CycloneDX / CycloneDX/cyclonedx-python

Feature Request: Include Python version in SBOM

Open
#597 7 comments 5 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
Python
Stars
390
Forks
98
Avg merge
2d 23h
Merged PRs (30d)
2

Description

As discussed in https://github.com/CycloneDX/cyclonedx-python/discussions/393#discussioncomment-7270903 the specific version of Python that a piece of software is run with is an important part of its dependencies.

Therefore, although the Python version isn't usually bundled with a piece of software, it can be useful to know what version was used when the SBOM was generated - ideally, because that is the same version it is deployed with or was used to build the wheel.

For internal tools, it provides visibility into which Python versions are being used.

Limitations:
Especially if a tool isn't package but simply deployed, it can be used with any Python version that supports all features it uses, and the SBOM cannot accurately reflect that. This could potentially be misleading.

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked discussion and the issue’s limitations, then locate the SBOM-generation entry point in the repository. Determine how the Python runtime version should be represented and add coverage for the generated SBOM; done means the version is included without overstating the runtime requirement.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.