uv-sbom 2.3.0

SBOM generation tool for uv projects - Generate CycloneDX SBOMs from uv.lock files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

# workspace

A minimal but realistic [uv workspace](https://docs.astral.sh/uv/concepts/projects/workspaces/)
with two member packages, designed to demonstrate `uv-sbom --workspace`.

## Structure

```
workspace/
├── pyproject.toml          # Workspace root — declares [tool.uv.workspace]
├── uv.lock                 # Committed lock file shared by all members
├── packages/
│   ├── api/
│   │   └── pyproject.toml  # Web-API service: requests, fastapi
│   └── worker/
│       └── pyproject.toml  # Background worker: celery, redis
```

## Prerequisites

- `uv-sbom` installed or built from source (`cargo build --release`)
- No `uv` required — the lock file is already committed

## Usage

### Generate one SBOM per member (CycloneDX JSON, default)

```bash
# From the repository root
uv-sbom --workspace --path examples/workspace
```

**Expected output:**

```
Workspace mode: 2 members found

  Processing: api
  ...
  Processing: worker
  ...

📦 Workspace SBOM Summary
────────────────────────────────────────────────────────────
Member               Output File
────────────────────────────────────────────────────────────
api                  examples/workspace/packages/api/sbom.json
worker               examples/workspace/packages/worker/sbom.json
────────────────────────────────────────────────────────────
```

Each member gets its own `sbom.json` containing only the packages reachable
from that member (transitive dependencies are included, but packages belonging
to other members are excluded).

### Markdown output

```bash
uv-sbom --workspace --path examples/workspace --format markdown
```

This writes `sbom.md` files instead of `sbom.json`.

### With CVE check

```bash
uv-sbom --workspace --path examples/workspace --check-cve
```

## Member Dependencies

| Member | Direct Dependencies |
|--------|-------------------|
| `api` | `requests`, `fastapi` |
| `worker` | `celery`, `redis` |

The two members share the same `uv.lock` at the workspace root.
`uv-sbom` uses the lock file to resolve the full transitive dependency
tree for each member independently.

## Contrast with single-project examples

| | `examples/sample-project` | `examples/workspace` |
|---|---|---|
| Mode | Default (single project) | `--workspace` |
| Lock file location | Project root | Workspace root (shared) |
| SBOM output | `sbom.json` / `sbom.md` | One file per member |