Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: mark dev-dependencies component.scope as "excluded" #675

Open
jkowalleck opened this issue Feb 8, 2024 · 0 comments
Open

feat: mark dev-dependencies component.scope as "excluded" #675

jkowalleck opened this issue Feb 8, 2024 · 0 comments
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed source: pipenv source: poetry

Comments

@jkowalleck
Copy link
Member

jkowalleck commented Feb 8, 2024

Is your feature request related to a problem? Please describe.

Per CycloneDX specification, the components' scope means (see docs)

  • "required": The component is required for runtime
  • "optional": The component is optional at runtime. Optional components are components that are not capable of being called due to them not be installed or otherwise accessible by any means. Components that are installed but due to configuration or other restrictions are prohibited from being called must be scoped as 'required'.
  • "excluded": Components that are excluded provide the ability to document component usage for test and other non-runtime purposes. Excluded components are not reachable within a call graph at runtime.

Current implementation does not set any scope, meaning the fallback to "required".
for dev-dependencies this would be wrong.

Describe the solution you'd like

mark all components, that are dev-dependencies only, as "excluded" in the resulting SBOM.

Describe alternatives you've considered

none

Additional context

for poetry

poetry knowns the "dev" group/category - things that are in there only (not in any other) are dev-dependencies

for pipenv

pipenv knowns a group/category called "dev-packages" - things that are in there only (not in any other) are dev-dependencies

for pyproject.toml

pyproject knows optional-dependency groups. see also PEP735 (draft)
there is no accepted PEP for that matter (or is there?), but commonly, people use "dev" or
"devel", "development" group to tell development-dependencies. - things that are in there, but not in any other, are dev-dependencies
Since there is no consensus here, the pyproject SHOULD have no effect on the component.scope, for now

@jkowalleck jkowalleck added enhancement New feature or request help wanted Extra attention is needed good first issue Good for newcomers source: poetry labels Feb 8, 2024
@jkowalleck jkowalleck changed the title feat: mark poetry dev-dependencies component.scope as "escluded feat: mark Poetry's dev-dependencies component.scope as "escluded Feb 8, 2024
@jkowalleck jkowalleck changed the title feat: mark Poetry's dev-dependencies component.scope as "escluded feat: mark Poetry's dev-dependencies component.scope as "excluded" Mar 14, 2024
@jkowalleck jkowalleck changed the title feat: mark Poetry's dev-dependencies component.scope as "excluded" feat: mark dev-dependencies component.scope as "excluded" Jun 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed source: pipenv source: poetry
Projects
None yet
Development

No branches or pull requests

1 participant