CycloneDX / CycloneDX/cyclonedx-python

[BUG] Environment can produce indirect dependency cycles due to extras

Đã đóng
#1,102 5 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
Python
Star
390
Fork
98
Merge trung bình
2 ngày 23 giờ
Pull request đã merge (30 ngày)
2

Mô tả

## Describe the bug

When scanning the requires of a given package, cyclonedx-python appears to include a given package in `dependsOn` if that package exists in the environment even if the extra was not actually specified when installing the package. This can create indirect dependency cycles in the SBOM which tools like Sunshine do not handle well.

## To Reproduce

This is easiest to see in a package like matplotlib where it has dependencies that will have some `test` or `plot` extra that declare matplotlib as a dependency. Install matplotlib into an empty virtual environment and generate an SBOM from that environment. matplotlib will be listed as a dependency in multiple components.

## Expected behavior

The SBOM only includes includes a dependency in `dependsOn` when it's known that the dependency was requested by the component.

## Environment

- _cyclonedx-py_ version: 7.3.1
- Python version: 3.10.12
- OS: Ubuntu Linux

## Additional context

This isn't a trivial problem to solve. A virtual environment doesn't appear to expose a means of querying what extras were chosen for a given package. One could choose a heuristic like "only include the dependencies if all of the dependencies specified by that extra exist in the environment," but that heuristic fails in the MRE: matplotlib depends on fonttools which has a `plot` extra whose only requirement is matplotlib.

## Contribution

- [ ] I am willing to provide a fix
- [x] I will wait until somebody else fixes it

If I had a better understanding of the internals, I might have been able to provide a fix but the nature of this problem might require more discussion.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

Start by reproducing the matplotlib case in an empty virtual environment with cyclonedx-python 7.3.1, then trace how installed package requirements and extras become SBOM dependsOn entries. Done means the generated SBOM includes a dependency only when it is known to have been requested and does not contain the described indirect cycles.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
python
Lĩnh vực
devtools, security
Loại issue
Lỗi
Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức độ hoạt động
Sôi nổi
Độ rõ ràng
Cần làm rõ
Mức phù hợp với người mới
35/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.