Question: Can python-inpector handle manifest files other than requirements.txt and setup.py?

[shi9qiu]

Hi,

I am trying to use this tool to generate SBOM files for Python projects. The README says this tool can "parse various manifests and packages files such as pip requirement files, Pipfile, pyproject.toml, poetry.lock, setup.py and setup.cfg and legacy and current metadata file formats for eggs, wheels and sdist". But I find it seems that only requirements.txt and setup.py can be set as the target manifest file.

I wonder if I didn't understand how to use it. Or do you have a plan to develop the function for another manifest file such as "pyproject.toml" or "setup.cfg"?

Thank you!

[pombredanne]

Actually this is both true and not true.
The code is https://github.com/nexB/python-inspector/blob/main/src/_packagedcode/pypi.py is able to process all these formats , but only requirements.txt and setup.py have been "wired" in to be used as an input at this stage. The other are in the plan: we have the parsers alright, so the work to get these as inputs should be not too big.

Let me update the description that did mislead you.

[shi9qiu]

Thank you very much for the response. Looking forward to the function to process all these formats!

[pombredanne]

Let's keep this open so we can track the addition here!
Note also that if you know some Python, help would be much appreciated and always welcomed!

[shi9qiu]

Yes, of course! I would like to help with this functional improvement!

[Nour1709]

Hello,

I'm experiencing the same issue with ScanCode.io. When I scan my project with various manifest files (pyproject.toml, package.json, etc.), it shows 0 dependencies.

I've confirmed that only requirements.txt and setup.py are properly processed, while other formats fail with errors like:

• "No packages could be resolved" for pyproject.toml

Is there a timeline for adding support for modern formats like pyproject.toml and package.json?

[mjherzog]

@Nour1709 There is strong support already for package.json in SCIO but that has nothing to do with python-inspector.