Pick an SBOM format

[woodruffw]

Emitting a well-known SBOM format is a lower priority, but it's something we specified in the proposal.

Two good options are SPDX and CycloneDX; we should determine:

• Which one(s) have good, maintained Python APIs
• Which one(s) have community adoption

[woodruffw]

Related: here's CycloneDX's (official?) Python module: https://github.com/CycloneDX/cyclonedx-python

[stevespringett]

There's also https://github.com/CycloneDX/cyclonedx-python-lib which is a reusable library containing the model and serializations to JSON and XML. https://github.com/CycloneDX/cyclonedx-python builds on top of the python library.

Let us know if you have any questions implementing CycloneDX. There's a vibrant community of adopters and implementors in the project Slack workspace.

And yes, they are both officially supported implementations.

[woodruffw]

Thanks for linking those!

[woodruffw]

Based on the current maturity of the Python SPDX ecosystem, I'm inclined to say that we should go with CycloneDX for now. We'll probably want to use cyclonedx-python-lib directly, rather than the cyclonedx-python tool.

Some braindump notes:

• The Bom model is the heart of the library -- we'll want to construct one, either from a "parser" (it looks like they support a sub/superset of our dependency sources directly), or manually by visiting each entry in an abstract dependency source. The latter might be more reliable, since some of their parsers (e.g. the requirements ones) won't function fully unless every dependency is pinned.

Closing so that we can formally unblock #77.