
+```
+# project.conf
+
+source-provenance-attributes:
+  concluded-license: The license as determined by the evidence provided by the source project
+  copyright-text: Copyright text defined by the source project
+  declared-license: The license of the source project as decided by the authors
+  description: Description of the source project
+  homepage: The URL of the source project's homepage
+  name: The name of the source project
+  originator: The name of the person or organisation that created the source package originally
+  supplier: The name of the person or organisation that provided the source package
+```
+
+Should any BuildStream plugins implement tracking for source provenance attributes, similar to
+[source tracking](https://docs.buildstream.build/master/using_commands.html#bst-source-track),
+it is recommended for all projects and plugins to use the attribute names exactly as seen above.
+This ensures the source provenance attributes are always generated identically between different
+plugins and makes sure they align with projects' definitions in the same way.
+
+## Usage
+
+To install, clone this repository and install it using `pip` (or preferably a
+tool like [`uv tool`](https://docs.astral.sh/uv/#tools) or
+[`pipx`](https://pipx.pypa.io/stable/) which install it in a virtual
+environment).
+
+To use, run `buildstream-sbom` in a buildstream project passing in the name of
+elements like you would pass to `bst`. There are two additional required
+arguments `--spdx-name` and `--spdx-namespace`, to set the SPDX document name
+and document namespace respectively. See the [SPDX specification](https://spdx.github.io/spdx-spec/v2.3/document-creation-information/)
+for details.
+
+`buildstream-sbom` also accepts some buildstream options, notably `-o/--option`
+to set buildstream options, `-C/--directory` to set the directory containing
+the buildstream project, and `--deps` to choose whether to include only runtime
+dependencies or all dependencies.
+
+On the topic of runtime dependencies, two BuildStream core plugins are treated
+specially: `filter` and `compose`. All build dependencies of elements using
+these plugins are considered runtime dependencies. You can set the `depends-on`
+key in the `sbom` public domain data to a list of build dependencies to have
+`buildstream-sbom` treat these build dependencies as runtime dependencies. This
+is useful for a `script` or `manual` element that copies artifacts from a build
+dependency into its own artifact.
+
+You can also include licenses that have been extracted from the element's
+artifacts using `--include-licenses`. This uses license information installed
+with tooling such as [Freedesktop-SDK's install-extra script](https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/master/include/install-extra.yml?ref_type=heads). This option can
+also be used in conjunction with `--artifact-checkout-directory` (`-A`), to
+control where element artifacts are checked out to during processing; useful
+for if you are checking out larger artifacts and want to specify a different
+part of a filesystem with more available space (note that artifacts are removed
+once processed anyway to minimise required storage space).

buildstream_sbom-1.1/pyproject.toml

@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+[build-system]
+requires = ["setuptools", "setuptools-scm"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "buildstream-sbom"
+dynamic = ["version"]
+description = "A tool to generate SPDX SBoMs from buildstream projects"
+readme = "README.md"
+dependencies = [
+    "pyyaml",
+]
+requires-python = ">=3.9"
+
+[project.scripts]
+buildstream-sbom = "buildstream_sbom.frontend:main"
+
+[tool.setuptools_scm]

buildstream_sbom-1.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

buildstream_sbom-1.1/src/buildstream_sbom/frontend.py

@@ -0,0 +1,190 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+
+import yaml
+
+from pathlib import Path
+
+from .spdx import generate_spdx
+from .utils import get_hosttool, bst_common_args
+
+
+def configure():
+    parser = argparse.ArgumentParser(
+        description="Generate an SPDX formatted SBoM manifest from a BuildStream project"
+    )
+
+    parser.add_argument(
+        "--spdx-name",
+        metavar="NAME",
+        help="SPDX document name",
+        required=True,
+    )
+    parser.add_argument(
+        "--spdx-namespace",
+        metavar="NAMESPACE",
+        help="SPDX document namespace",
+        required=True,
+    )
+    parser.add_argument(
+        "--spdx-comment",
+        metavar="COMMENT",
+        help="SPDX document comment",
+    )
+    parser.add_argument(
+        "--spdx-creator",
+        metavar="CREATOR",
+        action="append",
+        dest="spdx_creators",
+        help="SPDX creator, in the format mandated by SPDX. "
+        "Can be passed multiple times for multiple creators.",
+    )
+
+    parser.add_argument(
+        "-C",
+        "--directory",
+        metavar="DIRECTORY",
+        help="BuildStream project directory",
+    )
+
+    parser.add_argument(
+        "-o",
+        "--option",
+        metavar="OPTION VALUE",
+        nargs=2,
+        action="append",
+        dest="options",
+        default=[],
+        help="BuildStream project option",
+    )
+
+    parser.add_argument(
+        "--output",
+        metavar="FILE",
+        type=argparse.FileType("w"),
+        help="Output filename",
+        default="-",
+    )
+
+    parser.add_argument("--deps", choices=["all", "run"], default="run")
+
+    parser.add_argument(
+        "--with-licenses",
+        action=argparse.BooleanOptionalAction,
+        default=False,
+        help="Attempt to extract licenses from build artifacts and add them to the SBOM",
+    )
+
+    # A lot of artifacts can be checked out so it is a good idea to let users choose where these
+    # go in case of storage space limitations
+    parser.add_argument(
+        "--artifact-checkout-directory",
+        "-A",
+        default=Path(os.getcwd()),
+        help="Directory to use when checking out artifacts for processing; "
+        "the artifacts will be removed once they have been processed "
+        "(default: %(default)s)",
+        type=Path,
+    )
+
+    parser.add_argument(
+        "elements",
+        metavar="ELEMENT",
+        nargs="+",
+        help="Elements to generate SBoM for",
+    )
+
+    return parser.parse_args()
+
+
+def extract_element_infos(config):
+    element_infos = []
+
+    try:
+        result = run_bst_show(config)
+    except subprocess.CalledProcessError:
+        exit(1)
+
+    documents = yaml.load_all(result.stdout, yaml.BaseLoader)
+    try:
+        while True:
+            name = next(documents)
+            kind = next(documents)
+            source_infos = next(documents)
+            build_deps = next(documents)
+            runtime_deps = next(documents)
+            config = next(documents)
+            public = next(documents)
+            vars = next(documents)
+
+            element_infos.append(
+                {
+                    "name": name,
+                    "kind": None if kind == "%{kind}" else kind,
+                    "source-infos": source_infos,
+                    "build-deps": build_deps,
+                    "runtime-deps": runtime_deps,
+                    "config": config,
+                    "public": public,
+                    "vars": vars,
+                }
+            )
+    except StopIteration:
+        pass
+
+    return element_infos
+
+
+def check_creators(config):
+    spdx_creators = ["Person", "Organization", "Tool"]
+    valid_creator = True
+    for c in config.spdx_creators:
+        valid_creator &= any(re.split(":", c)[0] in sc for sc in spdx_creators)
+    if not valid_creator:
+        sys.exit(
+            "ERROR: SPDX creator should follow the SPDX format.\n"
+            "See: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#68-creator-field"
+        )
+
+
+def run_bst_show(config):
+    # Python documentation recommends using a full path for the executable
+    # https://docs.python.org/3/library/subprocess.html#subprocess.Popen
+    bst_cmdline = [get_hosttool("bst")]
+
+    bst_cmdline += bst_common_args(config)
+
+    bst_cmdline += [
+        "show",
+        "--format",
+        "---\n%{name}\n---\n'%{kind}'\n---\n%{source-info}\n---\n%{build-deps}\n---\n%{runtime-deps}\n---\n%{config}\n---\n%{public}---\n%{vars}",
+    ]
+    bst_cmdline += config.elements
+
+    return subprocess.run(bst_cmdline, stdout=subprocess.PIPE, text=True, check=True)
+
+
+def main():
+    config = configure()
+
+    if config.spdx_creators:
+        check_creators(config)
+
+    element_infos = extract_element_infos(config)
+
+    spdx = generate_spdx(element_infos, config)
+
+    with config.output:
+        json.dump(spdx, config.output, indent=2)
+
+
+if __name__ == "__main__":
+    main()

buildstream_sbom-1.1/src/buildstream_sbom/licensing.py

@@ -0,0 +1,151 @@
+# SPDX-FileCopyrightText: 2026 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import subprocess
+import sys
+import json
+import tempfile
+
+from argparse import Namespace
+from pathlib import Path
+
+from .utils import get_hosttool, bst_common_args
+
+
+def get_license_artifacts(
+    element: str,
+    artifact_checkout_path: Path,
+    licenses_path: Path,
+    config: Namespace,
+) -> Path | None:
+    """Use Buildstream artifact checkout to get the installed licenses of an element and outputs the licenses, specified by
+    `license_artifact_path`, to the chosen output directory.
+
+    If the artifact checkout failed then the it will cause the program to exit.
+
+    Returns a Path to the licenses or None if none were found in the artifacts
+    """
+
+    # bst artifact checkout
+    bst_cmdline = [get_hosttool("bst")]
+
+    bst_cmdline += bst_common_args(config)
+
+    bst_cmdline += [
+        "artifact",
+        "checkout",
+        element,
+        "--directory",  # Note: This is the artifact checkout directory arg and not the same as the bst project directory
+        artifact_checkout_path,
+        "--deps",
+        "none",
+        "--no-integrate",
+    ]
+
+    r = subprocess.run(bst_cmdline)
+
+    if r.returncode != 0:
+        sys.exit("ERROR: Failed to checkout artifacts")
+
+    if licenses_path.exists():
+        return licenses_path
+
+    return None
+
+
+def extract_licenses(
+    input_path, element_name, artifact_checkout_path
+) -> list[str] | None:
+    """Attempt to extract licenses from `input_path` using Askalono.
+
+    Unrecognised licenses automatically trigger warning outputs.
+
+    If the Akalono command fails for any reason it will cause the program to exit.
+
+    `element_name` and `artifact_checkout_path` are only used for providing error
+    context reporting and have no impact on the license extraction.
+    """
+    askalono_bin = get_hosttool("askalono")
+
+    r = subprocess.run(
+        [askalono_bin, "--format", "json", "crawl", str(input_path)],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    if r.returncode != 0:
+        sys.exit(f"ERROR: Askalono command failed.\n{r.stderr}")
+
+    license_json = r.stdout
+
+    # Askalono ouptuts multiple licenses as separate objects but not as an array,
+    # need to combine them in to an array
+    license_json_split = license_json.splitlines()
+
+    # use set to avoid duplicates
+    licenses = set()
+    failures = {}
+    for license_object_json in license_json_split:
+        license_object = json.loads(license_object_json)
+        license_result = license_object.get("result", None)
+        if license_result is None:
+            offending_file = license_object.get("path", "Missing File Name")
+            if offending_file is not None:
+                offending_file = offending_file.removeprefix(
+                    str(artifact_checkout_path)
+                )
+
+            files_with_error = failures.setdefault(
+                license_object.get("error", "Missing Error"), []
+            )
+            files_with_error.append(offending_file)
+
+            continue
+
+        licenses.add(license_result["license"]["name"])
+
+    for error, files in failures.items():
+        # python doesn't allow for '\' in f-string parts so need to use format
+        print(
+            "{0}: {1} found in\n\t{2}\n".format(
+                element_name, error, "\n\t".join(files)
+            ),
+            file=sys.stderr,
+        )
+
+    if len(licenses) == 0:
+        return None
+
+    return list(licenses)
+
+
+def retrieve_licenses(
+    element_name: str, artifact_license_path: Path, config: Namespace
+) -> list[str] | None:
+    """Retrieve licenses for an element by checking out its artifacts to `artifact_checkout_root` and scanning
+    `licenses_artifact_path` for any identifiable licenses.
+
+    Returns None if none could be found otherwise returns licenses as in a list
+    """
+
+    # path to use for artifact checkout
+    with tempfile.TemporaryDirectory(
+        dir=config.artifact_checkout_directory
+    ) as artifact_checkout_path:
+        # path to the licenses inside the artifact
+        licenses_path = Path(artifact_checkout_path, artifact_license_path)
+
+        license_data_path = get_license_artifacts(
+            element_name, artifact_checkout_path, licenses_path, config
+        )
+
+        if license_data_path is None:
+            return None
+
+        license_data = extract_licenses(
+            license_data_path, element_name, artifact_checkout_path
+        )
+
+    return license_data

buildstream_sbom-1.1/src/buildstream_sbom/spdx.py

@@ -0,0 +1,337 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+from buildstream_sbom.utils import bst_common_args
+import os
+import sys
+import re
+import subprocess
+
+from datetime import datetime, timezone
+from pathlib import Path
+
+from .licensing import retrieve_licenses
+
+from .utils import get_hosttool
+
+# buildstream-sbom supported spdx attributes
+# this could be generic for any key in provenance but being
+# explicit about these attributes guarantees valid SPDX
+SOURCE_PROVENANCE_ATTRIBUTES = {
+    "concluded-license": "licenseConcluded",
+    "copyright-text": "copyrightText",
+    "declared-license": "licenseDeclared",
+    "description": "summary",
+    "homepage": "homepage",
+    "name": "name",
+    "originator": "originator",
+    "supplier": "supplier",
+}
+
+
+def generate_spdx(element_infos, config):
+    element_infos = {
+        element_info["name"]: element_info for element_info in element_infos
+    }
+    packages = []
+    relationships = []
+
+    elements_done = set()
+    elements_to_do = set()
+
+    for element in config.elements:
+        relationships.append(
+            {
+                "spdxElementId": "SPDXRef-DOCUMENT",
+                "relationshipType": "DESCRIBES",
+                "relatedSpdxElement": element_spdxid(element),
+            }
+        )
+        elements_to_do.add(element)
+
+    while elements_to_do:
+        name = elements_to_do.pop()
+        if name in elements_done:
+            continue
+        elements_done.add(name)
+
+        elem_info = element_infos[name]
+        source_infos = elem_info["source-infos"]
+
+        element_package, source_packages = generate_spdx_for_element(
+            name,
+            source_infos,
+            elem_info,
+            config,
+        )
+
+        packages.append(element_package)
+        packages.extend(source_packages)
+
+        for source_package in source_packages:
+            relationships.append(
+                {
+                    "spdxElementId": element_spdxid(name),
+                    "relationshipType": "GENERATED_FROM",
+                    "relatedSpdxElement": source_package["SPDXID"],
+                }
+            )
+
+        # Order here doesn't matter, as we're sorting the relationships at the end
+        all_deps = set(elem_info["runtime-deps"])
+
+        extra_deps = get_extra_dependencies(elem_info, config.deps == "all", config)
+        all_deps.update(extra_deps)
+
+        for dep in all_deps:
+            relationships.append(
+                {
+                    "spdxElementId": element_package["SPDXID"],
+                    "relationshipType": "DEPENDS_ON",
+                    "relatedSpdxElement": element_spdxid(dep),
+                }
+            )
+            elements_to_do.add(dep)
+
+    def relationship_sort_key(relationship):
+        return (
+            relationship["spdxElementId"],
+            relationship["relatedSpdxElement"],
+            relationship["relationshipType"],
+        )
+
+    spdx = {
+        "spdxVersion": "SPDX-2.3",
+        "dataLicense": "CC0-1.0",
+        "SPDXID": "SPDXRef-DOCUMENT",
+    }
+
+    creation_info = spdx["creationInfo"] = {}
+
+    spdx["name"] = config.spdx_name
+
+    spdx["documentNamespace"] = config.spdx_namespace
+
+    if config.spdx_comment:
+        spdx["comment"] = config.spdx_comment
+
+    if config.spdx_creators:
+        creation_info["creators"] = config.spdx_creators
+
+    created_datetime = datetime.now(timezone.utc)
+    # This is a specific variant of isoformat, that python's datetime
+    # module doesn't support
+    # https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#691-description
+    creation_info["created"] = created_datetime.strftime("%Y-%m-%dT%H:%M:%SZ")
+
+    spdx["packages"] = sorted(packages, key=lambda pkg: pkg["SPDXID"])
+    spdx["relationships"] = sorted(relationships, key=relationship_sort_key)
+
+    return spdx
+
+
+def resolve_element_name(name, config):
+    # Python documentation recommends using a full path for the executable
+    # https://docs.python.org/3/library/subprocess.html#subprocess.Popen
+    bst_cmdline = [get_hosttool("bst")]
+
+    bst_cmdline += bst_common_args(config)
+
+    bst_cmdline += ["show", "--deps", "none", "--format", "%{name}", name]
+
+    return subprocess.run(
+        bst_cmdline, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
+    )
+
+
+def get_extra_dependencies(elem_info, all_deps, config):
+    """
+    Return extra dependencies (beyond the element runtime dependencies) that need to be
+    included in the SPDX. If `all_deps` is true, then all build dependencies are included.
+    Otherwise, it uses heuristics are based on the element kind, or hints in the element's
+    public data.
+    """
+
+    if all_deps:
+        return elem_info["build-deps"]
+
+    # See if we have explicit configuration in the public data
+    public_data = elem_info["public"].get("sbom", {})
+    if public_data:
+        extra_deps = []
+        junction, _, _ = elem_info["name"].rpartition(":")
+        for dep_name in public_data.get("depends-on", []):
+            # need to account for the junction where the element resides
+            if junction:
+                result = resolve_element_name(f"{junction}:{dep_name}", config)
+                if result.returncode == 0:
+                    resolved_dep_name = result.stdout.strip()
+                else:
+                    sys.exit(
+                        f"Could not find dependency {dep_name}, referenced "
+                        f"from public data of element {elem_info['name']}:\n"
+                        f"{result.stderr.strip()}"
+                    )
+            else:
+                resolved_dep_name = dep_name
+
+            if resolved_dep_name not in elem_info["build-deps"]:
+                deps_str = "\n".join(elem_info["build-deps"])
+                sys.exit(
+                    f"Could not find dependency {dep_name}, referenced "
+                    f"from public data of element {elem_info['name']} "
+                    f"(resolved to {resolved_dep_name}). "
+                    f"Dependency must be one of:\n{deps_str}"
+                )
+
+            extra_deps.append(resolved_dep_name)
+        return extra_deps
+
+    if include_build_deps(elem_info["kind"], elem_info["config"].keys()):
+        return elem_info["build-deps"]
+
+    return []
+
+
+def include_build_deps(kind, config_keys):
+    """
+    Returns whether build dependencies should be always included even when generating
+    an SBoM with runtime dependencies. This currently means the compose and filter
+    elements.
+    """
+    if kind is None:
+        # Try to guess the element kind depending on its configuration
+        if config_keys == set(
+            ["include", "exclude", "include-orphans", "pass-integration"]
+        ):
+            kind = "filter"
+        if config_keys == set(["include", "exclude", "include-orphans", "integrate"]):
+            kind = "compose"
+
+    return kind in ("filter", "compose")
+
+
+def element_licenses(name: str, elem_info, config):
+    license_dir: str = elem_info["vars"].get("licensedir", None)
+
+    if license_dir is not None:
+        license_dir = Path(license_dir.lstrip(os.sep))
+
+        licenses = retrieve_licenses(name, license_dir, config)
+        if licenses is None:
+            print(f"{name}: Skipping: No licenses found", file=sys.stderr)
+            return None
+
+        return " AND ".join(licenses)
+    else:
+        print(
+            f"Could not find license directory for {name}, skipping licenses.",
+            file=sys.stderr,
+        )
+
+    return None
+
+
+def generate_spdx_for_element(
+    name,
+    source_infos,
+    elem_info,
+    config,
+):
+    """
+    Generate SPDX package information from the passed-in module, which is an
+    entry from a new style manifest (using the source provenance API)
+    """
+    package_name = element_package_name(name)
+    spdx_name = element_spdxid(name)
+
+    element_package = {
+        "name": package_name,
+        "SPDXID": spdx_name,
+        "filesAnalyzed": False,
+        "downloadLocation": "NOASSERTION",
+    }
+
+    element_ext_refs = []
+    bst_element_name = {
+        "referenceCategory": "OTHER",
+        "referenceType": "bst-element",
+        "referenceLocator": f"{name}",
+    }
+    element_ext_refs.append(bst_element_name)
+
+    element_package["externalRefs"] = element_ext_refs
+
+    if config.with_licenses:
+        licenses = element_licenses(name, elem_info, config)
+        if licenses is not None:
+            element_package["licenseDeclared"] = licenses
+
+    source_packages = []
+
+    for idx, source in enumerate(source_infos):
+        package = {
+            "SPDXID": f"{spdx_name}-{idx}",
+            "filesAnalyzed": False,
+        }
+        source_ext_refs = []
+
+        if "provenance" in source:
+            provenance = source["provenance"]
+            for attribute, spdx_field in SOURCE_PROVENANCE_ATTRIBUTES.items():
+                if attribute in provenance:
+                    package[spdx_field] = provenance[attribute]
+
+        package.setdefault("name", source_package_name(source))
+
+        package["downloadLocation"] = source["url"]
+        if "version-guess" in source:
+            package["versionInfo"] = source["version-guess"]
+        else:
+            package["versionInfo"] = source["version"]
+
+        package["sourceInfo"] = source["kind"]
+
+        source_ext_refs.append(bst_element_name)
+        package["externalRefs"] = source_ext_refs
+
+        source_packages.append(package)
+
+    return element_package, source_packages
+
+
+def element_spdxid(name):
+    # SPDXID can only contain letters, numbers, `.`, and `-`
+    not_allowed = "[^a-zA-Z0-9.-]"
+    spdx_name = re.sub(not_allowed, "-", name)
+    return f"SPDXRef-{spdx_name}"
+
+
+def element_package_name(name):
+    element_name = name.split(":")[-1]
+    return os.path.splitext(os.path.basename(element_name))[0]
+
+
+def source_package_name(source_info):
+    basename = os.path.basename(source_info["url"])
+
+    if "extra-data" in source_info and "crate-name" in source_info["extra-data"]:
+        return source_info["extra-data"]["crate-name"]
+
+    if source_info["medium"] == "git":
+        if basename.endswith(".git"):
+            return basename[: -len(".git")]
+        return basename
+    elif source_info["medium"] in ("remote-file", "archive"):
+        stem = re.split(r"\.(tar|tgz|tbz|zip|crate)", basename)[0]
+        package = re.split("[-_][0-9]", stem)[0]
+        return package
+    elif source_info["medium"] == "local":
+        return basename
+    else:
+        print(
+            f"Can't extract a package name from source info {source_info}",
+            file=sys.stderr,
+        )
+        return "UNKNOWN"

buildstream_sbom-1.1/src/buildstream_sbom/utils.py

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: 2026 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+from argparse import Namespace
+import shutil
+import sys
+
+
+def get_hosttool(name: str):
+    """Returns the path to the executable of the specified command.
+
+    Errors if the command could not be found.
+    """
+    command = shutil.which(name)
+    if command is None:
+        sys.exit(f"`{name}` is not installed or could not be found.")
+
+    return command
+
+
+def bst_common_args(config: Namespace) -> list[str]:
+    args = []
+    if config.directory:
+        args += ["--directory", config.directory]
+
+    for option, value in config.options:
+        args += ["--option", option, value]
+
+    return args

buildstream_sbom-1.1/src/buildstream_sbom.egg-info/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: buildstream-sbom
+Version: 1.1
+Summary: A tool to generate SPDX SBoMs from buildstream projects
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml
+
+<!--
+SPDX-FileCopyrightText: 2025 Codethink Limited
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# BuildStream SBOM generator
+
+This tool can be used to produce an SBoM (Software Bill of Materials)
+describing a BuildStream element and its dependencies. It currently
+generates [SPDX](https://spdx.dev/) version 2.3.
+
+The manifest contains useful information, such as the package name, version,
+source locations and dependencies.
+
+
+## Source provenance data
+
+This tool relies on the [Source Provenance API](https://docs.buildstream.build/2.5/buildstream.source.html#generating-sourceinfo-for-provenance-information)
+introduced in BuildStream 2.5. This API is implemented by buildstream-plugins
+version 2.5.0 and buildstream-plugins-community 2.1.0. Please make sure your
+project is using those (or more recent) versions. If your project uses custom
+source plugins, please make sure that they also implement this API.
+
+Version guessing is handled by individual source plugins, please check the
+individual plugin documentation for details. Most plugins that implement it
+do something similar to what [DownloadableFileSource](https://docs.buildstream.build/2.5/buildstream.downloadablefilesource.html#core-downloadable-source-builtins)
+does, so it is a good starting point for understanding how this works.
+
+The list of currently supported source provenance attributes that can be
+specified and used for a Buildstream project is as follows:
+
+| Attribute name | Corresponding SPDX attribute |
+| -------------- | ---------------------------- |
+| concluded-license | [licenseConcluded](https://spdx.github.io/spdx-spec/v2.3/package-information/#713-concluded-license-field) |
+| copyright-text | [copyrightText](https://spdx.github.io/spdx-spec/v2.3/package-information/#717-copyright-text-field) |
+| declared-license | [licenseDeclared](https://spdx.github.io/spdx-spec/v2.3/package-information/#715-declared-license-field) |
+| description | [summary](https://spdx.github.io/spdx-spec/v2.3/package-information/#718-package-summary-description-field) |
+| homepage | [homepage](https://spdx.github.io/spdx-spec/v2.3/package-information/#711-package-home-page-field) |
+| name | [name](https://spdx.github.io/spdx-spec/v2.3/package-information/#71-package-name-field) |
+| originator | [originator](https://spdx.github.io/spdx-spec/v2.3/package-information/#76-package-originator-field) |
+| supplier | [supplier](https://spdx.github.io/spdx-spec/v2.3/package-information/#75-package-supplier-field) |
+
+These can be used in projects by use of the `source-provenance-attributes`
+field in the project.conf, this is described in the provenance section of
+the [BuildStream documentation](https://docs.buildstream.build/master/buildstream.source.html#built-in-functionality).
+
+### source-provenance-attributes snippet
+
+```
+# project.conf
+
+source-provenance-attributes:
+  concluded-license: The license as determined by the evidence provided by the source project
+  copyright-text: Copyright text defined by the source project
+  declared-license: The license of the source project as decided by the authors
+  description: Description of the source project
+  homepage: The URL of the source project's homepage
+  name: The name of the source project
+  originator: The name of the person or organisation that created the source package originally
+  supplier: The name of the person or organisation that provided the source package
+```
+
+Should any BuildStream plugins implement tracking for source provenance attributes, similar to
+[source tracking](https://docs.buildstream.build/master/using_commands.html#bst-source-track),
+it is recommended for all projects and plugins to use the attribute names exactly as seen above.
+This ensures the source provenance attributes are always generated identically between different
+plugins and makes sure they align with projects' definitions in the same way.
+
+## Usage
+
+To install, clone this repository and install it using `pip` (or preferably a
+tool like [`uv tool`](https://docs.astral.sh/uv/#tools) or
+[`pipx`](https://pipx.pypa.io/stable/) which install it in a virtual
+environment).
+
+To use, run `buildstream-sbom` in a buildstream project passing in the name of
+elements like you would pass to `bst`. There are two additional required
+arguments `--spdx-name` and `--spdx-namespace`, to set the SPDX document name
+and document namespace respectively. See the [SPDX specification](https://spdx.github.io/spdx-spec/v2.3/document-creation-information/)
+for details.
+
+`buildstream-sbom` also accepts some buildstream options, notably `-o/--option`
+to set buildstream options, `-C/--directory` to set the directory containing
+the buildstream project, and `--deps` to choose whether to include only runtime
+dependencies or all dependencies.
+
+On the topic of runtime dependencies, two BuildStream core plugins are treated
+specially: `filter` and `compose`. All build dependencies of elements using
+these plugins are considered runtime dependencies. You can set the `depends-on`
+key in the `sbom` public domain data to a list of build dependencies to have
+`buildstream-sbom` treat these build dependencies as runtime dependencies. This
+is useful for a `script` or `manual` element that copies artifacts from a build
+dependency into its own artifact.
+
+You can also include licenses that have been extracted from the element's
+artifacts using `--include-licenses`. This uses license information installed
+with tooling such as [Freedesktop-SDK's install-extra script](https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/master/include/install-extra.yml?ref_type=heads). This option can
+also be used in conjunction with `--artifact-checkout-directory` (`-A`), to
+control where element artifacts are checked out to during processing; useful
+for if you are checking out larger artifacts and want to specify a different
+part of a filesystem with more available space (note that artifacts are removed
+once processed anyway to minimise required storage space).

buildstream_sbom-1.1/src/buildstream_sbom.egg-info/SOURCES.txt

@@ -0,0 +1,16 @@
+.gitignore
+.gitlab-ci.yml
+CHANGELOG.md
+README.md
+pyproject.toml
+LICENSES/Apache-2.0.txt
+src/buildstream_sbom/frontend.py
+src/buildstream_sbom/licensing.py
+src/buildstream_sbom/spdx.py
+src/buildstream_sbom/utils.py
+src/buildstream_sbom.egg-info/PKG-INFO
+src/buildstream_sbom.egg-info/SOURCES.txt
+src/buildstream_sbom.egg-info/dependency_links.txt
+src/buildstream_sbom.egg-info/entry_points.txt
+src/buildstream_sbom.egg-info/requires.txt
+src/buildstream_sbom.egg-info/top_level.txt

buildstream_sbom-1.1/src/buildstream_sbom.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

buildstream_sbom-1.1/src/buildstream_sbom.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+buildstream-sbom = buildstream_sbom.frontend:main

buildstream_sbom-1.1/src/buildstream_sbom.egg-info/requires.txt

@@ -0,0 +1 @@
+pyyaml

buildstream_sbom-1.1/src/buildstream_sbom.egg-info/top_level.txt

@@ -0,0 +1 @@
+buildstream_sbom