Skip to content

When using Poetry lockfile, allow users to select dependency group(s) #580

Closed

Description

@robertlagrant

Poetry allows for different types of dependency; e.g. production, test, etc. The names are not fixed.

It would be great to be able to select e.g. only production dependencies (and their transitive dependencies) for SBOM output.

E.g.

cyclonedx-py --poetry --poetry-group production

Activity

  1. jkowalleck commented on Sep 7, 2023

    @jkowalleck
    Member

    groups:

    class PoetryGroupWellknown(Enum):
    """Wellknown Poetry groups.
    See https://python-poetry.org/docs/managing-dependencies/#dependency-groups
    """
    Main = "main"
    Dev = "dev"

    feature is kinda implemented in upcoming v4
    as CLI switch --omit:

    -omit OMIT, --omit OMIT
    Omit specified items when using Poetry or PipEnv
    (currently supported is dev)


    a better implementetion is planend, but depends on #527
    if every parser was handled by an own subcommand, then it would be possible to add specific CLI switches, like a poetry-specific --only=main, which would contradict --omit=...

  2. added this to the 4.0.0 milestone on Sep 7, 2023
  3. linked a pull request that will close this issuefeat!: rewrite CLI and parsers #610on Nov 13, 2023
  4. jkowalleck commented on Dec 25, 2023

    @jkowalleck
    Member

    fixed by #605

  5. jkowalleck commented on Dec 25, 2023

    @jkowalleck
    Member

    This feature will be part of the next/upcoming major release.
    Changelog: see #605
    Install via: pip install cyclonedx-bom==4.0.0rc1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions