Make possible to parse metadata via parsers

[moaddib666]

For now, there are no possibility to set metadata.component... via https://github.com/CycloneDX/cyclonedx-python.
After this patch would be possible to implement get_metadaa() in parser for example poetry to parse package from package.toml file. Also, I'd like to introduce some default parser that could parse env parameters.

[sonatype-lift]

Incompatible attribute type: Attribute component declared in class BomMetaData has type Component but is used as type Optional[Component].

---

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command	Usage
@sonatype-lift ignore	Leave out the above finding from this PR
@sonatype-lift ignoreall	Leave out all the existing findings from this PR
@sonatype-lift exclude <file|issue|path|tool>	Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

[madpah]

Hi @moaddib666 - thanks for getting involved with CycloneDX.

If I understand the purpose of the PR correctly (please correct me if I have miss-understood), you are raising this so that component can then be set from outside this core library? If that is the case, this is already possible (bom.metadata.component = my_component).

If I've not understood the purpose of this PR, please let us know.

Thanks again!

[moaddib666]

Hi, it's possible for custom code, not for CycloneDX/cyclonedx-python script itself, we have a pipeline for different languages and node/php implementation fill metadata.component from scratch. But python don't. I believe it's because env/pip does not have any, but poetry does. Also it looks to me that would be great Idea to parse env variables with metadata or pass it directly to the cli.

@madpah have a look:

pip install cyclonedx-bom
cyclonedx-bom -p -pb --format json
cat bom.json | jq .metadata

{
  "timestamp": "2022-09-05T08:45:11.893659+00:00",
  "tools": [
    {
      "vendor": "CycloneDX",
      "name": "cyclonedx-bom",
      "version": "3.5.0"
    },
    {
      "vendor": "CycloneDX",
      "name": "cyclonedx-python-lib",
      "version": "2.7.1",
      "externalReferences": [
        {
          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions",
          "type": "build-system"
        },
        {
          "url": "https://pypi.org/project/cyclonedx-python-lib/",
          "type": "distribution"
        },
        {
          "url": "https://cyclonedx.github.io/cyclonedx-python-lib/",
          "type": "documentation"
        },
        {
          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues",
          "type": "issue-tracker"
        },
        {
          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE",
          "type": "license"
        },
        {
          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md",
          "type": "release-notes"
        },
        {
          "url": "https://github.com/CycloneDX/cyclonedx-python-lib",
          "type": "vcs"
        },
        {
          "url": "https://cyclonedx.org",
          "type": "website"
        }
      ]
    }
  ]
}

[jkowalleck]

❓
this looks like it was refactored to an own file/module. what is the purpose?
why was it needed to be moved? whats the benefit of yet another module? are there any other changes?

[moaddib666]

Hi this is due to dependency recursion while type check:
cyclonedx/model/bom.py

from ..parser import BaseParser

cyclonedx/parser/init.py

from ..model.bom_meta import BomMetaData

[jkowalleck]

❌
since this seams to be the only relevant change here, please add proper unit tests

[moaddib666]

Sure will add, but as for me, it looks like it's should be covered by existing tests.

[jkowalleck]

re: #300 (comment)

Also it looks to me that would be great Idea to parse env variables with metadata or pass it directly to the cli.

I still dont get the point.

if you want to modify the resulting SBOM, then you might want to check: https://github.com/CycloneDX/cyclonedx-cli

[moaddib666]

re: #300 (comment)

Also it looks to me that would be great Idea to parse env variables with metadata or pass it directly to the cli.

I still dont get the point.

if you want to modify the resulting SBOM, then you might want to check: https://github.com/CycloneDX/cyclonedx-cli

Make sense for env vars to update it via cyclonedx-cli.
But in case of poetry, we still can get metadata from project.toml

[jkowalleck]

Parsers are planned to be removed via #489