CycloneDX / CycloneDX/cyclonedx-python

[IDEA] feat: library mode

Abierto
#1,041 2 comentarios 0 reacciones 0 asignados Ver en GitHub
enhancement
Lenguaje dominante
Python
Estrellas
390
Forks
98
Merge medio
2 d 23 h
PR fusionados (30 d)
2

Descripción

## Is your feature request related to a problem? Please describe.

if i build a SBOM for a **library**, i do not want to have non-bundled component listed as if they were concrete.
These dependencies are extraneous/"external" and the version of them is not clear - it is resolved on install-time .
Also, transitive dependencies of those are not clear until install-time.

This should be reflected in the SBOM.

## Describe the solution you'd like

Spec:

add a way to have
- only the bundled dependencies and the direct dependencies as components in the SBOM result.
- to be discussed, as python packaging does not declare this at the moment - see in contrast PEP770
- non-bundled' components must have no version.
- non-bundled's components must have a version range - [specification#321]
- non-bundled are marked as "external" - [specification#321]
- the dependency composition completeness is set to "incomplete_first_party_only" - see https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf page 59

## UX

to be discussed - see https://github.com/CycloneDX/cyclonedx-python/issues/1041#issuecomment-4250137234

### option to exisitng subcomamnds

option could be called (list of ideas)
- `--library-mode`
- `--mark-extraneous`/`--mark-externals`
- add your idea in the comments

new option MUST imply `--omit dev`

new option MUST be disabled bu default
new option MUST be marked as experimental in help page
new option might set `--mc-type=library'


### Describe alternatives you've considered

- instead of adding an option to existing sub-commands, we might add a specific sub command. -- to be discussed.
- we could make it, so that the existing option `--mc-type=library' causes this behavior by default, but that would be a breaking change

### Additional context

for libraries, non-bundled components are "external" - this is discussed in [specification#321]

`pyrproject.toml` knows the concept of
- platdform-depenedncies -- #597
- direct-dependencies
- optional dependencies (might be controlled by "extras")
- dev-dependencies - no intention to be shipped.
might shadow all of the above on build-time

the library-moed SBOM genertated by the tool might be merged with an extra SBOM to create an entire SBOM for PEP770

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

[specification#321]: https://github.com/CycloneDX/specification/issues/321

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.