Add support of piptools generated requirements.txt

[Kristouff]

Hi everyone,

I am trying to generate a SBOM with cdxgen for a python project.
My project has some dependencies managed with piptools.
I have a requirements.in input file with primary dependencies listed

sample_requirements.in
requests==2.27.1

From which I generate a requirements.txt using pip-compile containing all transitive dependencies documented through annotations

sample_requirements.txt
certifi==2021.10.8
# via requests
chardet==4.0.0
# via requests
idna==2.10
# via requests
requests==2.27.1
# via -r sample_requirement.in
urllib3==1.26.20
# via requests

When I generate a SBOM using cdxgen, all dependencies are flattened.
Is there a way to make cdxgen take into account the dependency tree described by piptools annotations ?

Thanks
Christophe

[prabhu]

Good idea. I would ideally expect the dependency tree to get recovered with the piptree.js plugin that we have. Any errors during the pip install step shown in debug or verbose mode?

export CDXGEN_DEBUG_MODE=debug
cdxgen -t python ...

[prabhu]

@Kristouff I spent some time implementing a parser for the via comments. In the end, I found that our piptree plugin is more accurate and deeper than comments left by pip-tools. I would suggest setting up a buildable environment with the correct version of Python installed and generating a build SBOM (instead of a pre-build one).