Run benchmarks for common open source SBOM generation tools on typical Python constructs like virtual environments.

Make sure all the tools are installed:

./install-all.sh

This requires a local Node installation for cdxgen. Then you can run the benchmarks:

$ ./run-all.sh

and inspect the results under sboms/.

Some generators only support reading from a requirements.txt file while some only support reading from a virtual environment. Syft supports scanning both sources but gives different results.