Identified only 9 packages, 7 packages are missing.
ex : verboselog:1.7, dateparser:0.7.0, etc (These are some of missing packages to identify by sfyt)
Anything else we need to know?:
Syft is parsing only {package-name}=={version} format only, remaining all other formats are not parsing and listing in SBOM from requirements.txt . (ex: {package-name}>={version})
Please refer page, few other formats also supported by python requirements.txt file - https://packaging.python.org/en/latest/specifications/version-specifiers/#version-specifiers
What happened:
SBOM generated for python is missing few packages listed in the requirements.txt file
What you expected to happen:
SBOM should list all packages mentioned in the requirements.txt file
Steps to reproduce the issue:
Run the Syft
/usr/local/bin/syft /scratch/app/gobgovin/jars/python-requirements/ -o syft-json=syft_python_bom_test.json ✔ Indexed file system /scratch/app/gobgovin/jars/python-requirements ✔ Cataloged contents beb33833a4b4aaabf7dde249b8713668b3b495f08e9619455f643cabe6be8c42 ├── ✔ Packages [9 packages] └── ✔ Executables [0 executables]
Identified only 9 packages, 7 packages are missing. ex : verboselog:1.7, dateparser:0.7.0, etc (These are some of missing packages to identify by sfyt)
Anything else we need to know?: Syft is parsing only {package-name}=={version} format only, remaining all other formats are not parsing and listing in SBOM from requirements.txt . (ex: {package-name}>={version}) Please refer page, few other formats also supported by python requirements.txt file - https://packaging.python.org/en/latest/specifications/version-specifiers/#version-specifiers
Environment:
Output of
syft version
: Application: syft Version: 1.4.1 BuildDate: 2024-05-09T19:45:46Z GitCommit: c200896a9644f9b6bd4bc3785c848276c33bb53c GitDescription: v1.4.1 Platform: linux/amd64 GoVersion: go1.21.9 Compiler: gcOS (e.g:
cat /etc/os-release
or similar): NAME="Oracle Linux Server" VERSION="7.9"