requirements.txt with Bomdesk
This opens a pinned requirements.txt with a GPL-licensed package, one with an unclassified licence and one with many advisories. Press Scan.
- Run pip freeze > requirements.txt in the environment you actually deploy.
- Paste the file or drop it on the box.
- Press Scan to see licences and advisories for each pinned version.
- Download CycloneDX or SPDX.
What to know
An SBOM needs exact versions, so Bomdesk reads only lines pinned with == (or ===). A line such as requests>=2.0 says what you allow, not what you run, so it is counted and set aside with a note. The best input is the output of pip freeze, or a file produced by pip-compile, which also lists the transitive packages.
Package names are normalised the way PyPI does (lower case, runs of dashes, dots and underscores become one dash), so Django and django-rest_framework match the registry. Extras, environment markers, hashes and comments are ignored. Lines that include -r or -c are not followed because the other file is not here: paste it too.
Licences come from deps.dev. Some Python packages do not state a licence in a form that maps to SPDX; those show as Unknown with the raw text, never as a guess. In the sample, chardet is one such case.
Updated · Cosmovex
Questions
Why were some lines skipped?
Only exact pins identify a version. Ranges, URLs, editable installs and local paths are skipped, and the page says how many.
Does it follow -r other.txt?
No. Paste the other file as well, or merge them with pip freeze.
Is pip freeze enough for a transitive list?
Yes, if it runs in the environment that holds your dependencies. It lists everything installed, including transitive packages.
Does it read Poetry or Pipenv lock files?
Not yet. Export a pinned list first, for example with pip freeze or the export command of your tool, and paste that.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
