The python root does not reference it's dependencies which cause a failure in drawing a tree.

[MohammedAziz02]

Hi, I'm using cdxgen to generate the SBOM for python project, but it's seems that the root project does not reference it's dependencies, here is an example, I create a sample python project with the requirements.txt file that contains only one library, then I run the command cdxgen -t python --spec-version 1.4 project-name "accelerated-project", as we can see here, the pkg:pypi/accelerated-project@latest does not reference anything in the dependencies, which cause an issue in displaying a tree. @prabhu could you please help, is this is a bug ?

[prabhu]

Is it just a project with requirements text files without pyproject.toml? There isn't much information about the parent component, so there might be some missing logic.

[MohammedAziz02]

I'm just wondering if we can just add the references to the default parent components, as I understand there is a default parent component which take the name of the directory of the project, so may be if we add the references of the dependencies in the requirements.txt to that default parent it will be great ?

[prabhu]

The challenge is then what if there are multiple requirements files like dev and test?

[MohammedAziz02]

The good thing is that cdxgen have the feature of excluding files , with the --exclude tag, one more good thing is that all the requirements files are build within the same environment, so as a user, I have the possibility to exclude the dev and test requirements, if not I will be aware that my SBOM contains the dev and test libraries, I think it's still okey if the default parent component references the libraries instead of reference to nothing 🤔 ?