feat: gather component identity evidence

[EltonChang1]

Description

Add --gather-identity-evidence to record the metadata sources of component names and concrete versions. The option works with environment, requirements, Pipenv, and Poetry input, including root component metadata from pyproject.toml. It is disabled by default, preserving existing output.

Each declared field receives a manifest-analysis method and its source label. Method confidence of 1 describes direct extraction, not authentication of the package or metadata. Missing/unpinned versions and identities inferred from requirements URLs or local paths are omitted. Source labels contain no absolute paths or requirement contents, and existing license evidence is preserved.

CycloneDX 1.6+ retains both identities and concluded values. The library projects this to the single name identity supported by 1.5 and omits identity evidence for older schemas. Raise the minimum cyclonedx-python-lib version to 10.2, where the required identity APIs were introduced, and document the option and schema behavior.

Fixes #829.

Validation on Windows/Python 3.12:

• 1,468 selected tests passed: all unit and functional tests, all integration modules except the existing environment fixture matrix, and the existing current-interpreter environment smoke test. This includes 18 new helper/CLI tests. Poetry fixture symlinks were temporarily materialized for the Windows checkout and restored after the run; no snapshots changed.
• All 18 new tests also passed with the minimum library version, 10.2.0. JSON/XML schema validation covers available 1.4, 1.5, 1.6, and 1.7 outputs.
• Flake8, isort, mypy (current and Python 3.9 target), Bandit, and deptry passed.
• Sphinx HTML build passed with warnings treated as errors, using an empty local static directory to replace the absent upstream docs/_static directory.

The full environment fixture/snapshot matrix and supported Python version matrix were not run locally and remain for upstream CI.

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: OpenAI Codex desktop, including parallel Codex agents for tests and independent review.
  • LLMs and versions: GPT-6-based Codex; the exact runtime model revision is not exposed in this session.
  • Prompts: Find an available issue explicitly labeled help wanted in an LLM- or security-adjacent project and implement a contribution. For this issue, implement opt-in identity evidence for directly declared names/versions across all builders, preserve default output and license evidence, avoid inferred provenance or credential/path disclosure, and validate schema and minimum-library compatibility.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 4 complexity · 0 duplication

Metric	Results
Complexity	✅ 4 (≤ 20 complexity)
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python SBOM Tool | 🛠️ Build #35202934 | 📁 Comparing 351c378 against latest (fc11987)

  🔍 Preview build  

1 file changed

± usage.html