Skip to content

feat: support explicit main component metadata for projects without pyproject.toml #1105

Open
Open
feat: support explicit main component metadata for projects without pyproject.toml#1105
Labels
enhancementNew feature or request

Description

@abhijit24learning
abhijit24learning
opened on Sep 23, 2026

Description

Many Python projects, especially older or minimal ones, do not have a pyproject.toml file. In those cases, the current root-component metadata flow depends on --pyproject, which makes it difficult to generate an SBOM with the correct main component name and version unless a project metadata file is present.

This creates a gap for projects that are still valid Python applications or libraries but are not structured around PEP 621 metadata.

Solution

Add CLI support for explicitly setting the main component metadata when pyproject.toml is not available.

Specifically:

  • --mc-name: Set the main component name directly from the CLI
  • --mc-version: Set the main component version directly from the CLI
  • Keep --mc-type support for specifying the main component type
  • Use directory-name fallback as a final fallback when neither explicit metadata nor pyproject.toml is available

This should be supported for the requirements and environment subcommands, and should complement the existing --pyproject behavior rather than replacing it.

mc here stands for "main component".

Describe alternatives you've considered

  • Inferring the root component name from the current directory name only
  • Adding a custom config file for component metadata

Additional context

This is especially useful for legacy Python projects, simple scripts, or deployments where the project metadata is not stored in pyproject.toml, but the SBOM still needs a valid top-level component.

Contribution

  • I am willing to provide an implementation
  • I will wait until somebody else implements it

Activity

  1. abhijit24learning
    added
    enhancementNew feature or request
    on Sep 23, 2026
  2. abhijit24learning
    changed the title [-]Metadata Component Auto-Detection[/-] [+]feat: metadata component auto-detection[/+] on Sep 23, 2026
  3. abhijit24learning
    changed the title [-]feat: metadata component auto-detection[/-] [+]feat: support explicit main component metadata for projects without pyproject.toml[/+] on Sep 23, 2026

  4. jkowalleck commented on Sep 28, 2026

    @jkowalleck
    jkowalleck
    on Sep 28, 2026
    Member

    what is the exact use case here?
    Could you elaborate on a specific real-world example?

  5. abhijit24learning commented on Sep 29, 2026

    @abhijit24learning
    abhijit24learning
    on Sep 29, 2026
    Author

    When scanning a project via requirements.txt, the generated SBOM currently has no metadata.component at all - there's no main component name, version, or type populated in the output.

    There is already a way to supply this via --pyproject, but for many projects that's not practical: not every requirements.txt-based project has (or wants to introduce) a pyproject.toml just to satisfy SBOM generation. In most cases, all that's actually needed is the main component's name and version - e.g.:

    "metadata": {
    "timestamp": "2024-01-09T12:00:00Z",
    "component": {
      "type": "application",
      "name": "my application",
      "version": "1.0"
    }
  },

    I'd propose adding two new CLI options, --mc-name and --mc-version, so this metadata can be provided directly on the command line without requiring a pyproject.toml:

    • --mc-name: sets metadata.component.name
    • --mc-version: sets metadata.component.version

    These would complement the existing --mc-type and --pyproject options rather than replace them - if --pyproject is given, its values would still be used as the default, with --mc-name/--mc-version acting as overrides when set. If no --pyproject is given, they'd populate metadata.component on their own, which is currently impossible.

  6. jkowalleck commented on Sep 29, 2026

    @jkowalleck
    jkowalleck
    on Sep 29, 2026
    Member

    These would complement the existing --mc-type and --pyproject options rather than replace them - if --pyproject is given, its values would still be used as the default, with --mc-name/--mc-version acting as overrides when set. If no --pyproject is given, they'd populate metadata.component on their own, which is currently impossible.

    i see. sounds like an interesting feature. 👍

    please go ahead, and (draft) pullrequest an implementation.

  7. abhijit24learning commented on Sep 29, 2026

    @abhijit24learning
    abhijit24learning
    on Sep 29, 2026
    Author

    i see. sounds like an interesting feature. 👍

    please go ahead, and (draft) pullrequest an implementation.

    Thanks! I'll get a draft PR up shortly implementing --mc-name/--mc-version for the requirements and environment subcommands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions