olemd/conan-1.6-utilities
Watch
1
0
Fork
You've already forked conan-1.6-utilities
 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions
5 releases 5 tags
  • v0.5.0 4c47235c82

    v0.5.0 Stable

    olemd released this 2026-09-29 15:19:31 +02:00 | 2 commits to main since this release

    New: conansbom – a software bill of materials for a Conan 1.x project

    For inventory and license compliance, e.g. to hand to a customer or load into Dependency-Track. It reads the same graph conan install resolves, with the recipes loaded, so it knows what lockfile-based tools cannot: each package's declared license, and which packages ship versus are only used to build.

    conansbom path/to/conanfile.py -r myremote --out sbom.cdx.json            # CycloneDX 1.6 (default)
conansbom path/to/conanfile.py -r myremote -f spdx --out sbom.spdx.json   # SPDX 2.3
conansbom path/to/conanfile.py -r myremote -f html --out sbom.html        # page for people
    • Every package once, with purl (pkg:conan/…), description, homepage and recipe URL; the project is the document's subject, with the build settings it describes.
    • What ships vs. what only builds it: build requirements, and everything only they pull in, are scope: excluded in CycloneDX and BUILD_DEPENDENCY_OF in SPDX.
    • Licenses exactly as declared, classified against the embedded SPDX License List 3.29.0 (works offline): SPDX identifiers and expressions are written as such, anything else is kept verbatim (a LicenseRef- with its text in SPDX). Packages that declare no license are listed on stderr and flagged in the HTML page.
    • Every format is validated in the tests (CycloneDX schema, spdx-tools).

    conandeps: a leaner HTML report

    • Each fact is shown once: the "Newer versions" and "Missing binaries" sections are folded into the dependency table (export dates and the version range are now tooltips), and the dependency tree shows structure only.
    • The tree's root and the last update-order wave use the project's package name instead of the conanfile path.

    The terminal output and the exit codes are unchanged.

    Install / upgrade

    With uv (installs both conandeps and conansbom):

    uv tool install git+https://kode.naiv.no/olemd/conan-1.6-utilities.git
uv tool upgrade conan-utils

    With pip, in a dedicated venv:

    ~/.venvs/conan-utils/bin/pip install git+https://kode.naiv.no/olemd/conan-1.6-utilities.git@v0.5.0

    conansbom imports conandeps, so it runs installed or from a checkout, not as a lone downloaded file.

    Downloads