Pitloom

Pitloom automates the generation of SPDX 3-compliant SBOMs for AI models and Python projects, documenting the composition and provenance of software systems. It reads metadata directly from Python packages and AI models (GGUF, ONNX, PyTorch, Safetensors) and offers native Hatchling integration so SBOMs can be generated automatically as part of a build.

Install

pip install pitloom

Install with AI model metadata extraction support:

pip install pitloom[ai]

Use

Command line

Create SBOM for the Python project in the current directory:

loom .

Create SBOM of a local AI model:

loom -m path/to/model.safetensors -o model.spdx3.json
loom -m path/to/model.gguf --pretty

Create SBOM of an AI model on Hugging Face Hub:

loom -m https://huggingface.co/mistralai/Mistral-7B-v0.1
loom -m Qwen/Qwen3-235B-A22B   # bare model ID also works

GitHub Action

- uses: bact/pitloom@v0.11.0

This creates a standalone SBOM file on the runner. It can be used for compliance logs, CI/CD audits, and release assets.

Note: Running the GitHub Action alone does not embed the SBOM inside your distributed Python wheel (use the Hatchling build hook for PEP 770 wheel embedding).

Hatchling build hook

Create SBOM during Hatchling build:

[build-system]
requires = ["hatchling>=1.28.0", "pitloom>=0.11.0"]
build-backend = "hatchling.build"

[tool.hatch.build.hooks.pitloom]
enabled = true

This embeds an SBOM into the distributed Python wheel.

Python API

from pathlib import Path
from pitloom.assemble import generate_sbom

project_path = Path("/path/to/project")
generate_sbom(project_path)

Python tracking decorator

from pitloom import loom

@loom.run(output_file="fragments/train.json")
def train_model():
    loom.set_model("model-name")
    loom.add_dataset("dataset-name", dataset_type="text")
    # ... training logic ...

Learn more

• Creation metadata – who/what/when/how every Pitloom-generated element records about its own creation.
• Metadata provenance – how Pitloom tracks the source of each metadata field for auditability.
• Resources – SBOM, AIBOM, SPDX, and related standards reading list.

Get started

See the project README for installation, quick start, and full usage instructions.