Version not detected on Python project scan

[HendrikSchrieber]

I am seeing the following error when running the cdxgen-deno docker image:
The version or the version specifiers used for a dependency is invalid. Resolve the below error to improve SBOM accuracy. ERROR: Could not find a version that satisfies the requirement libpysal==4.9.2 (from versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 4.0.0rc1, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.5, 4.4.0, 4.5.0, 4.5.1, 4.6.0, 4.6.1, 4.6.2, 4.7.0, 4.8.0rc1, 4.8.0rc2, 4.8.0, 4.8.1rc1, 4.8.1) ERROR: No matching distribution found for libpysal==4.9.2

On PyPI version 4.9.2 is available: https://pypi.org/project/libpysal/#history. I have no issue with installing the version on Ubuntu. Why do I get this error and how do I fix it?

[prabhu]

I have seen No matching distribution error when the right version of Python or the architecture is not available for the given package. This package appears to be supporting 3.12. Do you get the same error with the cdxgen image as well out of curiosity?

We also have a number of images in this unofficial repo which you can try.

[prabhu]

This particular line is missing in the deno image. Since PYTHON_CMD is set to python3, it is failing.

[HendrikSchrieber]

I tried the regular image without "deno" but still the same issue. Also it looks like SBOM generation works for all the other dependencies I have in my requirements.txt, it just fails for libpysal, so I suspect it maybe has to do something with the version lookup?

[prabhu]

Can you share a sample requirements file?

[HendrikSchrieber]

requirements.txt

Here is the requirements file (note: I have upgraded libpysal to version 4.11.0 in the meantime). And this is the command I use: docker run --rm -e CDXGEN_DEBUG_MODE=debug -v $PWD:/app ghcr.io/cyclonedx/cdxgen:v10.7.1 -o /app/sbom.json /app

When removing "libpysal" from the requirements.txt SBOM generation works without error.

Just in case this is relevant: I am running Docker in rootless mode on Ubuntu 22.04.

[prabhu]

Running the container with -e "PYTHON_CMD=/usr/bin/python3.12" makes it to succeed. What I am suspecting is that the cdxgen container image contains multiple versions of python (Unsurprising since almalinux!), so somehow python 3.9 is being used.

With the upcoming 10.8.0 release, --include-formulation lists all versions of build tools used, which is useful for troubleshooting. We can also update the container image with the right value for PYTHON_CMD.