Skip to content

Docs: how to use with uv #857

@jkowalleck

Description

@jkowalleck

Is your feature request related to a problem? Please describe.

uv is a project/package manager for python. see https://github.com/astral-sh/uv

uv is not first citizen of this tool, still.

But since uv uses python venv under the hood, we can generate SBOMs from uv's managed virtual environment.
(like PDM, Conda, etc ... )

So far, there are no docs on how to use his tool with uv

Describe the solution you'd like

add docs

  • in README describe how the tool can be applied to uv's managed venv - like the PDM section
  • in the docs: craft an example for uv - like the PDM section

Describe alternatives you've considered

/

Additional context

probably something like cyclonedx-py environment "$(uv env path)" might work -- need to test

  • readme section:
    * `PDM` manifest and lockfile are not explicitly supported.
    However, PDM's Python virtual environments are fully supported. See the docs for an example.
    * `Conda` as a package manager is no longer supported since version 4.
    However, conda's Python environments are fully supported via the methods listed above. See the docs for an example.
  • docs:
    .. code-block:: shell-session
    :caption: Build an SBOM from PDM environment
    $ cyclonedx-py environment "$(pdm info --python)"
  • docs:
    *****
    For PDM
    -------
    Support for `PDM`_ manifest and lockfile is not explicitly implemented, yet.
    See https://github.com/CycloneDX/cyclonedx-python/issues/604
    However, since PDM utilizes Python virtual environments under the hood,
    it is possible to use the functionality for Python (virtual) environments as described above.
    .. _PDM: https://pdm-project.org/
    *****

Contribution

  • I am willing to provide an implementation
  • I will wait until somebody else implements it

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions