Repository navigation
fix: v4 poetry missing transitive deps? #651
Description
via #605 (comment)
I am testing with poetry as I am interested in reporting only the production dependencies.
If I have a program A, that uses a library B that has a dependency C, I see that the dependency C does not appear in the report of my program A. Is this correct?
via #605 (comment)
It would be expected that the SBOM result included all transitive dependencies that were caused by the requested group(s).
Is this not the case? Could you share an examplepyproject.tomlandpoetry.lockand tell how you calledcyclonedx-py poetry?
via #605 (comment)
Yes, it is uploaded in these 2 repositories:
https://github.com/JCHacking/program_a
https://github.com/JCHacking/library_bIf I execute this command with program_a:
cyclonedx-py poetry --outfile dependencies_bom.xml --output-format XMLI see that in the generated file is not the dependency of library_b, in this case aiohttp (The xml that has generated me in the repository so you can see it)
Also, if you need it, this is the output of the command:
WARNING | CDX.PoetryBB > skip unlocked dependency: library_b C:\Users\jcmencia\PycharmProjects\Others\program_a\.venv\Lib\site-packages\cyclonedx\model\bom.py:609: UserWarning: The Component this BOM is describing None has no defined dependencies which means the Dependency Graph is incomplete - you should add direct dependencies to this "root" Component to complete the Dependency Graph data. warn(
Originally posted by @JCHacking in #605 (comment)
Activity
jkowalleck commentedon Jan 12, 2024
@JCHacking could you modify your projects so they do not require py3.12, but py3.8?
This would allow me to use them for extensive multi-py tests
jkowalleck commentedon Jan 12, 2024
issue is caused by package name normalization -- https://packaging.python.org/en/latest/specifications/name-normalization/
will provide a fix soon
jkowalleck commentedon Jan 12, 2024
issue was a mismatch in the package names in the actual package, the depedenncy definition in the project manifest and in the lock files.
package name normalization was improved/completed according to spec . so now the issue should be fixed. will merge and release a new RC.
jkowalleck commentedon Jan 12, 2024
closed via #652
[-]v4 poetry missing transitive deps? [/-][+]fix: v4 poetry missing transitive deps? [/+]jkowalleck commentedon Jan 12, 2024
a fix was published via https://github.com/CycloneDX/cyclonedx-python/releases/tag/v4.0.0-rc.6
@JCHacking , could you test it?
it is available via
cyclonedx-bom==4.0.0rc6JCHacking commentedon Jan 13, 2024
Hi @jkowalleck
Sorry for the delay, I just tried the correction and it works fine!!!!
I understand that you no longer need to modify the python version of the repositories for the example.
I will keep testing this new version, and in case I find something wrong, I will report it.
Thank you very much for your quick resolution!!! 🥇
jkowalleck commentedon Jan 13, 2024
Thank you for your testing efforts. This is very much appreciated.