-
Notifications
You must be signed in to change notification settings - Fork 4
docs: generate requirement text for ketryx #349
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. |
|
7ca1dee to
80ee800
Compare
| # via jsonschema | ||
| websockets==15.0.1 | ||
| # via uvicorn | ||
| wrapt==2.0.1 | ||
| # via smart-open | ||
| wsidicom==0.29.0 | ||
| # via aignostics (pyproject.toml) | ||
| wsproto==1.3.2 | ||
| # via simple-websocket | ||
| yarl==1.22.0 | ||
| # via aiohttp |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Bug: The requirements.txt is generated without the --universal flag, omitting Windows-specific dependencies like pywin32 from the SBOM for this multi-platform project.
Severity: MEDIUM | Confidence: High
🔍 Detailed Analysis
The requirements.txt file, intended for a Software Bill of Materials (SBOM) scan, is generated on a Linux environment without the --universal flag. According to uv documentation, this results in a platform-specific file that omits dependencies for other supported operating systems. Specifically, the pywin32 dependency, required for Windows as defined in pyproject.toml, is absent from the generated file. This creates an incomplete and misleading SBOM for a project that explicitly supports multiple platforms (Linux, macOS, and Windows), as it fails to account for the full dependency set required for a Windows environment.
💡 Suggested Fix
Regenerate the requirements file using the command uv pip compile --universal pyproject.toml -o requirements.txt. The --universal flag ensures that dependencies for all supported platforms, as defined by environment markers in pyproject.toml, are included in the output file.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: requirements.txt#L1-L546
Potential issue: The `requirements.txt` file, intended for a Software Bill of Materials
(SBOM) scan, is generated on a Linux environment without the `--universal` flag.
According to `uv` documentation, this results in a platform-specific file that omits
dependencies for other supported operating systems. Specifically, the `pywin32`
dependency, required for Windows as defined in `pyproject.toml`, is absent from the
generated file. This creates an incomplete and misleading SBOM for a project that
explicitly supports multiple platforms (Linux, macOS, and Windows), as it fails to
account for the full dependency set required for a Windows environment.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 7588090



Add requirement.txt for Ketryx dependencies scan; it seem like Ketryx does not support uv.lock file and therefore we need to manually generate the requirements txt, which can be scanned by Ketryx SBOM