feat: option to use an alternative python environment #543
Conversation
Signed-off-by: Mario Jonke <[email protected]>
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| else: | ||
| from importlib_metadata import metadata, PackageMetadata as _MetadataReturn | ||
| from importlib_metadata import Distribution, distributions, PackageMetadata as _MetadataReturn |
There was a problem hiding this comment.
F401: 'importlib_metadata.PackageMetadata as _MetadataReturn' imported but unused
ℹ️ Expand to see all @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
| Command | Usage |
|---|---|
@sonatype-lift ignore |
Leave out the above finding from this PR |
@sonatype-lift ignoreall |
Leave out all the existing findings from this PR |
@sonatype-lift exclude <file|issue|path|tool> |
Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file |
Note: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
| self.assertNotEqual(c_packaging.purl.to_string(), c_packaging.bom_ref.value) | ||
| self.assertIsNotNone(c_packaging.licenses) | ||
| self.assertEqual(len(c_packaging.licenses), 2) | ||
| self.assertEqual({LicenseChoice(license=License(name="BSD License")), |
There was a problem hiding this comment.
E1123: Unexpected keyword argument 'license' in constructor call
❗❗ 3 similar findings have been found in this PR
🔎 Expand here to view all instances of this finding
| File Path | Line Number |
|---|---|
| tests/test_parser_environment.py | 80 |
| tests/test_parser_environment.py | 81 |
| tests/test_parser_environment.py | 81 |
Visit the Lift Web Console to find more details in your report.
ℹ️ Expand to see all @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
| Command | Usage |
|---|---|
@sonatype-lift ignore |
Leave out the above finding from this PR |
@sonatype-lift ignoreall |
Leave out all the existing findings from this PR |
@sonatype-lift exclude <file|issue|path|tool> |
Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file |
Note: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
| ) -> None: | ||
| super().__init__() | ||
| debug_message('init {}', self.__class__.__name__) | ||
|
|
||
| debug_message('late import pkg_resources') | ||
| import pkg_resources | ||
| debug_message('processing importlib-metadata.distributions') |
There was a problem hiding this comment.
reportGeneralTypeIssues: Expected 2 more positional arguments
❗❗ 5 similar findings have been found in this PR
🔎 Expand here to view all instances of this finding
ℹ️ Expand to see all @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
| Command | Usage |
|---|---|
@sonatype-lift ignore |
Leave out the above finding from this PR |
@sonatype-lift ignoreall |
Leave out all the existing findings from this PR |
@sonatype-lift exclude <file|issue|path|tool> |
Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file |
Note: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
| c_packaging = parser.get_components()[0] | ||
| self.assertEqual(c_packaging.name, "packaging") | ||
| self.assertEqual(c_packaging.version, "23.1") | ||
| self.assertNotEqual(c_packaging.purl.to_string(), c_packaging.bom_ref.value) |
There was a problem hiding this comment.
reportOptionalMemberAccess: "to_string" is not a known member of "None"
ℹ️ Expand to see all @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
| Command | Usage |
|---|---|
@sonatype-lift ignore |
Leave out the above finding from this PR |
@sonatype-lift ignoreall |
Leave out all the existing findings from this PR |
@sonatype-lift exclude <file|issue|path|tool> |
Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file |
Note: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
|
probably superseded by #627 |
|
definitely superseded by #605 |
fixes: #475
Changes
Adds the
--envoption to theenvironmentcommand line to allow specifying a path to a location where packages are installed. This enables generating the BOM for an environment without the need to installcyclonedx-bominto said environment.Usage of
setuptools/pkg_resourcesin theEnvironmentParserwas replaced with functionality provided byimportlib.metadatafor the following reasons:pkg_resourcesfrom an alternative environment (e.g. via anEnvironmentwith customsearch_pathor aWorkingSetwith differententries) themetadatafunction fromimportlib.metadatawill not find any data since it usessys.pathto locate distributionspkg_resourcesis discouraged due to deprecationTests
For testing a stripped down virtual environment (basically only retaining the required metadata without source files) was added as fixture so that SBOM generation can be verified accordingly
Docs
Fixes some inconsistencies in docs and readme files.