Run without internet access

I encountered an issue running cyclonedx-py 0.3.5 in an environment with no internet access. The tool fails with the stack trace below, apparently trying to connect to http://cyclonedx.org/schema/bom/1.0.

We had excellent experience with CycloneDX for .NET, Java and NPM, which do not require internet access, when configured with on-premise package feeds.

Is it possible to configure cyclonedx-py to run without internet access? An on-premise Pip source is available, if necessary, but no other external resources are accessible.

If the answer is no currently, and code changes are required to support this case, I would be interested to contribute a PR, as long as someone can provide a few pointers on how to disable internet access.

Traceback (most recent call last):
  File "python\lib\runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "python\lib\runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "python\Scripts\cyclonedx-py.exe\__main__.py", line 4, in <module>
  File "python\lib\site-packages\cyclonedx\cli\generateBom.py", line 25, in <module>
    from cyclonedx import BomValidator
  File "python\lib\site-packages\cyclonedx\BomValidator.py", line 19, in <module>
    bom_schema = xmlschema.XMLSchema("http://cyclonedx.org/schema/bom/1.0")
  File "python\lib\site-packages\xmlschema\validators\schema.py", line 270, in __init__
    self.source = XMLResource(source, base_url, defuse, timeout, lazy=False)
  File "python\lib\site-packages\xmlschema\resources.py", line 279, in __init__
    self.source = source
  File "python\lib\site-packages\xmlschema\resources.py", line 303, in __setattr__
    self._root, self._text, self._url = self._fromsource(value)
  File "python\lib\site-packages\xmlschema\resources.py", line 381, in _fromsource
    resource = urlopen(url, timeout=self.timeout)
  File "python\lib\urllib\request.py", line 222, in urlopen
    return opener.open(url, data, timeout)
  File "python\lib\urllib\request.py", line 531, in open
    response = meth(req, response)
  File "python\lib\urllib\request.py", line 640, in http_response
    response = self.parent.error(
  File "python\lib\urllib\request.py", line 569, in error
    return self._call_chain(*args)
  File "python\lib\urllib\request.py", line 502, in _call_chain
    result = func(*args)
  File "python\lib\urllib\request.py", line 649, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 403: Forbidden

Environment information:

• Windows 10 (2004) 64-bit
• Python 3.8.5 x64
• cyclonedx_bom 0.3.5

[coderpatros]

Thanks for confirming that @nil4

There was a packaging bug where the schema files weren’t being included in the package.

What that warning basically means is that you will be missing a bit of additional information like the author and licence. But depending on your use case you might not be worried about that.

[nil4]

@coderpatros happy to report that the issue is resolved with v0.4.0! 👍

Running cyclonedx-py on a test project with a single requirement (elasticsearch==7.1.0) now outputs:

> cyclonedx-py
Input file: requirements.txt
Output BOM: bom.xml
JSON output: False
Package info url: https://pypi.org/pypi/{package_name}/{package_version}/json
Generating CycloneDX BOM
WARNING: could not retrieve package info for elasticsearch
Validating BOM
Complete

The warning displayed appears harmless, as the following BOM is produced:

<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
    <components>
        <component type="library">
            <name>elasticsearch</name>
            <version>7.1.0</version>
            <purl>pkg:pypi/elasticsearch@7.1.0</purl>
            <modified>false</modified>
        </component>
    </components>
</bom>

Thank you very much for identifying and releasing the fix so quickly!