Exclude file for requirements.txt ?

[andy778]

Have there been any toughs to support and exclude components, reason for this is that one would like to exclude files used in the build?
e.g. adding a -x parameter

python3 -m cyclonedx_py -r -i .\constraints.txt -x .\requirements-dev.txt

#constraints.txt  ( This is created by running "pip freeze --exclude-editable" after one have run "pip install -r requirements.txt "
anyio==3.6.1
argcomplete==2.0.0
attrs==22.1.0
autoflake==1.7.6

#requirements-dev.txt
autoflake
black

[andy778]

One thing one can do also is and use grep in the build toolchain
grep -vfrequirements-dev.txt constraints.txt > requirements.txt

[jkowalleck]

latter one is the preferred behaviour.

you provide the requirements.txt, so it is your responsibility that the content is the one you intend to use.

[jannylund]

The challenge here is that if we only generate from requirements.txt we miss all the transient dependencies.

In our setup, we usually don't pin development dependencies but just force them to autoupdate.
A way around this is to run a new virtual env, install all packages and then generate constraints from that using something like:

# install reqs and latest dev reqs
pip install -r requirements.txt && pip install -r requirements-dev.txt --upgrade
# generate a constraints file of what is available in the venv.
pip freeze --exclude-editable > constraints.txt

At this stage, we now have a file containing a full list of dependencies, but it contains a bit more than we actually want to have and we need to filter it out. Some of these come from requirements-dev.txt and some of it comes from the venv itself...

[jkowalleck]

Possible solution for you:

pip install -r requirements.txt
pip freeze --exclude-editable > runtime-requirements.txt
pip install -r requirements-dev.txt --upgrade
cyclonedx-py -r -i runtime-requirements.txt

---

Overall: you are experiencing all the known shortcomings your requirements.txt has.
Maybe you should switch to a more sophisticated solution, like pipenv, poetry, pip-compile from pip-tools, etc. ?

One or a combination of the following issues should solve your problems:

• see Feat: omit development dependencies from SBOM results #474
• see Feat: option to use an alternative python environment #475

[jkowalleck]

see also: #487