Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: support hatch ecosystem #645

Open
jkowalleck opened this issue Jan 6, 2024 · 1 comment
Open

feat: support hatch ecosystem #645

jkowalleck opened this issue Jan 6, 2024 · 1 comment
Labels
enhancement New feature or request hacktoberfest help wanted Extra attention is needed source: hatch

Comments

@jkowalleck
Copy link
Member

jkowalleck commented Jan 6, 2024

"Hatch is a modern, extensible Python project manager."
see https://hatch.pypa.io

PREREQUISITE: evaluate whether hatch is able to artifact analyzable data.
see pyproject.toml, hatch.toml, any lock files? -- https://hatch.pypa.io/1.9/intro/


TODO: write a roadmap and requirements...

@jkowalleck jkowalleck added enhancement New feature or request help wanted Extra attention is needed source: hatch labels Jan 6, 2024
@jkowalleck jkowalleck pinned this issue Jan 6, 2024
@jkowalleck
Copy link
Member Author

Why not bring the wish/need/topic for CycloneDX SBOM to the @pypa/hatch team themselves, so they could implement it as a CLI tool feature and maintain it as needed.
Nowadays, package managers know that SBOM is a thing, they are waiting for a community request, to justify the effort of implementation ;-)
We, the CycloneDX team, had already good experience with this approach: community members did the first request to the ecosystems, and then we successfully supported the package manager developers and ecosystem maintainers on their way of getting CycloneDX SBOM as a first party feature.
(see npm and conan2)

If the @pypa/hatch people don't see a need for this topic or don't want to provide the feature themselves, then sure come back, so we can discuss a possible solution implemented in clonedx-python/cyclonedx-bom.

PS: the CycloneDX community is proud of their own solutions and implementations to get ecosystems enabled to do proper supply chain assessment, and we will continue doing so. We also love to see ecosystems adopting the topic. 🚀

@jkowalleck jkowalleck unpinned this issue Feb 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request hacktoberfest help wanted Extra attention is needed source: hatch
Projects
None yet
Development

No branches or pull requests

1 participant