Emit results in a SBOM format

[di]

Blocked on #3.

[woodruffw]

Closed #3 with CycloneDX as the choice.

[woodruffw]

Using the local environment parser from CycloneDX as inspiration for the dependency source adapter we'll have to write: https://github.com/CycloneDX/cyclonedx-python-lib/blob/79538e92834e548a3f9697388a47efa3b27da678/cyclonedx/parser/environment.py

class EnvironmentParser(BaseParser):
    """
    This will look at the current Python environment and list out all installed packages.
    Best used when you have virtual Python environments per project.
    """

    def __init__(self):
        super().__init__()

        import pkg_resources

        i: pkg_resources.DistInfoDistribution
        for i in iter(pkg_resources.working_set):
            c = Component(name=i.project_name, version=i.version)

            i_metadata = self._get_metadata_for_package(i.project_name)
            if 'Author' in i_metadata.keys():
                c.set_author(author=i_metadata.get('Author'))

            if 'License' in i_metadata.keys() and i_metadata.get('License') != 'UNKNOWN':
                c.set_license(license_str=i_metadata.get('License'))

            if 'Classifier' in i_metadata.keys():
                for classifier in i_metadata.get_all('Classifier'):
                    if str(classifier).startswith('License :: OSI Approved :: '):
                        c.set_license(license_str=str(classifier).replace('License :: OSI Approved :: ', '').strip())

            self._components.append(c)

    @staticmethod
    def _get_metadata_for_package(package_name: str):
        if sys.version_info >= (3, 8, 0):
            return metadata(package_name)
        else:
            return metadata(package_name)

[woodruffw]

Working on this now.

Not a blocker, but it looks like the cyclonedx module doesn't advertise its type hints. I've opened an upstream issue to track that: CycloneDX/cyclonedx-python-lib#52