-
Notifications
You must be signed in to change notification settings - Fork 568
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Python egg packages are not parsed for SBOM #1761
Comments
Hi @Oh-Py-God, would you be able to share the .egg file you are working with so we can reproduce this issue? Thanks! |
@tgerla attaching the egg file for your reference. |
Thank you! We will investigate and get back to you when we have an update. What I've found so far: This boto3 egg has an
It may be the case that we need to expand our search glob to include
|
Thanks for looking into this, @tgerla. I have also observed that syft does not parse .egg-info directories properly. PFA screenshot and sample .egg-info for your reference. |
Hi @Oh-Py-God, thanks for the additional details. Do you happen to know why the boto3 egg file might have EGG-INFO in uppercase, where other eggs might be using lowercase? If you don't know, that's fine, but we thought we would ask. Thank you! |
Hi @tgerla, apologies for the delayed response. While generating SBOM for different products in my organization, I came across certain build processes where EGG-INFO (uppercase) directories were found. Also, referring to the setuptools page, it is evident to find this type of a structure. Let me know if further information is needed to fix this. |
Hi @Oh-Py-God, thanks for the reply! We will probably extend the glob search to include uppercase EGG-INFO and uppercase DIST-INFO to solve this problem. |
What happened:
While trying to generate SBOM for a package containing a python package in egg form, syft is not able to capture the same in SBOM.
What you expected to happen:
egg package should have been discovered as part of SBOM.
Steps to reproduce the issue:
Create a simple python project with egg dependency shipped along.
Run the syft command on the project
Anything else we need to know?:
PFA screenshot for your reference.
Environment:
syft version
:cat /etc/os-release
or similar):MacOS Ventura 13.2.1
The text was updated successfully, but these errors were encountered: