@trustify-da/trustify-da-javascript-client 0.3.0-ea.e12bc82 → 0.3.0-ea.e348975

package/dist/src/providers/python_controller.d.ts

@@ -1,4 +1,4 @@
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     /**
      * Constructor to create new python controller instance to interact with pip package manager
@@ -15,17 +15,24 @@ export default class Python_controller {
     realEnvironment: boolean;
     pathToRequirements: string;
     options: {};
+    parser: Promise<import("web-tree-sitter").Parser>;
+    requirementsQuery: Promise<import("web-tree-sitter").Query>;
+    pinnedVersionQuery: Promise<import("web-tree-sitter").Query>;
     prepareEnvironment(): void;
     /**
      *
      * @param {boolean} includeTransitive - whether to return include in returned object transitive dependencies or not
-     * @return {[DependencyEntry]}
+     * @return {Promise<[DependencyEntry]>}
      */
-    getDependencies(includeTransitive: boolean): [DependencyEntry];
+    getDependencies(includeTransitive: boolean): Promise<[DependencyEntry]>;
     #private;
 }
 export type DependencyEntry = {
     name: string;
     version: string;
     dependencies: DependencyEntry[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };

package/dist/src/providers/python_controller.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from 'node:path';
 import os, { EOL } from "os";
 import { environmentVariableIsPopulated, getCustom, invokeCommand } from "../tools.js";
+import { getParser, getRequirementQuery, getPinnedVersionQuery } from './requirements_parser.js';
 function getPipFreezeOutput() {
     try {
         return environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") ? new Buffer.from(process.env["TRUSTIFY_DA_PIP_FREEZE"], 'base64').toString('ascii') : invokeCommand(this.pathToPipBin, ['freeze', '--all']).toString();
@@ -18,7 +19,54 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/**
+ * Get pip inspect output from env var override or by invoking pip inspect.
+ * Returns null if pip inspect is unavailable (pip < 22.2) or if freeze/show
+ * env vars are set without an inspect override (to avoid inconsistent data).
+ * @return {string|null} pip inspect JSON output, or null on failure
+ */
+function getPipInspectOutput() {
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_INSPECT")) {
+        return new Buffer.from(process.env["TRUSTIFY_DA_PIP_INSPECT"], 'base64').toString('ascii');
+    }
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") || environmentVariableIsPopulated("TRUSTIFY_DA_PIP_SHOW")) {
+        return null;
+    }
+    try {
+        return invokeCommand(this.pathToPipBin, ['inspect']).toString();
+    }
+    catch (error) {
+        console.warn('pip inspect is not available (requires pip 22.2+), SBOM will be generated without hashes');
+        return null;
+    }
+}
+/**
+ * Parse pip inspect JSON output and build a hash lookup map.
+ * @param {string|null} inspectOutput - raw pip inspect JSON string
+ * @return {Map<string, Array<{alg: string, content: string}>>} map of lowercase package name to hashes
+ */
+function parsePipInspectHashes(inspectOutput) {
+    if (!inspectOutput) {
+        return new Map();
+    }
+    try {
+        let inspectData = JSON.parse(inspectOutput);
+        let hashMap = new Map();
+        for (let pkg of (inspectData.installed || [])) {
+            let name = pkg.metadata?.name;
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            if (name && sha256) {
+                hashMap.set(name.toLowerCase(), [{ alg: "SHA-256", content: sha256 }]);
+            }
+        }
+        return hashMap;
+    }
+    catch (error) {
+        console.warn('Failed to parse pip inspect output, SBOM will be generated without hashes');
+        return new Map();
+    }
+}
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
     pathToPipBin;
@@ -26,6 +74,9 @@ export default class Python_controller {
     realEnvironment;
     pathToRequirements;
     options;
+    parser;
+    requirementsQuery;
+    pinnedVersionQuery;
     /**
      * Constructor to create new python controller instance to interact with pip package manager
      * @param {boolean} realEnvironment - whether to use real environment supplied by client or to create virtual environment
@@ -41,6 +92,9 @@ export default class Python_controller {
         this.prepareEnvironment();
         this.pathToRequirements = pathToRequirements;
         this.options = options;
+        this.parser = getParser();
+        this.requirementsQuery = getRequirementQuery();
+        this.pinnedVersionQuery = getPinnedVersionQuery();
     }
     prepareEnvironment() {
         if (!this.realEnvironment) {
@@ -86,6 +140,24 @@ export default class Python_controller {
             }
         }
     }
+    /**
+     * Parse the requirements.txt file using tree-sitter and return structured requirement data.
+     * @return {Promise<{name: string, version: string|null, hasMarker: boolean}[]>}
+     */
+    async #parseRequirements() {
+        const content = fs.readFileSync(this.pathToRequirements).toString();
+        const tree = (await this.parser).parse(content);
+        return Promise.all((await this.requirementsQuery).matches(tree.rootNode).map(async (match) => {
+            const reqNode = match.captures.find(c => c.name === 'req').node;
+            const name = match.captures.find(c => c.name === 'name').node.text;
+            const versionMatches = (await this.pinnedVersionQuery).matches(reqNode);
+            const version = versionMatches.length > 0
+                ? versionMatches[0].captures.find(c => c.name === 'version').node.text
+                : null;
+            const hasMarker = reqNode.children.some(c => c.type === 'marker_spec');
+            return { name, version, hasMarker };
+        }));
+    }
     #decideIfWindowsOrLinuxPath(fileName) {
         if (os.platform() === "win32") {
             return fileName + ".exe";
@@ -97,17 +169,20 @@ export default class Python_controller {
     /**
      *
      * @param {boolean} includeTransitive - whether to return include in returned object transitive dependencies or not
-     * @return {[DependencyEntry]}
+     * @return {Promise<[DependencyEntry]>}
      */
-    getDependencies(includeTransitive) {
+    async getDependencies(includeTransitive) {
         let startingTime;
         let endingTime;
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             startingTime = new Date();
             console.log("Starting time to get requirements.txt dependency tree = " + startingTime);
         }
+        let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
+        if (installBestEfforts === "true" && this.realEnvironment) {
+            throw new Error("Conflicting settings, TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS=true requires TRUSTIFY_DA_PYTHON_VIRTUAL_ENV=true");
+        }
         if (!this.realEnvironment) {
-            let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
             if (installBestEfforts === "false") {
                 try {
                     invokeCommand(this.pathToPipBin, ['install', '-r', this.pathToRequirements]);
@@ -124,10 +199,10 @@ export default class Python_controller {
                 if (matchManifestVersions === "true") {
                     throw new Error("Conflicting settings, TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS=true can only work with MATCH_MANIFEST_VERSIONS=false");
                 }
-                this.#installingRequirementsOneByOne();
+                await this.#installingRequirementsOneByOne();
             }
         }
-        let dependencies = this.#getDependenciesImpl(includeTransitive);
+        let dependencies = await this.#getDependenciesImpl(includeTransitive);
         this.#cleanEnvironment();
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             endingTime = new Date();
@@ -137,16 +212,14 @@ export default class Python_controller {
         }
         return dependencies;
     }
-    #installingRequirementsOneByOne() {
-        let requirementsContent = fs.readFileSync(this.pathToRequirements);
-        let requirementsRows = requirementsContent.toString().split(EOL);
-        requirementsRows.filter((line) => !line.trim().startsWith("#")).filter((line) => line.trim() !== "").forEach((dependency) => {
-            let dependencyName = getDependencyName(dependency);
+    async #installingRequirementsOneByOne() {
+        const requirements = await this.#parseRequirements();
+        requirements.forEach(({ name }) => {
             try {
-                invokeCommand(this.pathToPipBin, ['install', dependencyName]);
+                invokeCommand(this.pathToPipBin, ['install', name]);
             }
             catch (error) {
-                throw new Error(`Failed in best-effort installing ${dependencyName} in virtual python environment`, { cause: error });
+                throw new Error(`Failed in best-effort installing ${name} in virtual python environment`, { cause: error });
             }
         });
     }
@@ -163,34 +236,26 @@ export default class Python_controller {
             }
         }
     }
-    #getDependenciesImpl(includeTransitive) {
-        let dependencies = new Array();
+    async #getDependenciesImpl(includeTransitive) {
+        let dependencies = [];
         let usePipDepTree = getCustom("TRUSTIFY_DA_PIP_USE_DEP_TREE", "false", this.options);
-        let freezeOutput;
-        let lines;
-        let depNames;
-        let pipShowOutput;
         let allPipShowDeps;
         let pipDepTreeJsonArrayOutput;
         if (usePipDepTree !== "true") {
-            freezeOutput = getPipFreezeOutput.call(this);
-            lines = freezeOutput.split(EOL);
-            depNames = lines.map(line => getDependencyName(line));
+            const freezeOutput = getPipFreezeOutput.call(this);
+            const lines = freezeOutput.split(EOL);
+            const depNames = lines.map(line => getDependencyName(line));
+            const pipShowOutput = getPipShowOutput.call(this, depNames);
+            allPipShowDeps = pipShowOutput.split(EOL + "---" + EOL);
         }
         else {
             pipDepTreeJsonArrayOutput = getDependencyTreeJsonFromPipDepTree(this.pathToPipBin, this.pathToPythonBin);
         }
-        if (usePipDepTree !== "true") {
-            pipShowOutput = getPipShowOutput.call(this, depNames);
-            allPipShowDeps = pipShowOutput.split(EOL + "---" + EOL);
-        }
-        //debug
-        // pipShowOutput = "alternative pip show output goes here for debugging"
         let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "true", this.options);
-        let linesOfRequirements = fs.readFileSync(this.pathToRequirements).toString().split(EOL).filter((line) => !line.trim().startsWith("#")).map(line => line.trim());
+        let parsedRequirements = await this.#parseRequirements();
         let CachedEnvironmentDeps = {};
         if (usePipDepTree !== "true") {
-            allPipShowDeps.forEach((record) => {
+            allPipShowDeps.forEach(record => {
                 let dependencyName = getDependencyNameShow(record).toLowerCase();
                 CachedEnvironmentDeps[dependencyName] = record;
                 CachedEnvironmentDeps[dependencyName.replace("-", "_")] = record;
@@ -210,42 +275,31 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
-        linesOfRequirements.forEach((dep) => {
-            // if matchManifestVersions setting is turned on , then
-            if (matchManifestVersions === "true") {
-                let dependencyName;
-                let manifestVersion;
+        const inspectOutput = getPipInspectOutput.call(this);
+        const hashMap = parsePipInspectHashes(inspectOutput);
+        parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
+            if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
+                return;
+            }
+            if (matchManifestVersions === "true" && manifestVersion != null) {
                 let installedVersion;
-                let doubleEqualSignPosition;
-                if (dep.includes("==")) {
-                    doubleEqualSignPosition = dep.indexOf("==");
-                    manifestVersion = dep.substring(doubleEqualSignPosition + 2).trim();
-                    if (manifestVersion.includes("#")) {
-                        let hashCharIndex = manifestVersion.indexOf("#");
-                        manifestVersion = manifestVersion.substring(0, hashCharIndex);
+                if (CachedEnvironmentDeps[depName.toLowerCase()] !== undefined) {
+                    if (usePipDepTree !== "true") {
+                        installedVersion = getDependencyVersion(CachedEnvironmentDeps[depName.toLowerCase()]);
                     }
-                    dependencyName = getDependencyName(dep);
-                    // only compare between declared version in manifest to installed version , if the package is installed.
-                    if (CachedEnvironmentDeps[dependencyName.toLowerCase()] !== undefined) {
-                        if (usePipDepTree !== "true") {
-                            installedVersion = getDependencyVersion(CachedEnvironmentDeps[dependencyName.toLowerCase()]);
-                        }
-                        else {
-                            installedVersion = CachedEnvironmentDeps[dependencyName.toLowerCase()].version;
-                        }
+                    else {
+                        installedVersion = CachedEnvironmentDeps[depName.toLowerCase()].version;
                     }
-                    if (installedVersion) {
-                        if (manifestVersion.trim() !== installedVersion.trim()) {
-                            throw new Error(`Can't continue with analysis - versions mismatch for dependency name ${dependencyName} (manifest version=${manifestVersion}, installed version=${installedVersion}).If you want to allow version mismatch for analysis between installed and requested packages, set environment variable/setting MATCH_MANIFEST_VERSIONS=false`);
-                        }
+                }
+                if (installedVersion) {
+                    if (manifestVersion.trim() !== installedVersion.trim()) {
+                        throw new Error(`Can't continue with analysis - versions mismatch for dependency name ${depName} (manifest version=${manifestVersion}, installed version=${installedVersion}).If you want to allow version mismatch for analysis between installed and requested packages, set environment variable/setting MATCH_MANIFEST_VERSIONS=false`);
                     }
                 }
             }
-            let path = new Array();
-            let depName = getDependencyName(dep);
-            //array to track a path for each branch in the dependency tree
+            let path = [];
             path.push(depName.toLowerCase());
-            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree);
+            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap);
         });
         dependencies.sort((dep1, dep2) => {
             const DEP1 = dep1.name.toLowerCase();
@@ -325,8 +379,9 @@ function getDepsList(record) {
  * @param includeTransitive
  * @param usePipDepTree
  * @param {[string]}path array representing the path of the current branch in dependency tree, starting with a root dependency - that is - a given dependency in requirements.txt
+ * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - map of lowercase package name to hashes
  */
-function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree) {
+function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap) {
     if (dependencyName?.trim() === "") {
         return;
     }
@@ -347,18 +402,22 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
         version = record.version;
         directDeps = record.dependencies;
     }
-    let targetDeps = new Array();
+    let targetDeps = [];
+    let hashes = hashMap?.get(depName.toLowerCase());
     let entry = { "name": depName, "version": version, "dependencies": [] };
+    if (hashes) {
+        entry.hashes = hashes;
+    }
     dependencies.push(entry);
     directDeps.forEach((dep) => {
-        let depArray = new Array();
+        let depArray = [];
         // to avoid infinite loop, check if the dependency not already on current path, before going recursively resolving its dependencies.
         if (!path.includes(dep.toLowerCase())) {
             // send to recurrsion the path + the current dep
             depArray.push(dep.toLowerCase());
             if (includeTransitive) {
                 // send to recurrsion the array of all deps in path + the current dependency name which is not on the path.
-                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree);
+                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree, hashMap);
             }
         }
         // sort ra

package/dist/src/providers/python_pip.d.ts

@@ -3,12 +3,18 @@ declare namespace _default {
     export { validateLockFile };
     export { provideComponent };
     export { provideStack };
+    export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
 export type DependencyEntry = {
     name: string;
     version: string;
     dependencies: DependencyEntry[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };
 /**
  * @param {string} manifestName - the subject manifest name-type
@@ -23,13 +29,19 @@ declare function validateLockFile(): boolean;
  * Provide content and content type for python-pip component analysis.
  * @param {string} manifest - path to requirements.txt for component report
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @returns {Promise<Provided>}
  */
-declare function provideComponent(manifest: string, opts?: {} | undefined): Provided;
+declare function provideComponent(manifest: string, opts?: {}): Promise<Provided>;
 /**
  * Provide content and content type for python-pip stack analysis.
  * @param {string} manifest - the manifest path or name
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @returns {Promise<Provided>}
  */
-declare function provideStack(manifest: string, opts?: {} | undefined): Provided;
+declare function provideStack(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Python requirements.txt has no standard license field
+ * @param {string} manifestPath - path to requirements.txt
+ * @returns {string|null}
+ */
+declare function readLicenseFromManifest(manifestPath: string): string | null;

package/dist/src/providers/python_pip.js

@@ -1,16 +1,18 @@
 import fs from 'node:fs';
-import { EOL } from 'os';
 import { PackageURL } from 'packageurl-js';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack };
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'pip'; } };
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 /**
  * @type {string} ecosystem for python-pip is 'pip'
  * @private
  */
 const ecosystem = 'pip';
+const NO_SCOPE = undefined;
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `requirements.txt` is the manifest name-type
@@ -18,6 +20,13 @@ const ecosystem = 'pip';
 function isSupported(manifestName) {
     return 'requirements.txt' === manifestName;
 }
+/**
+ * Python requirements.txt has no standard license field
+ * @param {string} manifestPath - path to requirements.txt
+ * @returns {string|null}
+ */
+// eslint-disable-next-line no-unused-vars
+function readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
 /**
  * @param {string} manifestDir - the directory where the manifest lies
  */
@@ -26,12 +35,12 @@ function validateLockFile() { return true; }
  * Provide content and content type for python-pip stack analysis.
  * @param {string} manifest - the manifest path or name
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @returns {Promise<Provided>}
  */
-function provideStack(manifest, opts = {}) {
+async function provideStack(manifest, opts = {}) {
     return {
         ecosystem,
-        content: createSbomStackAnalysis(manifest, opts),
+        content: await createSbomStackAnalysis(manifest, opts),
         contentType: 'application/vnd.cyclonedx+json'
     };
 }
@@ -39,16 +48,15 @@ function provideStack(manifest, opts = {}) {
  * Provide content and content type for python-pip component analysis.
  * @param {string} manifest - path to requirements.txt for component report
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @returns {Promise<Provided>}
  */
-function provideComponent(manifest, opts = {}) {
+async function provideComponent(manifest, opts = {}) {
     return {
         ecosystem,
-        content: getSbomForComponentAnalysis(manifest, opts),
+        content: await getSbomForComponentAnalysis(manifest, opts),
         contentType: 'application/vnd.cyclonedx+json'
     };
 }
-/** @typedef {{name: string, , version: string, dependencies: DependencyEntry[]}} DependencyEntry */
 /**
  *
  * @param {PackageURL}source
@@ -58,7 +66,7 @@ function provideComponent(manifest, opts = {}) {
  */
 function addAllDependencies(source, dep, sbom) {
     let targetPurl = toPurl(dep["name"], dep["version"]);
-    sbom.addDependency(source, targetPurl);
+    sbom.addDependency(source, targetPurl, NO_SCOPE, dep["hashes"]);
     let directDeps = dep["dependencies"];
     if (directDeps !== undefined && directDeps.length > 0) {
         directDeps.forEach((dependency) => { addAllDependencies(toPurl(dep["name"], dep["version"]), dependency, sbom); });
@@ -66,49 +74,34 @@ function addAllDependencies(source, dep, sbom) {
 }
 /**
  *
- * @param nameVersion
- * @return {string}
- */
-function splitToNameVersion(nameVersion) {
-    let result = [];
-    if (nameVersion.includes("==")) {
-        return nameVersion.split("==");
-    }
-    const regex = /[^\w\s-_]/g;
-    let endIndex = nameVersion.search(regex);
-    if (endIndex === -1) {
-        return [nameVersion.trim()];
-    }
-    result.push(nameVersion.substring(0, endIndex).trim());
-    return result;
-}
-/**
- *
- * @param {string} requirementTxtContent
- * @return {PackageURL []}
+ * @param {string} manifest - path to requirements.txt
+ * @return {Promise<PackageURL[]>}
  */
-function getIgnoredDependencies(requirementTxtContent) {
-    let requirementsLines = requirementTxtContent.split(EOL);
-    return requirementsLines
-        .filter(line => line.includes("#exhortignore") || line.includes("# exhortignore"))
-        .map((line) => line.substring(0, line.indexOf("#")).trim())
-        .map((name) => {
-        let nameVersion = splitToNameVersion(name);
-        if (nameVersion.length === 2) {
-            return toPurl(nameVersion[0], nameVersion[1]);
-        }
-        return toPurl(nameVersion[0], undefined);
+async function getIgnoredDependencies(manifest) {
+    const [parser, ignoreQuery, pinnedVersionQuery] = await Promise.all([
+        getParser(), getIgnoreQuery(), getPinnedVersionQuery()
+    ]);
+    const content = fs.readFileSync(manifest).toString();
+    const tree = parser.parse(content);
+    return ignoreQuery.matches(tree.rootNode).map(match => {
+        const reqNode = match.captures.find(c => c.name === 'req').node;
+        const name = match.captures.find(c => c.name === 'name').node.text;
+        const versionMatches = pinnedVersionQuery.matches(reqNode);
+        const version = versionMatches.length > 0
+            ? versionMatches[0].captures.find(c => c.name === 'version').node.text
+            : undefined;
+        return toPurl(name, version);
     });
 }
 /**
  *
- * @param {string} requirementTxtContent content of requirments.txt in string
+ * @param {string} manifest - path to requirements.txt
  * @param {Sbom} sbom object to filter out from it exhortignore dependencies.
  * @param {{Object}} opts - various options and settings for the application
  * @private
  */
-function handleIgnoredDependencies(requirementTxtContent, sbom, opts = {}) {
-    let ignoredDeps = getIgnoredDependencies(requirementTxtContent);
+async function handleIgnoredDependencies(manifest, sbom, opts = {}) {
+    let ignoredDeps = await getIgnoredDependencies(manifest);
     let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "true", opts);
     if (matchManifestVersions === "true") {
         const ignoredDepsVersion = ignoredDeps.filter(dep => dep.version !== undefined);
@@ -172,22 +165,22 @@ const DEFAULT_PIP_ROOT_COMPONENT_VERSION = "0.0.0";
  * Create sbom json string out of a manifest path for stack analysis.
  * @param {string} manifest - path for requirements.txt
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {string} the sbom json string content
+ * @returns {Promise<string>} the sbom json string content
  * @private
  */
-function createSbomStackAnalysis(manifest, opts = {}) {
+async function createSbomStackAnalysis(manifest, opts = {}) {
     let binaries = {};
     let createVirtualPythonEnv = handlePythonEnvironment(binaries, opts);
     let pythonController = new Python_controller(createVirtualPythonEnv === "false", binaries.pip, binaries.python, manifest, opts);
-    let dependencies = pythonController.getDependencies(true);
+    let dependencies = await pythonController.getDependencies(true);
     let sbom = new Sbom();
     const rootPurl = toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION);
-    sbom.addRoot(rootPurl);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(rootPurl, license);
     dependencies.forEach(dep => {
         addAllDependencies(rootPurl, dep, sbom);
     });
-    let requirementTxtContent = fs.readFileSync(manifest).toString();
-    handleIgnoredDependencies(requirementTxtContent, sbom, opts);
+    await handleIgnoredDependencies(manifest, sbom, opts);
     // In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by the DA backend
     // sbom.removeRootComponent()
     return sbom.getAsJsonString(opts);
@@ -196,22 +189,22 @@ function createSbomStackAnalysis(manifest, opts = {}) {
  * Create a sbom json string out of a manifest content for component analysis
  * @param {string} manifest - path to requirements.txt
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {string} the sbom json string content
+ * @returns {Promise<string>} the sbom json string content
  * @private
  */
-function getSbomForComponentAnalysis(manifest, opts = {}) {
+async function getSbomForComponentAnalysis(manifest, opts = {}) {
     let binaries = {};
     let createVirtualPythonEnv = handlePythonEnvironment(binaries, opts);
     let pythonController = new Python_controller(createVirtualPythonEnv === "false", binaries.pip, binaries.python, manifest, opts);
-    let dependencies = pythonController.getDependencies(false);
+    let dependencies = await pythonController.getDependencies(false);
     let sbom = new Sbom();
     const rootPurl = toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION);
-    sbom.addRoot(rootPurl);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(rootPurl, license);
     dependencies.forEach(dep => {
-        sbom.addDependency(rootPurl, toPurl(dep.name, dep.version));
+        sbom.addDependency(rootPurl, toPurl(dep.name, dep.version), NO_SCOPE, dep.hashes);
     });
-    let requirementTxtContent = fs.readFileSync(manifest).toString();
-    handleIgnoredDependencies(requirementTxtContent, sbom, opts);
+    await handleIgnoredDependencies(manifest, sbom, opts);
     // In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by the DA backend
     // sbom.removeRootComponent()
     return sbom.getAsJsonString(opts);

package/dist/src/providers/python_pip_pyproject.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Python provider for pyproject.toml files using PEP 621 format without a lock file.
+ * Uses `pip install --dry-run --ignore-installed --report` to resolve the full dependency tree.
+ * Acts as the fallback provider when no lock file (uv.lock/poetry.lock) is found.
+ */
+export default class Python_pip_pyproject extends Base_pyproject {
+    /**
+     * Always returns true — pip provider is the fallback when no lock file is found.
+     * @param {string} manifestDir
+     * @param {{}} [opts={}]
+     * @returns {boolean}
+     */
+    validateLockFile(manifestDir: string, opts?: {}): boolean;
+    /**
+     * Get pip report output from env var override or by running pip.
+     * @param {string} manifestDir - directory containing pyproject.toml
+     * @param {{}} [opts={}]
+     * @returns {string} pip report JSON string
+     */
+    _getPipReportOutput(manifestDir: string, opts?: {}): string;
+    /**
+     * Parse pip report JSON and build dependency graph.
+     * @param {string} reportJson - pip report JSON string
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     */
+    _parsePipReport(reportJson: string): {
+        directDeps: string[];
+        graph: Map<string, {
+            name: string;
+            version: string;
+            children: string[];
+        }>;
+    };
+    /**
+     * Check if a requires_dist entry is an extras-only dependency.
+     * @param {string} req - e.g. "PySocks!=1.5.7,>=1.5.6; extra == \"socks\""
+     * @returns {boolean}
+     */
+    _hasExtraMarker(req: string): boolean;
+    /**
+     * Extract package name from a requires_dist entry.
+     * @param {string} req - e.g. "charset_normalizer<4,>=2"
+     * @returns {string|null}
+     */
+    _extractDepName(req: string): string | null;
+    /**
+     * Resolve dependencies using pip install --dry-run --report.
+     * @param {string} manifestDir
+     * @param {string} _workspaceDir - unused (pip resolves from manifest directory)
+     * @param {object} parsed - parsed pyproject.toml
+     * @param {{}} [opts={}]
+     * @returns {Promise<{directDeps: string[], graph: Map}>}
+     */
+    _getDependencyData(manifestDir: string, _workspaceDir: string, parsed: object, opts?: {}): Promise<{
+        directDeps: string[];
+        graph: Map<any, any>;
+    }>;
+    _findEggInfoDirs(dir: any): string[];
+    _cleanupEggInfo(dir: any, existing: any): void;
+}
+import Base_pyproject from './base_pyproject.js';