Conan 2.x support?

[jfinkhaeuser]

I guess the subject says it all. I just wonder what the progress here is, so would like to watch an issue for it :)

[norbertvarju]

I am wondering the same, as I was about to integrate it too. The upgrade seems somewhat tricky as well, as the Conan Python API seems to have changed quite a bit.

[andreas-hilti]

@jfinkhaeuser @norbertvarju I have started playing with conan v2. The branch is still in a very rough state, but the basics seem to work:
https://github.com/andreas-hilti/cyclonedx-conan/tree/feat/conan_v2_draft
And yes, the conan Python API changed quite a bit...

[jkowalleck]

probably not gonna support conan2,
in hope conan2 will add native CDX support

• [feature] Add support for CycloneDX output to the info command conan-io/conan#9787
• Add format 'cyclonedx' as output format for the graph command conan-io/conan#14405

[hedtke]

Working on it: conan-io/conan-extensions#66

[memsharded]

Hi all, and @jkowalleck

I commented in conan-io/conan-extensions#66 (comment), but just to make sure: is it your preferred approach that the Conan 2.0 support happens in the Conan org? You are for sure more experts, I see that you already reviewed it there.

As commented in the ticket, with Conan 2.0 it doesn't matter much in which repo is it, because both are equally integrated, just one conan config install <url> and you get the command the same as a Conan built-in command, this is also the approach we follow for our own extensions repository.

[jkowalleck]

is it your preferred approach that the Conan 2.0 support happens in the Conan org?

re: conan-io/conan-extensions#66 (comment)

[...] it could be either centralized in the CycloneDX org, or here in the Conan org, [...]

@memsharded,
I will discuss this topic with the CycloneDX team, and come back to you soon.
CC @coderpatros @stevespringett @CycloneDX/core-team @CycloneDX/python-maintainers

[jkowalleck]

@memsharded re #84 (comment)

Speaking for the CycloneDX Core team, we see our main focus as developing and documenting the CycloneDX document standard.
We might help kick-start ecosystems' integration and implementation; therefore, we provide libraries to a certain extent in various programming languages (see repositories on GitHub). Another thing we do is host lists of CycloneDX-related tools and supporters (companies, vendors, projects).

We prefer ecosystems to implement and provide CycloneDX generators themselves.
We are always there to support, give guidance and answer questions. Feel free to reach out to us, preferably on our official Slack server (invite link).
This being said, we would welcome the Conan2 community to sustain a CycloneDX generator themselves. We are looking forward to adding your organization and tools to our lists.

[memsharded]

Thanks very much @jkowalleck for the feedback and the insights.

Then, lets go with the plan of adding support for it as a Conan extension, and continue with the effort that @hedtke has started there. Thanks for the support offer, it will be greatly appreciated if you keep reviewing and supervising things there, to make sure things align with the specs and good practices.