microsoft / microsoft/component-detection

package detector warning

Open
#1,043 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

detector:pip status:waiting-on-response type:bug
Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

I got two question about warning note while running component detection leveraging msft-sbom-tool.

  1. Does component detection tool support C/C++ based project?

We noticed component detection isn't capturing any packages and throws the below mentioned warning. Does C/C++ projected supported? if not, will this been enabled in the future?
##[warning]There were no packages detected during the generation workflow.
No_packages

  1. We noticed few of the component has been skipped. For example tensorflow and keras. Is this expected behavior or something need to be change on python requirement.txt.

]Candidate version ("protobuf 5.26.0 - pip") for "protobuf" already exists in map and the version is NOT valid.
##[warning]Specifiers: "!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<5.0.0dev,>=3.20.3" for package "tensorflow-cpu-aws" caused this.
##[warning]Candidate version ("tensorboard 2.15.2 - pip") for "tensorboard" already exists in map and the version is NOT valid.
##[warning]Specifiers: "<2.17,>=2.16" for package "tensorflow" caused this.
##[warning]Version Resolution for "tensorboard" failed, assuming last valid version is used.
##[warning]Candidate version ("keras 2.15.0 - pip") for "keras" already exists in map and the version is NOT valid.
##[warning]Specifiers: ">=3.0.0" for package "tensorflow" caused this.

##[warning]Components skipped for "Pip" detector:
##[warning]- "abi-pytestfixture-integration"
##[warning]- "abi-core"
##[warning]- "abi-package"
##[warning]- "abi-vault"
##[warning]- "numpy=1.26.4"

tensorflow

And I specify PIP_EXTRA_INDEX_URL as an internal link in system environment as well as in requirement.txt, but all the package is still not found in component detection. Do you know who can we resolve this warning message?

##[warning]Received NotFound "Not Found" from https://pypi.org/pypi/abi-core/json
##[warning]Root dependency "abi-core" not found on pypi. Skipping package.
##[warning]Received NotFound "Not Found" from https://pypi.org/pypi/abi-package/json
##[warning]Root dependency "abi-package" not found on pypi. Skipping package.
##[warning]Received NotFound "Not Found" from https://pypi.org/pypi/abi-vault/json
##[warning]Root dependency "abi-vault" not found on pypi. Skipping package.

Thank you.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the msft-sbom-tool component-detection workflow and the Pip detector warnings shown in the issue, including the C/C++ support question and PIP_EXTRA_INDEX_URL behavior. Review how the detector handles TensorFlow and Keras version constraints and private packages; done means documenting the supported project types and a reproducible resolution for the skipped components.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, keras, python, tensorflow
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.