SBOM Snapshot installed environment
Developers and security teams frequently deploy runtime environments without an accurate, verifiable record of what software dependencies are physically installed on disk.
After payment, Stripe emails your download link within a few minutes (valid 7 days). Pass buyers also get the private All-Access Vault on GitHub.
Digital goods, delivered instantly. If a tool doesn't work as described, we fix it or refund you — see Terms.
requirements.txt — list of dependencies
What's in the ZIP
- Python source, README and requirements
Why PyForge: Ready-made tools with full source code.
More details
Developers and security teams frequently deploy runtime environments without an accurate, verifiable record of what software dependencies are physically installed on disk. Relying on static source lockfiles often fails to capture actual host-level installations, creating audit uncertainty and compliance gaps under standards like the EU Cyber Resilience Act. The tool inspects active Python distributions using standard library importlib metadata, scans local npm packages inside node_modules directories, and detects system packages via dpkg-query or rpm. It computes deterministic SHA-256 integrity hashes for located components, extracts license expressions, and generates standards-compliant CycloneDX 1.5 or SPDX 2.3 JSON documents. A built-in bidirectional diff engine compares two saved snapshots to highlight drift across deployments using strictly the Python standard library. Example: Run python3 sbom_snapshot_installed_enviro.py --help to view command line arguments. Create a complete CycloneDX inventory by executing python3 sbom_snapshot_installed_enviro.py --format cyclonedx --output sbom.json or track environmental drift between releases by running python3 sbom_snapshot_installed_enviro.py --diff baseline.json current.json in your shell. It does not query live vulnerability feeds like CVE databases or resolve remote package registries.
Quick Start
Runs on Python 3.9 or newer. Check requirements.txt in the ZIP and install what it lists with pip install -r requirements.txt.
1 — Install the dependencies
pip install -r requirements.txt2 — Run it
How agents & programs use it: Install its requirements in a virtual environment; scripts and AI agents can then run it as a subprocess.
Why developers buy from PyForge
- Save hours: ready-made, tested tools. Skip writing, debugging and maintaining it yourself.
- Ready in minutes: one file, drop it in your project and run it.
- Zero dependencies: no pip install chains, no supply-chain risk.
- Full source code: readable, auditable, yours to modify.
- Runs locally and offline: no account, no API key, no data leaves your machine.
- Pay once, own it: no subscription.
- Tested before release: every tool is checked before it goes on sale.
All-Access Pass
Get every PyForge tool with the All-Access Pass
41 tools today plus every future release, lifetime commercial license, one payment of $99.
This tool: $49 · All 41 tools: $99
See the All-Access Pass