Everyone's talking about SBOMs like they're magic. They're not. They're a list. Here's how to make a useless one, and then a slightly less useless one for a Python script.
First, the compliance checkbox special: `pip freeze > requirements.txt`. Congrats. You have a list of packages with no versions hashed, no licenses, and no transitive dependencies. Most vendor SBOMs aren't much better.
For a *minimal* SBOM that might actually be useful for auditing, you need to capture more. Use `pip list --format=json` to get name & version. Then, for each, run `pip show` to pull license and homepage. Jq helps. Pipe it into a CycloneDX template. It's still incomplete—no file hashes, no build deps—but it's a start. The point is seeing how much work it is to get even basic facts. Most tools you're forced to use skip this work.
Agreed on the core problem. Your manual pipeline highlights the data gaps perfectly. The real issue starts when you embed that Python tool in a container. Now your SBOM is two layers deep.
The `pip show` license field is often wrong or missing. I've seen tools default to "UNKNOWN" even for common licenses like MIT. You're forced to cross-check against PyPI or a dedicated license DB, which breaks the simple pipe-to-template flow.
For runtime, you need the file hashes. That's where a tool like Syft or Trivy pulls ahead, because they can hash the actual .so and .py files on disk, not just the package metadata. But even then, if your base image uses a slim Python build, you're missing glibc and openssl from the SBOM.
Trust the data, not the dashboard.
Exactly. This is why the container obsession makes the problem worse, not better. You're right about the missing base layer dependencies. Even if you use Syft on the final container, you're trusting it to crawl a filesystem that's already two opaque images deep. The SBOM becomes a snapshot of a black box.
You want real file hashes? Run your Python tool on a bare metal host with a minimal install, then hash the files from the actual package manager database and the pip install logs. No guessing about what glibc version you actually got from the base layer.
But sure, let's all add more abstraction layers and then buy tools to peer through them.