feat!: rewrite CLI and parsers

[jkowalleck]

• BC: removed support for python < 3.8
• BC: removed deprecated shell script cyclonedx-bom
• BC: removed conda support. However, conda's Python environments are fully supported.
• BC: removed public API. You may use the CLI instead.
• complete redesign of the CLI:
  • uses sub-commands for easy accessibility
  • Easy understandable flags, switches and options -- in accordance with the domain
  • Updated help pages, including examples
• Complete rewrite from scratch
• Dozens of new features and fixes
  • New environment analyzer supports any Python (virtual) environment
  • Poetry analyzer support groups, filtering and such
  • Pipenv analyzer support categories, filtering and such
  • More details in the SBOM results
  • PackageURLs may have more qualifiers
  • component properties according to
    • https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/python.md
    • https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/pipenv.md
    • https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/poetry.md
  • SBOM results may be validated
  • SBOM results may have dependency graph populated
  • SBOM results may have root-component populated
  • Fixed possible issues with input data encoding
  • May omit dev-dependencies or domain-specific groups/categories
  • Support CycloneDX 1.5

---

• restructure CLI
  • supersedes feat: move existing BOM generation to make-bom subcommand #533
  • added new switches/options/parameters and subcommands
• rewrite: requirements
  • integrate all existing features
  • fix: encoding issues
    • fixes CycloneDX gives odd versions and PURLs #398
  • feat: improve support for hashes
  • feat: add support for extras
  • feat: support for alternative package registries
  • feat: pull qualified PURLS
  • feat: add root component metadata -- TO BE DISCUSSED
    • fixes feat: Populate bom.metadata.component #391
    • see feat: minimal pep621 implementation #619
  • add reproducible tests
• rewrite: poetry
  • integrate all existing features
  • feat: completely mimic poetry CLI switches/options for relevant features
  • feat: add support for extras
  • feat: add support for groups/categories
    • fixes When using Poetry lockfile, allow users to select dependency group(s) #580
    • fixes Feat: omit development dependencies from SBOM results #474
  • feat: add root component metadata
    • fixes feat: Populate bom.metadata.component #391
  • feat: add dependency tree
    • fixes Feat: dependency graph in SBOM result #40
  • feat: support for alternative package registries
  • feat: support local packages
  • feat: support URL packages (vie VCS or direct download url)
  • feat: pull qualified PURLS
  • add reproducible tests
• rewrite: pipenv
  • integrate all existing features
  • feat: completely mimic pipenv CLI switches/options for relevant features
  • feat: add support for extras
  • feat: add support for groups/categories
    • fixes When using Poetry lockfile, allow users to select dependency group(s) #580
    • fixes Feat: omit development dependencies from SBOM results #474
  • feat: add root component metadata -- TO BE DISCUSSED -- mebe via flag (not MVP)
    • fixes feat: Populate bom.metadata.component #391
  • feat: add dependency tree -- not possible out of the box. may come as a feature later
    • fixes Feat: dependency graph in SBOM result #40
  • feat: support for alternative package registries
  • feat: support local packages
  • feat: support URL packages (via VCS or direct download url)
  • feat: pull qualified PURLS
  • add reproducible tests
• rewrite: conda -- conda was dropped.
  • conda is a self-claimed package manager for any language (not python specific!)
  • conda may add SBOM support themselves -- feat: SBOM from conda-lock.yml file #594
  • fixes BC: drop support for conda #622
• rewrite: environment
  • integrate all existing features
  • feat: add root component metadata -- TO BE DISCUSSED -- maybe via flag (not MVP)
    • fixes feat: Populate bom.metadata.component #391
  • feat: add dependency tree
    • fixes Feat: dependency graph in SBOM result #40
  • feat: support for virtual/alternative environments
    • fixes Feat: option to use an alternative python environment #475
  • feat: pull qualified PURLS
  • add reproducible tests
• remove/fix all TODOs
• update the docs to showcase the CLI help pages
• feat: officially support py312
• feat: support CDX 1.5 -- fixes support CycloneDX 1.5 #617
• chore: drop poetry lockfile -- fixes chore: fix poetry lock file #491

🔍 coverage report #610 (comment)