{"id":21809859,"url":"https://github.com/moverseai/vcpkg-sbom","last_synced_at":"2026-02-06T02:31:56.325Z","repository":{"id":257820820,"uuid":"870833028","full_name":"moverseai/vcpkg-sbom","owner":"moverseai","description":"📓 A python CLI tool to extract a software bill of materials and license info from a vcpkg manifest.","archived":false,"fork":false,"pushed_at":"2024-10-15T20:20:23.000Z","size":25,"stargazers_count":4,"open_issues_count":1,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-11-28T11:50:14.916Z","etag":null,"topics":["cpp","developer-tool","developer-tools","sbom","sbom-tool","software-bill-of-material","software-bill-of-materials","spdx","spdx-23","spdx-license","spdx-license-identifier","spdx-licenses","spdx-sbom","vcpkg"],"latest_commit_sha":null,"homepage":"https://github.com/moverseai/vcpkg-sbom/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moverseai.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-10-10T18:45:11.000Z","updated_at":"2025-10-02T20:27:46.000Z","dependencies_parsed_at":"2024-10-16T20:16:01.982Z","dependency_job_id":null,"html_url":"https://github.com/moverseai/vcpkg-sbom","commit_stats":null,"previous_names":["moverseai/vcpkg-sbom"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/moverseai/vcpkg-sbom","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moverseai%2Fvcpkg-sbom","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moverseai%2Fvcpkg-sbom/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moverseai%2Fvcpkg-sbom/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moverseai%2Fvcpkg-sbom/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moverseai","download_url":"https://codeload.github.com/moverseai/vcpkg-sbom/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moverseai%2Fvcpkg-sbom/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29145849,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-06T01:13:33.096Z","status":"online","status_checked_at":"2026-02-06T02:00:08.092Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cpp","developer-tool","developer-tools","sbom","sbom-tool","software-bill-of-material","software-bill-of-materials","spdx","spdx-23","spdx-license","spdx-license-identifier","spdx-licenses","spdx-sbom","vcpkg"],"created_at":"2024-11-27T13:24:57.318Z","updated_at":"2026-02-06T02:31:56.293Z","avatar_url":"https://github.com/moverseai.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 📓 Software Bill-of-Materials for `vcpkg` manifests.\n\n[![Python Version](https://img.shields.io/pypi/pyversions/vcpkg-sbom.svg)](https://pypi.org/project/vcpkg-sbom)\n[![PyPI](https://img.shields.io/pypi/v/vcpkg-sbom.svg)](https://pypi.org/project/vcpkg-sbom)\n![PyPI - Wheel](https://img.shields.io/pypi/wheel/vcpkg-sbom)\n![PyPI - Status](https://img.shields.io/pypi/status/vcpkg-sbom)\n[![GitHub Release Date](https://img.shields.io/github/release-date/moverseai/vcpkg-sbom)](https://github.com/moverseai/vcpkg-sbom/releases)\n[![PyPI - Downloads](https://img.shields.io/pypi/dm/vcpkg-sbom?style=plastic\u0026logo=python\u0026logoColor=magenta\u0026color=magenta\u0026link=https%3A%2F%2Fpypi.org%2Fproject%2Fvcpkg-sbom%2F)](https://pypi.org/project/vcpkg-sbom/)\n\n![GitHub repo size](https://img.shields.io/github/repo-size/moverseai/vcpkg-sbom)\n[![PyPI - License](https://img.shields.io/pypi/l/vcpkg-sbom)](https://github.com/moverseai/vcpkg-sbom/blob/main/LICENSE)\n[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)\n[![Black Format](https://github.com/moverseai/rerun-animation/actions/workflows/black.yaml/badge.svg)](https://github.com/moverseai/vcpkg-sbom/actions/workflows/black.yaml)\n[![Discord](https://dcbadge.limes.pink/api/server/bQc7B6qSPd?style=flat)](https://discord.gg/bQc7B6qSPd)\n\n___\n\n\u003eA python command line tool to extract a combined software bill of materials and license info from a vcpkg manifest.\n\n## Installation\n\n### :snake: [PyPi](https://pypi.org/project/vcpkg-sbom/)\n\nOpen a command line and run:\n```py\npip install vcpkg-sbom\n```\n\n---\n\n### :octocat: Local\n\nDownlaod the repo:\n```sh\ngit clone https://github.com/moverseai/vcpkg-sbom vcpkg-sbom\ncd vcpkg-sbom\n```\n\nFrom the repo's root path run:\n\n```py\npip install .\n```\n\nFor an editable install run:\n\n```py\npip install -e .\n```\n\n## :keyboard: Usage\n\n```sh\nvcpkg-sbom PATH/TO/PROJECT/vcpkg_installed\n```\n\n| ID | Package |\n|:---:|:---|\n| 0  | package name #1 |\n| 1  | package name #2 |\n| 2  | package name #3 |\n| ... | package name #N |\n\n\u003e Merging spdx:  ━━━━━━━━━━━━━━━━━━ 100% 0:00:00   \n\u003e Extracting \u0026 merging copyrights ...    \n\u003e Merging copyrights:  ━━━━━━━━━━━━━━━━━━   0% -:--:--\n\n\u003e [!NOTE]  \n\u003e The output file is a `SPDX-2.3` `SPDXRef-DOCUMENT` that merges all available `*.spdx.json` files from the manifest's installed packages.\n\n\u003e [!TIP]  \n\u003e The default `triplet` is `x64-windows` and is appended to the cmd line given path before searching for all installed packages.\n\n\u003e [!IMPORTANT]  \n\u003e The output files (`*.spdx.json`, and optionally, `*_license_info.json` and `*_EULA.txt`) are written to the current working directory from where the command was executed.\n\n---\n\n### 🔧 Command Line API\n\n```bash\n$ vcpkg-sbom --help\nusage: A software bill of materials extracter and merger for `vcpkg` manifest projects.\n\npositional arguments:\n  vcpkg_root            Path to the `vcpkg_installed` folder of your manifest project.\n\noptions:\n  -h, --help            show this help message and exit\n  -t TRIPLET, --triplet TRIPLET\n                        The `vcpkg` triplet to use.\n  -p PROJECT, --project PROJECT\n                        The project's name that will be used for the merged output files.\n  -n NAMESPACE, --namespace NAMESPACE\n                        The software's namespace to use for the `spdx` file.\n  -o ORGANIZATION, --organization ORGANIZATION\n                        The organization or company name to use for the `spdx` file.\n  -e EMAIL, --email EMAIL\n                        The email to use for the `spdx` file.\n  -c, --copyright       Additionally extract and merge all copyright files in a `*.txt` file.\n  -l, --license         Additionally extract and merge all license types in a `*.json` file.\n```\n\n\u003e [!IMPORTANT]\n\u003e Default values:\n\u003e   - `triplet`: _x64-windows_\n\u003e   - `project`: _project_\n\u003e   - `namespace`: _https://spdx.org/spdxdocs/_\n\u003e   - `organization`: _org_\n\u003e   - `email`: _info@org.com_\n\u003e   - `copyright`: flag to enable copyright file merging\n\u003e   - `license`: flag to enable license info merging\n\n\n\u003e [!TIP]  \n\u003e Info on how to choose a proper namespace can be found [here](https://spdx.github.io/spdx-spec/v2-draft/document-creation-information/#65-spdx-document-namespace-field)\n\n## Acknowledgements / Material\n\n- vcpkg` spdx [info](https://learn.microsoft.com/en-us/vcpkg/reference/software-bill-of-materials) and [discussion](https://github.com/microsoft/vcpkg/discussions/40700) @ Microsoft docs\n- The merging code was adapted from https://github.com/philips-software/SPDXMerge\n- The `jq` script [here](https://edgebit.io/blog/merge-two-sboms/) is a nice alternative\n- [licensecpp](https://github.com/cenit/licencpp/tree/master) is another approach starting from the `vcpkg` manifest.json file.\n- [spdx docs](https://spdx.github.io/spdx-spec)\n\n## Disclaimer / Limitations\n\n\u003e [!WARNING]\n\u003e As indicated at the `vcpkg` [docs](https://learn.microsoft.com/en-us/vcpkg/reference/vcpkg-json#license):\n\u003e _The licensing information provided for each package in the vcpkg registry represents Microsoft's best understanding of the licensing requirements. However, this information may not be definitive. Users are advised to verify the exact licensing requirements for each package they intend to use, as it is ultimately their responsibility to ensure compliance with the applicable licenses._\n\nWhile `vcpkg` offers a lot of information about licensing, this information should be scrutinized. Any tool that builds on top of this information provided by `vcpkg` is reliant on the legibility of the provided data, and should thus, be also scrutinized for correctness.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoverseai%2Fvcpkg-sbom","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoverseai%2Fvcpkg-sbom","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoverseai%2Fvcpkg-sbom/lists"}