microsoft / microsoft/component-detection
package detector warning
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
I got two question about warning note while running component detection leveraging msft-sbom-tool.
- Does component detection tool support C/C++ based project?
We noticed component detection isn't capturing any packages and throws the below mentioned warning. Does C/C++ projected supported? if not, will this been enabled in the future?
##[warning]There were no packages detected during the generation workflow.
- We noticed few of the component has been skipped. For example tensorflow and keras. Is this expected behavior or something need to be change on python requirement.txt.
]Candidate version ("protobuf 5.26.0 - pip") for "protobuf" already exists in map and the version is NOT valid.
##[warning]Specifiers: "!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<5.0.0dev,>=3.20.3" for package "tensorflow-cpu-aws" caused this.
##[warning]Candidate version ("tensorboard 2.15.2 - pip") for "tensorboard" already exists in map and the version is NOT valid.
##[warning]Specifiers: "<2.17,>=2.16" for package "tensorflow" caused this.
##[warning]Version Resolution for "tensorboard" failed, assuming last valid version is used.
##[warning]Candidate version ("keras 2.15.0 - pip") for "keras" already exists in map and the version is NOT valid.
##[warning]Specifiers: ">=3.0.0" for package "tensorflow" caused this.
##[warning]Components skipped for "Pip" detector:
##[warning]- "abi-pytestfixture-integration"
##[warning]- "abi-core"
##[warning]- "abi-package"
##[warning]- "abi-vault"
##[warning]- "numpy=1.26.4"
And I specify PIP_EXTRA_INDEX_URL as an internal link in system environment as well as in requirement.txt, but all the package is still not found in component detection. Do you know who can we resolve this warning message?
##[warning]Received NotFound "Not Found" from https://pypi.org/pypi/abi-core/json
##[warning]Root dependency "abi-core" not found on pypi. Skipping package.
##[warning]Received NotFound "Not Found" from https://pypi.org/pypi/abi-package/json
##[warning]Root dependency "abi-package" not found on pypi. Skipping package.
##[warning]Received NotFound "Not Found" from https://pypi.org/pypi/abi-vault/json
##[warning]Root dependency "abi-vault" not found on pypi. Skipping package.
Thank you.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the msft-sbom-tool component-detection workflow and the Pip detector warnings shown in the issue, including the C/C++ support question and PIP_EXTRA_INDEX_URL behavior. Review how the detector handles TensorFlow and Keras version constraints and private packages; done means documenting the supported project types and a reproducible resolution for the skipped components.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, keras, python, tensorflow
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100