Python pip dependency information

[prosunjitbiswas]

I am generating SBOM using syft packages dir: command. Given presence of a package manager file (eg. requirements.txt), I see syft reports both direct & transitive dependencies in the generated SBOM.

Given that, is there a way to differentiate between direct and transitive dependencies in the SBOM generated by syft?

[kzantow]

I do not believe the requirements.txt has information separating direct and transitive dependencies. Without this information being conveyed in the file somehow, Syft can only treat the entries as a flat list today. If there is a tool that could provide this information, it's possible in the future Syft will be able to shell out to something in order to enhance the SBOM that is created. It looks like the pipdeptree package might be able to do this; it would be nice if pip could do it directly.

[kzantow]

FYI -- we have an open epic to add this information where we can: #1562

[kzantow]

I'll use this question as a placeholder for getting pip dependency info.