PRP: Extractor for pyproject.toml (PEP 621, not covered in #984)

[rahulhoysala]

• Software distribution method or binary type: pyproject.toml (PEP 621)
• Popularity of distribution method: PyPI hosts over 600,000 projects, where pyproject.toml is the default project file. Projects which ship only pyproject.toml without a lockfile seem to be currently off the radar of SCALIBR's Python extraction.
• Any critical, emergent vulnerability associated with software from the distribution method: The PyPI ecosystem has been a constant target for supply chain attacks. A popular example is the Ultralytics library (around 60 million downloads at the time) was compromised in December 2024, injecting a cryptominer into four published versions.
• Resources:
  https://peps.python.org/pep-0621/
  https://packaging.python.org/en/latest/specifications/pyproject-toml/
  https://www.guvi.in/blog/python-packaging-with-pyproject-toml/
• Additional notes: PRP: Extractor for PDM, Poetry, and uv #984 seems to cover sections of pyproject.toml specific to individual tools like Poetry, PDM and UV. This proposal targets complementary tables defined by PEP 621 like [project.dependencies] and [project.optional-dependencies].

[github-actions]

Welcome to the OSV-SCALIBR patch reward program!
Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once every other week,
so it can take up to two weeks before you hear back from us,
sometimes longer depending on available capacity.
Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.
For more details, please see the rules page.
~The OSV-SCALIBR PRP team

[another-rex]

Thank you for the proposal. We are happy to accept this PRP! Please feel free to start working on it.

Note: Ideally we can support transitive package resolution as well with enrichers after the initial extraction. I believe we can just reuse the requirements.txt transitive resolving.

[github-actions]

Congratulations, your request has been approved! 🎉
This means that you can start working on this contribution.
❗ Please take a moment to fill the participation form
If you are unsure where to start, we have compiled a set of
useful guides in our documentation:

• Writing a new vulnerability detector plugin
• Writing a new inventory extraction plugin
• Writing a new secret detector plugin
• General style guide

~The OSV-SCALIBR PRP team

[rahulhoysala]

@another-rex Notifying you that the work is done and ready for review (I'm assuming that this will still be reviewed despite the PRP pause).

I implemented your suggestion regarding transitive package resolution and all tests passed. I'm yet to build a Docker image for the PRP submission on bughunters, doing that now.

[another-rex]

Yes all approved issues will still be reviewed, just not accepting any new proposals for now, thanks!

[rahulhoysala]

Docker image if needed - https://gist.github.com/rahulhoysala/7ac899502a6fdd31f92d2470b3dde8ea