Addition of component name and type when running as requirements

[andy778]

It would be good to somehow add the component name and data to the json when running "cyclonedx-py requirements", can't pick this information up from req file, so either som smart logic from git or command line argument

"component":{ 
"name": "My application", 
"version": "1.0.0", 
"type": "application" }
,

metadata_component_version

[jkowalleck]

you are referring to populating $.metadata.component?

then this capability is already there, see the docs:

example usage

cyclonedx-py requirements --pyproject .../pyproject.toml .../requirements.txt

examples: https://github.com/CycloneDX/cyclonedx-python/tree/main/tests/_data/infiles/requirements
example results: https://github.com/CycloneDX/cyclonedx-python/tree/main/tests/_data/snapshots/requirements

[andy778]

Q) you are referring to populating $.metadata.component?
A) yes, thanks case closed

[jkowalleck]

@andy778 since you had to ask about this capability, I wonder, whether the current documentation is insufficient.
I'd appreciate your help improving the documentation. 💟
Do you have a suggestion what could be changed or elaborated/added? A pull-request would be great, though.

the rendered docs are here: https://cyclonedx-bom-tool.readthedocs.io/en/latest/
the raw docs are here: https://github.com/CycloneDX/cyclonedx-python/tree/main/docs
and the help pages for --pyproject are here: https://github.com/CycloneDX/cyclonedx-python/blob/main/cyclonedx_py/_internal/cli_common.py

[andy778]

This was due to several challenges before this case

• Some consumers of sbom files have this " metadata.component" as mandatory
• Not all consumers do schema check and this didn't trigger fault either, but I think it should do as name at least is required
• Not all python projects have pyproject.toml yet

Ideas ?

• Perhas add to examples "cyclonedx-py requirements --help"
• Should it fill in default "$.metadata.component" with some name fom directory, or perhaps make --pyproject mandatory ?