# SBOM coverage across PyPI

pypi-tea tracks which Python packages ship a CycloneDX or SPDX SBOM inside their wheels ([PEP 770](https://peps.python.org/pep-0770/)), whether it validates, and whether the wheel carries a PEP 740 attestation. Every SBOM found is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). Every page is also available as Markdown: add `.md` to its URL.

## Coverage

- Package versions explored: 799,131
- With an SBOM: 2,645 (0.33%)
- Wheels checked: 1,084,250, of which 44,518 contain an SBOM
- Wheels with a verified PEP 740 attestation: 197,496
- SBOM formats: CycloneDX/1.5 (32,744), CycloneDX/1.4 (11,881), CycloneDX/1.6 (264), CycloneDX/1.7 (172), SPDX/2.3 (42), CycloneDX/1.3 (35), SPDX/3.0 (3)

## Browse

- [All packages with SBOMs](https://pypi.sbomify.com/packages.md)
- [CycloneDX SBOMs](https://pypi.sbomify.com/packages.md?format=CycloneDX)
- [SPDX SBOMs](https://pypi.sbomify.com/packages.md?format=SPDX)

## Query with TEA

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/<name>@<version>
```

A release that hasn't been looked up before is fetched from PyPI on the first TEA query.

---
From pypi-tea by sbomify: https://pypi.sbomify.com/