Enhancement request: add support to scan package manifest

[pombredanne]

Following recent changes in SCIO we no longer can import product's data from package manifest

• latest DejaCode cannot upload SBOM anymore in a product  #64

I would like to have the ability to simply upload a package manifest or lockfile as a product like in the former "import_manifest" feature.

We could do it best IMHO as two imports: import SBOM and import_manifest that would other behave the same.

[DennisClark]

In addition to the current "Scan" dropdown options on a Product, how about a new one to

Import data from Package Manifest

or better maybe

Interpret data from Package Manifest

[tdruez]

We had "Import Packages from manifest" before the renaming to "Load Packages from SBOMs".

[DennisClark]

Perhaps we need to re-introduce "Import Packages from manifest" then as a fifth option.

[pombredanne]

Perhaps we need to re-introduce "Import Packages from manifest" then as a fifth option.

This sounds the sanest and I like the fact this is more explicit than trying to guess of we have SBOMs or manifests.

[DennisClark]

@tdruez testing on staging went reasonably well. I submitted a request for the requirements.txt file from pi-hole-5.17.3 (attached) and it imported a number of packages, and also reported 3 errors, but the log does not tell me what those errors are. See screenshots.

requirements.txt