Crashes on requirements with latest (without version) packeges

[L4zyF1ng3r]

Hi everybody.
Found the problem, my requirements.txt has packages with no version specified.
When executing the command:

cyclonedx-py -r -rf requirements.txt -o bom.xml 

I have an error:

Traceback (most recent call last):
  File "/usr/local/bin/cyclonedx-py", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.9/site-packages/cyclonedx_py/client.py", line 152, in main
    CycloneDxCmd().execute()
  File "/usr/local/lib/python3.9/site-packages/cyclonedx_py/client.py", line 63, in execute
    output = self.get_output()
  File "/usr/local/lib/python3.9/site-packages/cyclonedx_py/client.py", line 55, in get_output
    bom=Bom.from_parser(self._get_input_parser()),
  File "/usr/local/lib/python3.9/site-packages/cyclonedx_py/client.py", line 139, in _get_input_parser
    return RequirementsFileParser(requirements_file=self._arguments.input_requirements_file)
  File "/usr/local/lib/python3.9/site-packages/cyclonedx/parser/requirements.py", line 51, in __init__
    super(RequirementsFileParser, self).__init__(requirements_content=r.read())
  File "/usr/local/lib/python3.9/site-packages/cyclonedx/parser/requirements.py", line 41, in __init__
    (op, version) = requirement.specs[0]
IndexError: list index out of range 

If I remove packages without versions, the process goes without errors.

pip3 list | grep cyclonedx
cyclonedx-bom        1.0.2
cyclonedx-python-lib 0.4.0

[madpah]

Hi @L4zyF1ng3r,

Thanks for reporting an issue.

This project is not intended to be able to generate a CycloneDX from a requirements file that does not contain pinned versions.

Under the current (version 1.3) CycloneDX schema, a version must be present for a Component in an SBOM (see https://cyclonedx.org/docs/1.3/#type_component).

Perhaps you may be better served by running cyclonedx-py in environment mode (-e flag) which will generate a CycloneDX from the exact packages and versions you currently have installed in your environment?

[madpah]

@L4zyF1ng3r - version 1.0.5 adds better support for handing requirements.txt which do not include versions :-)