Human-readable CycloneDX SBOM

sbom.py

#!/usr/bin/env python3
"""
Read a CycloneDX 1.4 *JSON* BOM from stdin and print one line per component:

    <name>@<version> – <license1>, <license2>, …

Usage:
    python3 cyclonedx-deps-json.py < bom.json
"""

import json
import sys

def licenses(comp):
    """Return a list of licence identifiers/names for a component."""
    out = []
    for l in comp.get("licenses", []):
        if "license" in l:          # structured licence object
            lic = l["license"]
            out.append(lic.get("id") or lic.get("name", ""))
        elif "expression" in l:     # SPDX expression string
            out.append(l["expression"])
    return [x for x in out if x]

def main():
    try:
        bom = json.load(sys.stdin)
    except json.JSONDecodeError as e:
        sys.exit(f"Invalid JSON BOM: {e}")

    for c in bom.get("components", []):
        name    = c.get("name", "UNKNOWN")
        version = c.get("version") or ""
        label   = f"{name}{'@'+version if version else ''}"
        lic_txt = ", ".join(licenses(c)) or "No licence information"
        print(f"{label} – {lic_txt}")

if __name__ == "__main__":
    main()