opensbom-generator / spdx-sbom-generator

Support CI generation of SBOMs via golang tooling.
403 stars 110 forks source link

Python(Go) - poetry - dependencies listed in METADAT file are not displayed in SPDX file #146

Closed niruautomation closed 3 years ago

niruautomation commented 3 years ago

@lfpratik Tool Version Cloned code from main branch of https://github.com/spdx/spdx-sbom-generator on 11-06-2021 and built the tool Test Repo https://github.com/lfpratik/spdx-poetry-demo OS Windows 10

  1. Followed all prerequisite steps as per https://confluence.linuxfoundation.org/display/PROD/SPDX+-+Python+Module+-+Prerequisites+For+Windows
  2. Followed Prerequisite and Steps as per below screenshot image
  3. Execute ./spdx-sbom-generator
  4. Observed that all dependencies listed in METADAT file are not displayed in SPDX file Example1 image

image

Example2 image

image

lfpratik commented 3 years ago

Just for the log tester python version is 3.9.5

lfpratik commented 3 years ago

@niruautomation, my first thought on the highlighted packages those packages are not installed due to the dependency on the python version required for them. pyrsistent required python < 3 version enum34 required python < 3.4 version

If your current python version higher side then it will not list into SPDX files it will get skip into the dependency tree. Note: This case applies to the other test projects.

I believe it is the expected output. @licquia can you confirm this I am imaging this case will occur on the pure python side.

cc: @licquia and @niravpatel27

niruautomation commented 3 years ago

@lfpratik @licquia @niravpatel27 Could you please confirm what is the expected behavior

licquia commented 3 years ago

Our expected behavior is that these modules are not present unless you are running an older version of Python (3.4 or earlier in the case of enum34, or Python 2.x with pyrsistent. So I believe it's correct that these modules are not present in the SPDX file.

niruautomation commented 3 years ago

Verified packages as per above comment and observed that dependencies are fetched as expected