From 61b6e8af414edef19ee618a785a3f946f5a4e1f5 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 13:07:37 +0100
Subject: [PATCH 01/17] cli commons

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli_common.py   | 32 ++++++++++++++++++++++++++
 cyclonedx_py/_internal/environment.py  | 23 +++---------------
 cyclonedx_py/_internal/pipenv.py       | 24 ++++---------------
 cyclonedx_py/_internal/poetry.py       | 17 ++------------
 cyclonedx_py/_internal/requirements.py | 27 ++++------------------
 5 files changed, 46 insertions(+), 77 deletions(-)
 create mode 100644 cyclonedx_py/_internal/cli_common.py

diff --git a/cyclonedx_py/_internal/cli_common.py b/cyclonedx_py/_internal/cli_common.py
new file mode 100644
index 00000000..69fcd56b
--- /dev/null
+++ b/cyclonedx_py/_internal/cli_common.py
@@ -0,0 +1,32 @@
+from typing import TYPE_CHECKING
+
+from .utils.args import argparse_type4enum
+
+if TYPE_CHECKING:  # pragma: no cover
+    from argparse import Action, ArgumentParser
+
+
+def add_argument_pyproject(p: 'ArgumentParser') -> 'Action':
+    return p.add_argument('--pyproject',
+                          metavar='FILE',
+                          help="Path to the root component's `pyproject.toml` file. "
+                               'This should point to a file compliant with PEP 621 '
+                               '(storing project metadata).',
+                          dest='pyproject_file',
+                          default=None)
+
+
+def add_argument_mc_type(p: 'ArgumentParser') -> 'Action':
+    from cyclonedx.model.component import ComponentType
+    choices = [ComponentType.APPLICATION,
+               ComponentType.FIRMWARE,
+               ComponentType.LIBRARY]
+    return p.add_argument('--mc-type',
+                          metavar='TYPE',
+                          help='Type of the main component'
+                               f' {{choices: {", ".join(t.value for t in choices)}}}'
+                               ' (default: %(default)s)',
+                          dest='mc_type',
+                          choices=choices,
+                          type=argparse_type4enum(ComponentType),
+                          default=ComponentType.APPLICATION)
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index f6649b48..ae9c3df7 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -40,9 +40,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from os import name as os_name
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum
+        from .cli_common import add_argument_mc_type, add_argument_pyproject
 
         p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
@@ -87,23 +85,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                  • Build an SBOM from Poetry environment:
                        $ %(prog)s "$(poetry env info --executable)"
                """)
-        p.add_argument('--pyproject',
-                       metavar='FILE',
-                       help="Path to the root component's `pyproject.toml` according to PEP621",
-                       dest='pyproject_file',
-                       default=None)
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_pyproject(p)
+        add_argument_mc_type(p)
         # TODO possible additional switch:
         #  `--exclude <package>` Exclude specified package from the output (multi use)
         #  `--local`        If in a virtualenv that has global access, do not list globally-installed packages.
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 6fafb4f7..7b1e224f 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -44,9 +44,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from os import getenv
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum, arpaese_split
+        from .cli_common import add_argument_mc_type, add_argument_pyproject
+        from .utils.args import arpaese_split
 
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pipenv.
@@ -71,23 +70,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        help='Specify a PyPI mirror [env var: PIPENV_PYPI_MIRROR]',
                        dest='pypi_url',
                        default=getenv('PIPENV_PYPI_MIRROR'))
-        p.add_argument('--pyproject',
-                       metavar='FILE',
-                       help="Path to the root component's `pyproject.toml` according to PEP621",
-                       dest='pyproject_file',
-                       default=None)
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_pyproject(p)
+        add_argument_mc_type(p)
         p.add_argument('project_directory',
                        metavar='project-directory',
                        help='The project directory for Pipenv (default: current working directory)\n'
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 372b2f62..a03e8707 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -70,9 +70,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum
+        from .cli_common import add_argument_mc_type
 
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Poetry project.
@@ -116,18 +114,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                         dest='all_extras',
                         default=False)
         del eg
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_mc_type(p)
         p.add_argument('project_directory',
                        metavar='project-directory',
                        help='The project directory for Poetry (default: current working directory)',
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index ca432e21..befa12f9 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -41,9 +41,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum
+        from .cli_common import add_argument_mc_type, add_argument_pyproject
 
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pip requirements.
@@ -83,27 +81,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        action='append',
                        dest='extra_index_urls',
                        default=[])
-        p.add_argument('--pyproject',
-                       metavar='FILE',
-                       help="Path to the root component's `pyproject.toml` according to PEP621",
-                       dest='pyproject_file',
-                       default=None)
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_pyproject(p)
+        add_argument_mc_type(p)
         p.add_argument('requirements_file',
                        metavar='REQUIREMENTS-FILE',
-                       help='Requirements file (default: %(default)r in current working directory).\n'
-                            'May be set to "-" to read from <stdin>.',
+                       help='Path to requirements file. May be set to "-" to read from <stdin>. '
+                            '(default: %(default)r in current working directory)',
                        nargs=OPTIONAL,
                        default='requirements.txt')
         return p

From af133b8c1ba233c9fff3bcd0194cd215def379cb Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 15:59:07 +0100
Subject: [PATCH 02/17] feat: more packaging

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/environment.py     |  24 ++---
 cyclonedx_py/_internal/pipenv.py          |   2 +-
 cyclonedx_py/_internal/poetry.py          |  62 +------------
 cyclonedx_py/_internal/requirements.py    |   2 +-
 cyclonedx_py/_internal/utils/packaging.py |  17 ++--
 cyclonedx_py/_internal/utils/pep610.py    |   2 +-
 cyclonedx_py/_internal/utils/pep621.py    |  79 +++++++----------
 cyclonedx_py/_internal/utils/pep631.py    |  29 ------
 cyclonedx_py/_internal/utils/poetry.py    | 103 ++++++++++++++++++++++
 cyclonedx_py/_internal/utils/pyproject.py |  50 ++++++++++-
 pyproject.toml                            |   1 +
 tests/integration/test_cli_environment.py |   1 +
 12 files changed, 211 insertions(+), 161 deletions(-)
 delete mode 100644 cyclonedx_py/_internal/utils/pep631.py
 create mode 100644 cyclonedx_py/_internal/utils/poetry.py

diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index ae9c3df7..5c1f8835 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Tuple
 
 from . import BomBuilder
 
@@ -26,6 +26,7 @@
 
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
+    from packaging.requirements import Requirement
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -112,16 +113,16 @@ def __call__(self, *,  # type:ignore[override]
         from os import getcwd
 
         from .utils.cdx import make_bom
+        from .utils.pyproject import pyproject2dependencies
 
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pep621 import pyproject2component, pyproject_dependencies, pyproject_load
-            from .utils.pep631 import requirement2package_name
+            from .utils.pyproject import pyproject2component, pyproject_load
             pyproject = pyproject_load(pyproject_file)
             root_c = pyproject2component(pyproject, type=mc_type)
             root_c.bom_ref.value = 'root-component'
-            root_d = set(filter(None, map(requirement2package_name, pyproject_dependencies(pyproject))))
+            root_d = pyproject2dependencies(pyproject)
             rc = (root_c, root_d)
 
         path: List[str]
@@ -137,21 +138,22 @@ def __call__(self, *,  # type:ignore[override]
         self.__add_components(bom, rc, path=path)
         return bom
 
-    def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]],
+    def __add_components(self, bom: 'Bom',
+                         rc: Optional[Tuple['Component', Iterable['Requirement']]],
                          **kwargs: Any) -> None:
         from importlib.metadata import distributions
 
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
+        from packaging.requirements import Requirement
 
         from . import PropertyName
         from .utils.cdx import licenses_fixup
         from .utils.packaging import metadata2extrefs, metadata2licenses
         from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref, packagesource4dist
-        from .utils.pep631 import requirement2package_name
 
-        all_components: Dict[str, Tuple['Component', Set[str]]] = {}
+        all_components: Dict[str, Tuple['Component', Iterable[Requirement]]] = {}
         self._logger.debug('distribution context args: %r', kwargs)
         self._logger.info('discovering distributions...')
         for dist in distributions(**kwargs):
@@ -197,10 +199,8 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
                                             qualifiers=purl_qs, subpath=purl_subpath)
             del dist_meta, dist_name, dist_version, packagesource, purl_qs
 
-            all_components[component.name.lower()] = (
-                component,
-                set(filter(None, map(requirement2package_name, dist.requires or ())))
-            )
+            all_components[component.name.lower()] = component, map(Requirement, dist.requires or ())
+
             self._logger.info('add component for package %r', component.name)
             self._logger.debug('add component: %r', component)
             bom.components.add(component)
@@ -218,7 +218,7 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
         for component, requires in all_components.values():
             # we know a lot of dependencies, but here we are only interested in those that are actually installed/found
             requires_d: Iterable[Component] = filter(None,
-                                                     map(lambda r: all_components.get(r, (None,))[0],
+                                                     map(lambda r: all_components.get(r.name.lower(), (None,))[0],
                                                          requires))
             bom.register_dependency(component, requires_d)
 
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 7b1e224f..1c2de12c 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -126,7 +126,7 @@ def __call__(self, *,  # type:ignore[override]
             if pyproject_file is None:
                 rc = None
             else:
-                from .utils.pep621 import pyproject_file2component
+                from .utils.pyproject import pyproject_file2component
                 rc = pyproject_file2component(pyproject_file, type=mc_type)
                 rc.bom_ref.value = 'root-component'
 
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index a03e8707..b11513c3 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -28,7 +28,6 @@
     from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
-    from cyclonedx.model.license import License
 
     NameDict = Dict[str, Any]
 
@@ -219,6 +218,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         from . import PropertyName
         from .utils.cdx import make_bom
+        from .utils.poetry import poetry2component
 
         self._logger.debug('use_groups: %r', use_groups)
         self._logger.debug('use_extras: %r', use_extras)
@@ -227,7 +227,8 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         po_cfg = project['tool']['poetry']
 
-        bom.metadata.component = root_c = self.__component4poetryproj(po_cfg, mc_type)
+        bom.metadata.component = root_c = poetry2component(po_cfg, type=mc_type)
+        root_c.bom_ref.value = 'root-component'
         root_c.properties.update(Property(
             name=PropertyName.PackageExtra.value,
             value=extra
@@ -319,63 +320,6 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
 
         return bom
 
-    def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') -> 'Component':
-        from cyclonedx.factory.license import LicenseFactory
-        from cyclonedx.model.component import Component
-
-        from .utils.cdx import licenses_fixup
-        from .utils.pep621 import classifiers2licenses
-
-        licenses: List['License'] = []
-        lfac = LicenseFactory()
-        if 'classifiers' in po_cfg:
-            # https://python-poetry.org/docs/pyproject/#classifiers
-            licenses.extend(classifiers2licenses(po_cfg['classifiers'], lfac))
-        if 'license' in po_cfg:
-            # https://python-poetry.org/docs/pyproject/#license
-            licenses.append(lfac.make_from_string(po_cfg['license']))
-        del lfac
-
-        # see spec: https://python-poetry.org/docs/pyproject/
-        return Component(
-            bom_ref=str(po_cfg.get('name', 'root-component')),
-            type=c_type,
-            name=str(po_cfg.get('name', 'unnamed')),
-            version=str(po_cfg.get('version', '')) or None,
-            description=str(po_cfg.get('description', '')) or None,
-            licenses=licenses_fixup(licenses),
-            author=' | '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
-            external_references=self.__extrefs4poetryproj(po_cfg)
-        )
-
-    def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
-
-        from .utils.cdx import url_label_to_ert
-
-        for ers, ert in [
-            # see https://python-poetry.org/docs/pyproject/
-            ('homepage', ExternalReferenceType.WEBSITE),
-            ('repository', ExternalReferenceType.VCS),
-            ('documentation', ExternalReferenceType.DOCUMENTATION),
-        ]:
-            try:
-                yield ExternalReference(
-                    comment=f'from poetry: {ers}',
-                    type=ert,
-                    url=XsUri(str(po_cfg[ers])))
-            except (KeyError, InvalidUriException):  # pragma: nocover
-                pass
-        for ul, ut in po_cfg.get('urls', {}).items():
-            try:
-                yield ExternalReference(
-                    comment=f'from poetry url: {ul}',
-                    type=url_label_to_ert(ul),
-                    url=XsUri(str(ut)))
-            except InvalidUriException:  # pragma: nocover
-                pass
-
     @staticmethod
     def _get_lockfile_version(locker: 'NameDict') -> Tuple[int, ...]:
         return tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index befa12f9..1b2c6dc9 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -112,7 +112,7 @@ def __call__(self, *,  # type:ignore[override]
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pep621 import pyproject_file2component
+            from .utils.pyproject import pyproject_file2component
             rc = pyproject_file2component(pyproject_file, type=mc_type)
             rc.bom_ref.value = 'root-component'
 
diff --git a/cyclonedx_py/_internal/utils/packaging.py b/cyclonedx_py/_internal/utils/packaging.py
index 558d9ddb..70b412e1 100644
--- a/cyclonedx_py/_internal/utils/packaging.py
+++ b/cyclonedx_py/_internal/utils/packaging.py
@@ -57,14 +57,13 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#download-url
         ('Download-URL', ExternalReferenceType.DISTRIBUTION),
     ):
-        if meta_key in metadata:
-            try:
-                yield ExternalReference(
-                    comment=f'from packaging metadata: {meta_key}',
-                    type=extref_typet,
-                    url=XsUri(metadata[meta_key]))
-            except InvalidUriException:
-                pass
+        try:
+            yield ExternalReference(
+                comment=f'from packaging metadata: {meta_key}',
+                type=extref_typet,
+                url=XsUri(metadata[meta_key]))
+        except (KeyError, InvalidUriException):    # pragma: nocover
+            pass
     for label_url in metadata.get_all('Project-URL', ()):
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#project-url-multiple-use
         label, url = label_url.split(',', maxsplit=1)
@@ -73,5 +72,5 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
                 comment=f'from packaging metadata Project-URL: {label}',
                 type=url_label_to_ert(label),
                 url=XsUri(url.strip()))
-        except InvalidUriException:
+        except InvalidUriException:   # pragma: nocover
             pass
diff --git a/cyclonedx_py/_internal/utils/pep610.py b/cyclonedx_py/_internal/utils/pep610.py
index 2bd1f352..8e9a4ba5 100644
--- a/cyclonedx_py/_internal/utils/pep610.py
+++ b/cyclonedx_py/_internal/utils/pep610.py
@@ -139,6 +139,6 @@ def packagesource2extref(src: PackageSource) -> Optional['ExternalReference']:
                 type=ExternalReferenceType.DISTRIBUTION,
                 url=XsUri(src.url),
                 comment=f'PackageSource: Local{sdir}')
-    except InvalidUriException:
+    except InvalidUriException:  # pragma: nocover
         pass
     return None
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index c456896c..61f33f0e 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -23,13 +23,14 @@
 See https://peps.python.org/pep-0621/
 """
 
-from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, Iterator, Tuple
 
 if TYPE_CHECKING:
     from cyclonedx.factory.license import LicenseFactory
     from cyclonedx.model import ExternalReference
     from cyclonedx.model.component import Component, ComponentType
     from cyclonedx.model.license import License
+    from packaging.requirements import Requirement
 
 
 def classifiers2licenses(classifiers: Iterable[str], lfac: 'LicenseFactory') -> Generator['License', None, None]:
@@ -43,13 +44,13 @@ def classifiers2licenses(classifiers: Iterable[str], lfac: 'LicenseFactory') ->
                               classifiers)))
 
 
-def pyproject2licenses(pyproject: Dict[str, Any], lfac: 'LicenseFactory') -> Generator['License', None, None]:
-    if 'classifiers' in pyproject:
+def project2licenses(project: Dict[str, Any], lfac: 'LicenseFactory') -> Generator['License', None, None]:
+    if 'classifiers' in project:
         # https://packaging.python.org/en/latest/specifications/pyproject-toml/#classifiers
         # https://peps.python.org/pep-0621/#classifiers
         # https://packaging.python.org/en/latest/specifications/core-metadata/#classifier-multiple-use
-        yield from classifiers2licenses(pyproject['classifiers'], lfac)
-    license = pyproject.get('license')
+        yield from classifiers2licenses(project['classifiers'], lfac)
+    license = project.get('license')
     # https://packaging.python.org/en/latest/specifications/pyproject-toml/#license
     # https://peps.python.org/pep-0621/#license
     # https://packaging.python.org/en/latest/specifications/core-metadata/#license
@@ -57,27 +58,7 @@ def pyproject2licenses(pyproject: Dict[str, Any], lfac: 'LicenseFactory') -> Gen
         yield lfac.make_from_string(license['text'])
 
 
-def pyproject2component(pyproject: Dict[str, Any], *,
-                        type: 'ComponentType') -> 'Component':
-    from cyclonedx.factory.license import LicenseFactory
-    from cyclonedx.model.component import Component
-
-    from .cdx import licenses_fixup
-
-    project = pyproject['project']
-    dynamic = project.get('dynamic', ())
-    return Component(
-        type=type,
-        name=project['name'],
-        version=project.get('version', None) if 'version' not in dynamic else None,
-        description=project.get('description', None) if 'description' not in dynamic else None,
-        licenses=licenses_fixup(pyproject2licenses(project, LicenseFactory())),
-        external_references=_project2extrefs(project),
-        # TODO add more properties according to spec
-    )
-
-
-def _project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
+def project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
     from cyclonedx.exception.model import InvalidUriException
     from cyclonedx.model import ExternalReference, XsUri
 
@@ -90,30 +71,38 @@ def _project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference',
                 comment=f'from pyproject urls: {label}',
                 type=url_label_to_ert(label),
                 url=XsUri(str(url)))
-        except InvalidUriException:
+        except InvalidUriException:  # pragma: nocover
             pass
 
 
-def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
-    from .toml import toml_loads
-    try:
-        pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
-    except OSError as err:
-        raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
-    with pyproject_fh:
-        return toml_loads(pyproject_fh.read())
+def project2component(project: Dict[str, Any], *,
+                      type: 'ComponentType') -> 'Component':
+    from cyclonedx.factory.license import LicenseFactory
+    from cyclonedx.model.component import Component
 
+    from .cdx import licenses_fixup
 
-def pyproject_file2component(pyproject_file: str, *,
-                             type: 'ComponentType') -> 'Component':
-    return pyproject2component(
-        pyproject_load(pyproject_file),
-        type=type
+    dynamic = project.get('dynamic', ())
+    return Component(
+        type=type,
+        name=project['name'],
+        version=project.get('version', None) if 'version' not in dynamic else None,
+        description=project.get('description', None) if 'description' not in dynamic else None,
+        licenses=licenses_fixup(project2licenses(project, LicenseFactory())),
+        external_references=project2extrefs(project),
+        # TODO add more properties according to spec
     )
 
 
-def pyproject_dependencies(pyproject: Dict[str, Any]) -> Generator[str, None, None]:
-    project = pyproject.get('project', {})
-    yield from project.get('dependencies', ())
-    for opts in project.get('optional-dependencies', {}).values():
-        yield from opts
+def project2dependencies(project: Dict[str, Any]) -> Iterator['Requirement']:
+    from itertools import chain
+
+    from packaging.requirements import Requirement
+
+    return (
+        Requirement(dep)
+        for dep in chain(
+            project.get('dependencies', ()),
+            chain.from_iterable(project.get('optional-dependencies', {}).values())
+        )
+    )
diff --git a/cyclonedx_py/_internal/utils/pep631.py b/cyclonedx_py/_internal/utils/pep631.py
deleted file mode 100644
index a1d36f64..00000000
--- a/cyclonedx_py/_internal/utils/pep631.py
+++ /dev/null
@@ -1,29 +0,0 @@
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
-from typing import Optional
-
-from packaging.requirements import Requirement
-
-
-def requirement2package_name(value: str) -> Optional[str]:
-    # see https://peps.python.org/pep-0631/#implementation
-    try:
-        return Requirement(value).name
-    except Exception:
-        return None
diff --git a/cyclonedx_py/_internal/utils/poetry.py b/cyclonedx_py/_internal/utils/poetry.py
new file mode 100644
index 00000000..c0349af9
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/poetry.py
@@ -0,0 +1,103 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+"""
+Functionality related to poetry manifest.
+
+See https://python-poetry.org/docs/pyproject/
+"""
+
+from typing import TYPE_CHECKING, Any, Dict, Generator, List
+
+if TYPE_CHECKING:
+    from cyclonedx.model import ExternalReference
+    from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.license import License
+    from packaging.requirements import Requirement
+
+
+def poetry2extrefs(poetry: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
+    from cyclonedx.exception.model import InvalidUriException
+    from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+
+    from .cdx import url_label_to_ert
+
+    for ers, ert in (
+        ('homepage', ExternalReferenceType.WEBSITE),
+        ('repository', ExternalReferenceType.VCS),
+        ('documentation', ExternalReferenceType.DOCUMENTATION),
+    ):
+        try:
+            yield ExternalReference(
+                comment=f'from poetry: {ers}',
+                type=ert,
+                url=XsUri(str(poetry[ers])))
+        except (KeyError, InvalidUriException):  # pragma: nocover
+            pass
+    for label, url in poetry.get('urls', {}).items():
+        try:
+            yield ExternalReference(
+                comment=f'from poetry url: {label}',
+                type=url_label_to_ert(label),
+                url=XsUri(str(url)))
+        except InvalidUriException:  # pragma: nocover
+            pass
+
+
+def poetry2component(poetry: Dict[str, Any], *, type: 'ComponentType') -> 'Component':
+    from cyclonedx.factory.license import LicenseFactory
+    from cyclonedx.model.component import Component
+
+    from .cdx import licenses_fixup
+    from .pep621 import classifiers2licenses
+
+    licenses: List['License'] = []
+    lfac = LicenseFactory()
+    if 'classifiers' in poetry:
+        licenses.extend(classifiers2licenses(poetry['classifiers'], lfac))
+    if 'license' in poetry:
+        licenses.append(lfac.make_from_string(poetry['license']))
+    del lfac
+
+    return Component(
+        type=type,
+        name=poetry['name'],
+        version=poetry.get('version'),
+        description=poetry.get('description'),
+        licenses=licenses_fixup(licenses),
+        external_references=poetry2extrefs(poetry),
+        # TODO add more properties according to spec
+    )
+
+
+def poetry2dependencies(poetry: Dict[str, Any]) -> Generator['Requirement', None, None]:
+    from itertools import chain
+
+    from packaging.requirements import Requirement
+
+    for name, spec in chain(
+        poetry.get('dependencies', {}).items(),
+        poetry.get('dev-dependencies', {}).items(),
+        chain.from_iterable(
+            group.get('dependencies', {}).items()
+            for group in poetry.get('group', {}).items()
+        )
+    ):
+        req = Requirement(name)
+        if isinstance(spec, dict) and 'extras' in spec:
+            req.extras = set(spec['extras'])
+        yield req
diff --git a/cyclonedx_py/_internal/utils/pyproject.py b/cyclonedx_py/_internal/utils/pyproject.py
index 317af77f..8269669a 100644
--- a/cyclonedx_py/_internal/utils/pyproject.py
+++ b/cyclonedx_py/_internal/utils/pyproject.py
@@ -1,9 +1,51 @@
 # use pyproject from pep621
 # use pyproject from poetry implementation
 
-# usage: environment may use also th pyprojevt implementation ...
-# poetry uses only poetry implementation
-# all othther use pep621
 
+from typing import TYPE_CHECKING, Any, Dict, Iterator
 
-# TODO ^^^^
+from .pep621 import project2component, project2dependencies
+from .poetry import poetry2component, poetry2dependencies
+
+if TYPE_CHECKING:  # pragma: no cover
+    from cyclonedx.model.component import Component, ComponentType
+    from packaging.requirements import Requirement
+
+
+def pyproject2component(data: Dict[str, Any], *,
+                        type: 'ComponentType') -> 'Component':
+    tool = data.get('tool', {})
+    # TODO decide based on install engine
+    if 'poetry' in tool:
+        return poetry2component(tool['poetry'], type=type)
+    if 'project' in data:
+        return project2component(data['project'], type=type)
+    raise ValueError('Unable to build component from pyproject')
+
+
+def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
+    from .toml import toml_loads
+    try:
+        pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
+    except OSError as err:
+        raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
+    with pyproject_fh:
+        return toml_loads(pyproject_fh.read())
+
+
+def pyproject_file2component(pyproject_file: str, *,
+                             type: 'ComponentType') -> 'Component':
+    return pyproject2component(
+        pyproject_load(pyproject_file),
+        type=type
+    )
+
+
+def pyproject2dependencies(data: Dict[str, Any]) -> Iterator['Requirement']:
+    tool = data.get('tool', {})
+    # TODO decide based on install engine
+    if 'poetry' in tool:
+        return poetry2dependencies(tool['poetry'])
+    if 'project' in data:
+        return project2dependencies(data['project'])
+    return iter(())
diff --git a/pyproject.toml b/pyproject.toml
index 2971396f..85a2bc69 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -50,6 +50,7 @@ packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 tomli = { version = "^2.0.1", python = "<3.11" }
 chardet = "^5.1"
+packaging = "^22||^23"
 
 [tool.poetry.group.dev.dependencies]
 # pin to exact versions, if the tool/lib/plugin is process-relevant
diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
index 6ce23b1e..11540fc9 100644
--- a/tests/integration/test_cli_environment.py
+++ b/tests/integration/test_cli_environment.py
@@ -53,6 +53,7 @@ class TestCliEnvironment(TestCase, SnapshotMixin):
     def setUpClass(cls) -> None:
         if INIT_TESTBEDS:
             for initfile in initfiles:
+                print('setup environment testbed:', initfile)
                 res = run([executable, initfile],
                           capture_output=True, encoding='utf8', shell=False)  # nosec:B603
                 if res.returncode != 0:

From b57e579e34629325dd54e7ad9e3fbfdf7660dfda Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 16:50:55 +0100
Subject: [PATCH 03/17] feat: mpre from pyprojects

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/environment.py         | 20 ++++++++++++++-----
 cyclonedx_py/_internal/poetry.py              |  2 +-
 cyclonedx_py/_internal/utils/packaging.py     | 17 ++++++++--------
 cyclonedx_py/_internal/utils/pep621.py        |  2 +-
 cyclonedx_py/_internal/utils/pyproject.py     |  2 --
 .../environment/venv_with-extras_1.2.json.bin |  3 ---
 .../environment/venv_with-extras_1.2.xml.bin  |  4 +---
 .../environment/venv_with-extras_1.3.json.bin |  9 ++++++---
 .../environment/venv_with-extras_1.3.xml.bin  |  7 ++++---
 .../environment/venv_with-extras_1.4.json.bin |  9 ++++++---
 .../environment/venv_with-extras_1.4.xml.bin  |  7 ++++---
 .../environment/venv_with-extras_1.5.json.bin |  9 ++++++---
 .../environment/venv_with-extras_1.5.xml.bin  |  7 ++++---
 .../poetry/group-deps_lock11_1.2.json.bin     |  1 -
 .../poetry/group-deps_lock11_1.2.xml.bin      |  1 -
 .../poetry/group-deps_lock11_1.3.json.bin     |  1 -
 .../poetry/group-deps_lock11_1.3.xml.bin      |  1 -
 .../poetry/group-deps_lock11_1.4.json.bin     |  1 -
 .../poetry/group-deps_lock11_1.4.xml.bin      |  1 -
 .../poetry/group-deps_lock11_1.5.json.bin     |  1 -
 .../poetry/group-deps_lock11_1.5.xml.bin      |  1 -
 .../poetry/group-deps_lock20_1.2.json.bin     |  1 -
 .../poetry/group-deps_lock20_1.2.xml.bin      |  1 -
 .../poetry/group-deps_lock20_1.3.json.bin     |  1 -
 .../poetry/group-deps_lock20_1.3.xml.bin      |  1 -
 .../poetry/group-deps_lock20_1.4.json.bin     |  1 -
 .../poetry/group-deps_lock20_1.4.xml.bin      |  1 -
 .../poetry/group-deps_lock20_1.5.json.bin     |  1 -
 .../poetry/group-deps_lock20_1.5.xml.bin      |  1 -
 .../poetry/local_lock10_1.2.json.bin          |  1 -
 .../snapshots/poetry/local_lock10_1.2.xml.bin |  1 -
 .../poetry/local_lock10_1.3.json.bin          |  1 -
 .../snapshots/poetry/local_lock10_1.3.xml.bin |  1 -
 .../poetry/local_lock10_1.4.json.bin          |  1 -
 .../snapshots/poetry/local_lock10_1.4.xml.bin |  1 -
 .../poetry/local_lock10_1.5.json.bin          |  1 -
 .../snapshots/poetry/local_lock10_1.5.xml.bin |  1 -
 .../poetry/local_lock11_1.2.json.bin          |  1 -
 .../snapshots/poetry/local_lock11_1.2.xml.bin |  1 -
 .../poetry/local_lock11_1.3.json.bin          |  1 -
 .../snapshots/poetry/local_lock11_1.3.xml.bin |  1 -
 .../poetry/local_lock11_1.4.json.bin          |  1 -
 .../snapshots/poetry/local_lock11_1.4.xml.bin |  1 -
 .../poetry/local_lock11_1.5.json.bin          |  1 -
 .../snapshots/poetry/local_lock11_1.5.xml.bin |  1 -
 .../poetry/local_lock20_1.2.json.bin          |  1 -
 .../snapshots/poetry/local_lock20_1.2.xml.bin |  1 -
 .../poetry/local_lock20_1.3.json.bin          |  1 -
 .../snapshots/poetry/local_lock20_1.3.xml.bin |  1 -
 .../poetry/local_lock20_1.4.json.bin          |  1 -
 .../snapshots/poetry/local_lock20_1.4.xml.bin |  1 -
 .../poetry/local_lock20_1.5.json.bin          |  1 -
 .../snapshots/poetry/local_lock20_1.5.xml.bin |  1 -
 .../poetry/main-and-dev_lock10_1.2.json.bin   |  1 -
 .../poetry/main-and-dev_lock10_1.2.xml.bin    |  1 -
 .../poetry/main-and-dev_lock10_1.3.json.bin   |  1 -
 .../poetry/main-and-dev_lock10_1.3.xml.bin    |  1 -
 .../poetry/main-and-dev_lock10_1.4.json.bin   |  1 -
 .../poetry/main-and-dev_lock10_1.4.xml.bin    |  1 -
 .../poetry/main-and-dev_lock10_1.5.json.bin   |  1 -
 .../poetry/main-and-dev_lock10_1.5.xml.bin    |  1 -
 .../poetry/main-and-dev_lock11_1.2.json.bin   |  1 -
 .../poetry/main-and-dev_lock11_1.2.xml.bin    |  1 -
 .../poetry/main-and-dev_lock11_1.3.json.bin   |  1 -
 .../poetry/main-and-dev_lock11_1.3.xml.bin    |  1 -
 .../poetry/main-and-dev_lock11_1.4.json.bin   |  1 -
 .../poetry/main-and-dev_lock11_1.4.xml.bin    |  1 -
 .../poetry/main-and-dev_lock11_1.5.json.bin   |  1 -
 .../poetry/main-and-dev_lock11_1.5.xml.bin    |  1 -
 .../poetry/main-and-dev_lock20_1.2.json.bin   |  1 -
 .../poetry/main-and-dev_lock20_1.2.xml.bin    |  1 -
 .../poetry/main-and-dev_lock20_1.3.json.bin   |  1 -
 .../poetry/main-and-dev_lock20_1.3.xml.bin    |  1 -
 .../poetry/main-and-dev_lock20_1.4.json.bin   |  1 -
 .../poetry/main-and-dev_lock20_1.4.xml.bin    |  1 -
 .../poetry/main-and-dev_lock20_1.5.json.bin   |  1 -
 .../poetry/main-and-dev_lock20_1.5.xml.bin    |  1 -
 .../poetry/no-deps_lock20_1.2.json.bin        |  1 -
 .../poetry/no-deps_lock20_1.2.xml.bin         |  1 -
 .../poetry/no-deps_lock20_1.3.json.bin        |  1 -
 .../poetry/no-deps_lock20_1.3.xml.bin         |  1 -
 .../poetry/no-deps_lock20_1.4.json.bin        |  1 -
 .../poetry/no-deps_lock20_1.4.xml.bin         |  1 -
 .../poetry/no-deps_lock20_1.5.json.bin        |  1 -
 .../poetry/no-deps_lock20_1.5.xml.bin         |  1 -
 .../poetry/no-dev_lock11_1.2.json.bin         |  1 -
 .../poetry/no-dev_lock11_1.2.xml.bin          |  1 -
 .../poetry/no-dev_lock11_1.3.json.bin         |  1 -
 .../poetry/no-dev_lock11_1.3.xml.bin          |  1 -
 .../poetry/no-dev_lock11_1.4.json.bin         |  1 -
 .../poetry/no-dev_lock11_1.4.xml.bin          |  1 -
 .../poetry/no-dev_lock11_1.5.json.bin         |  1 -
 .../poetry/no-dev_lock11_1.5.xml.bin          |  1 -
 .../poetry/no-dev_lock20_1.2.json.bin         |  1 -
 .../poetry/no-dev_lock20_1.2.xml.bin          |  1 -
 .../poetry/no-dev_lock20_1.3.json.bin         |  1 -
 .../poetry/no-dev_lock20_1.3.xml.bin          |  1 -
 .../poetry/no-dev_lock20_1.4.json.bin         |  1 -
 .../poetry/no-dev_lock20_1.4.xml.bin          |  1 -
 .../poetry/no-dev_lock20_1.5.json.bin         |  1 -
 .../poetry/no-dev_lock20_1.5.xml.bin          |  1 -
 .../poetry/only-groups_lock11_1.2.json.bin    |  1 -
 .../poetry/only-groups_lock11_1.2.xml.bin     |  1 -
 .../poetry/only-groups_lock11_1.3.json.bin    |  1 -
 .../poetry/only-groups_lock11_1.3.xml.bin     |  1 -
 .../poetry/only-groups_lock11_1.4.json.bin    |  1 -
 .../poetry/only-groups_lock11_1.4.xml.bin     |  1 -
 .../poetry/only-groups_lock11_1.5.json.bin    |  1 -
 .../poetry/only-groups_lock11_1.5.xml.bin     |  1 -
 .../poetry/only-groups_lock20_1.2.json.bin    |  1 -
 .../poetry/only-groups_lock20_1.2.xml.bin     |  1 -
 .../poetry/only-groups_lock20_1.3.json.bin    |  1 -
 .../poetry/only-groups_lock20_1.3.xml.bin     |  1 -
 .../poetry/only-groups_lock20_1.4.json.bin    |  1 -
 .../poetry/only-groups_lock20_1.4.xml.bin     |  1 -
 .../poetry/only-groups_lock20_1.5.json.bin    |  1 -
 .../poetry/only-groups_lock20_1.5.xml.bin     |  1 -
 .../private-packges_lock10_1.2.json.bin       |  1 -
 .../poetry/private-packges_lock10_1.2.xml.bin |  1 -
 .../private-packges_lock10_1.3.json.bin       |  1 -
 .../poetry/private-packges_lock10_1.3.xml.bin |  1 -
 .../private-packges_lock10_1.4.json.bin       |  1 -
 .../poetry/private-packges_lock10_1.4.xml.bin |  1 -
 .../private-packges_lock10_1.5.json.bin       |  1 -
 .../poetry/private-packges_lock10_1.5.xml.bin |  1 -
 .../private-packges_lock11_1.2.json.bin       |  1 -
 .../poetry/private-packges_lock11_1.2.xml.bin |  1 -
 .../private-packges_lock11_1.3.json.bin       |  1 -
 .../poetry/private-packges_lock11_1.3.xml.bin |  1 -
 .../private-packges_lock11_1.4.json.bin       |  1 -
 .../poetry/private-packges_lock11_1.4.xml.bin |  1 -
 .../private-packges_lock11_1.5.json.bin       |  1 -
 .../poetry/private-packges_lock11_1.5.xml.bin |  1 -
 .../private-packges_lock20_1.2.json.bin       |  1 -
 .../poetry/private-packges_lock20_1.2.xml.bin |  1 -
 .../private-packges_lock20_1.3.json.bin       |  1 -
 .../poetry/private-packges_lock20_1.3.xml.bin |  1 -
 .../private-packges_lock20_1.4.json.bin       |  1 -
 .../poetry/private-packges_lock20_1.4.xml.bin |  1 -
 .../private-packges_lock20_1.5.json.bin       |  1 -
 .../poetry/private-packges_lock20_1.5.xml.bin |  1 -
 .../regression-issue611_lock20_1.2.json.bin   |  1 -
 .../regression-issue611_lock20_1.2.xml.bin    |  1 -
 .../regression-issue611_lock20_1.3.json.bin   |  1 -
 .../regression-issue611_lock20_1.3.xml.bin    |  1 -
 .../regression-issue611_lock20_1.4.json.bin   |  1 -
 .../regression-issue611_lock20_1.4.xml.bin    |  1 -
 .../regression-issue611_lock20_1.5.json.bin   |  1 -
 .../regression-issue611_lock20_1.5.xml.bin    |  1 -
 .../poetry/some-extras_lock10_1.2.json.bin    |  1 -
 .../poetry/some-extras_lock10_1.2.xml.bin     |  1 -
 .../poetry/some-extras_lock10_1.3.json.bin    |  1 -
 .../poetry/some-extras_lock10_1.3.xml.bin     |  1 -
 .../poetry/some-extras_lock10_1.4.json.bin    |  1 -
 .../poetry/some-extras_lock10_1.4.xml.bin     |  1 -
 .../poetry/some-extras_lock10_1.5.json.bin    |  1 -
 .../poetry/some-extras_lock10_1.5.xml.bin     |  1 -
 .../poetry/some-extras_lock11_1.2.json.bin    |  1 -
 .../poetry/some-extras_lock11_1.2.xml.bin     |  1 -
 .../poetry/some-extras_lock11_1.3.json.bin    |  1 -
 .../poetry/some-extras_lock11_1.3.xml.bin     |  1 -
 .../poetry/some-extras_lock11_1.4.json.bin    |  1 -
 .../poetry/some-extras_lock11_1.4.xml.bin     |  1 -
 .../poetry/some-extras_lock11_1.5.json.bin    |  1 -
 .../poetry/some-extras_lock11_1.5.xml.bin     |  1 -
 .../poetry/some-extras_lock20_1.2.json.bin    |  1 -
 .../poetry/some-extras_lock20_1.2.xml.bin     |  1 -
 .../poetry/some-extras_lock20_1.3.json.bin    |  1 -
 .../poetry/some-extras_lock20_1.3.xml.bin     |  1 -
 .../poetry/some-extras_lock20_1.4.json.bin    |  1 -
 .../poetry/some-extras_lock20_1.4.xml.bin     |  1 -
 .../poetry/some-extras_lock20_1.5.json.bin    |  1 -
 .../poetry/some-extras_lock20_1.5.xml.bin     |  1 -
 .../poetry/some-groups_lock11_1.2.json.bin    |  1 -
 .../poetry/some-groups_lock11_1.2.xml.bin     |  1 -
 .../poetry/some-groups_lock11_1.3.json.bin    |  1 -
 .../poetry/some-groups_lock11_1.3.xml.bin     |  1 -
 .../poetry/some-groups_lock11_1.4.json.bin    |  1 -
 .../poetry/some-groups_lock11_1.4.xml.bin     |  1 -
 .../poetry/some-groups_lock11_1.5.json.bin    |  1 -
 .../poetry/some-groups_lock11_1.5.xml.bin     |  1 -
 .../poetry/some-groups_lock20_1.2.json.bin    |  1 -
 .../poetry/some-groups_lock20_1.2.xml.bin     |  1 -
 .../poetry/some-groups_lock20_1.3.json.bin    |  1 -
 .../poetry/some-groups_lock20_1.3.xml.bin     |  1 -
 .../poetry/some-groups_lock20_1.4.json.bin    |  1 -
 .../poetry/some-groups_lock20_1.4.xml.bin     |  1 -
 .../poetry/some-groups_lock20_1.5.json.bin    |  1 -
 .../poetry/some-groups_lock20_1.5.xml.bin     |  1 -
 .../poetry/with-extras_lock10_1.2.json.bin    |  1 -
 .../poetry/with-extras_lock10_1.2.xml.bin     |  1 -
 .../poetry/with-extras_lock10_1.3.json.bin    |  1 -
 .../poetry/with-extras_lock10_1.3.xml.bin     |  1 -
 .../poetry/with-extras_lock10_1.4.json.bin    |  1 -
 .../poetry/with-extras_lock10_1.4.xml.bin     |  1 -
 .../poetry/with-extras_lock10_1.5.json.bin    |  1 -
 .../poetry/with-extras_lock10_1.5.xml.bin     |  1 -
 .../poetry/with-extras_lock11_1.2.json.bin    |  1 -
 .../poetry/with-extras_lock11_1.2.xml.bin     |  1 -
 .../poetry/with-extras_lock11_1.3.json.bin    |  1 -
 .../poetry/with-extras_lock11_1.3.xml.bin     |  1 -
 .../poetry/with-extras_lock11_1.4.json.bin    |  1 -
 .../poetry/with-extras_lock11_1.4.xml.bin     |  1 -
 .../poetry/with-extras_lock11_1.5.json.bin    |  1 -
 .../poetry/with-extras_lock11_1.5.xml.bin     |  1 -
 .../poetry/with-extras_lock20_1.2.json.bin    |  1 -
 .../poetry/with-extras_lock20_1.2.xml.bin     |  1 -
 .../poetry/with-extras_lock20_1.3.json.bin    |  1 -
 .../poetry/with-extras_lock20_1.3.xml.bin     |  1 -
 .../poetry/with-extras_lock20_1.4.json.bin    |  1 -
 .../poetry/with-extras_lock20_1.4.xml.bin     |  1 -
 .../poetry/with-extras_lock20_1.5.json.bin    |  1 -
 .../poetry/with-extras_lock20_1.5.xml.bin     |  1 -
 .../poetry/with-urls_lock10_1.2.json.bin      |  1 -
 .../poetry/with-urls_lock10_1.2.xml.bin       |  1 -
 .../poetry/with-urls_lock10_1.3.json.bin      |  1 -
 .../poetry/with-urls_lock10_1.3.xml.bin       |  1 -
 .../poetry/with-urls_lock10_1.4.json.bin      |  1 -
 .../poetry/with-urls_lock10_1.4.xml.bin       |  1 -
 .../poetry/with-urls_lock10_1.5.json.bin      |  1 -
 .../poetry/with-urls_lock10_1.5.xml.bin       |  1 -
 .../poetry/with-urls_lock11_1.2.json.bin      |  1 -
 .../poetry/with-urls_lock11_1.2.xml.bin       |  1 -
 .../poetry/with-urls_lock11_1.3.json.bin      |  1 -
 .../poetry/with-urls_lock11_1.3.xml.bin       |  1 -
 .../poetry/with-urls_lock11_1.4.json.bin      |  1 -
 .../poetry/with-urls_lock11_1.4.xml.bin       |  1 -
 .../poetry/with-urls_lock11_1.5.json.bin      |  1 -
 .../poetry/with-urls_lock11_1.5.xml.bin       |  1 -
 .../poetry/with-urls_lock20_1.2.json.bin      |  1 -
 .../poetry/with-urls_lock20_1.2.xml.bin       |  1 -
 .../poetry/with-urls_lock20_1.3.json.bin      |  1 -
 .../poetry/with-urls_lock20_1.3.xml.bin       |  1 -
 .../poetry/with-urls_lock20_1.4.json.bin      |  1 -
 .../poetry/with-urls_lock20_1.4.xml.bin       |  1 -
 .../poetry/with-urls_lock20_1.5.json.bin      |  1 -
 .../poetry/with-urls_lock20_1.5.xml.bin       |  1 -
 237 files changed, 57 insertions(+), 265 deletions(-)

diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 5c1f8835..77554cb2 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -216,11 +216,21 @@ def __add_components(self, bom: 'Bom',
             bom.metadata.component = root_c
 
         for component, requires in all_components.values():
-            # we know a lot of dependencies, but here we are only interested in those that are actually installed/found
-            requires_d: Iterable[Component] = filter(None,
-                                                     map(lambda r: all_components.get(r.name.lower(), (None,))[0],
-                                                         requires))
-            bom.register_dependency(component, requires_d)
+            component_deps: List[Component] = []
+            for req in requires:
+                req_component: Optional[Component] = all_components.get(req.name.lower(), (None,))[0]
+                if req_component is None:
+                    continue
+                if req_component is component:
+                    # circulars are a typical thing when extras require other extras
+                    continue
+                component_deps.append(req_component)
+                req_component.properties.update(
+                    Property(
+                        name=PropertyName.PackageExtra.value,
+                        value=extra
+                    ) for extra in req.extras)
+            bom.register_dependency(component, component_deps)
 
     @staticmethod
     def __py_interpreter(value: str) -> str:
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index b11513c3..1659f483 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -228,7 +228,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         po_cfg = project['tool']['poetry']
 
         bom.metadata.component = root_c = poetry2component(po_cfg, type=mc_type)
-        root_c.bom_ref.value = 'root-component'
+        root_c.bom_ref.value = root_c.name  # 'root-component'
         root_c.properties.update(Property(
             name=PropertyName.PackageExtra.value,
             value=extra
diff --git a/cyclonedx_py/_internal/utils/packaging.py b/cyclonedx_py/_internal/utils/packaging.py
index 70b412e1..a47496bf 100644
--- a/cyclonedx_py/_internal/utils/packaging.py
+++ b/cyclonedx_py/_internal/utils/packaging.py
@@ -57,13 +57,14 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#download-url
         ('Download-URL', ExternalReferenceType.DISTRIBUTION),
     ):
-        try:
-            yield ExternalReference(
-                comment=f'from packaging metadata: {meta_key}',
-                type=extref_typet,
-                url=XsUri(metadata[meta_key]))
-        except (KeyError, InvalidUriException):    # pragma: nocover
-            pass
+        if meta_key in metadata:
+            try:
+                yield ExternalReference(
+                    comment=f'from packaging metadata: {meta_key}',
+                    type=extref_typet,
+                    url=XsUri(metadata[meta_key]))
+            except InvalidUriException:  # pragma: nocover
+                pass
     for label_url in metadata.get_all('Project-URL', ()):
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#project-url-multiple-use
         label, url = label_url.split(',', maxsplit=1)
@@ -72,5 +73,5 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
                 comment=f'from packaging metadata Project-URL: {label}',
                 type=url_label_to_ert(label),
                 url=XsUri(url.strip()))
-        except InvalidUriException:   # pragma: nocover
+        except InvalidUriException:  # pragma: nocover
             pass
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index 61f33f0e..73744110 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -23,7 +23,7 @@
 See https://peps.python.org/pep-0621/
 """
 
-from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, Iterator, Tuple
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, Iterator
 
 if TYPE_CHECKING:
     from cyclonedx.factory.license import LicenseFactory
diff --git a/cyclonedx_py/_internal/utils/pyproject.py b/cyclonedx_py/_internal/utils/pyproject.py
index 8269669a..090ffe7d 100644
--- a/cyclonedx_py/_internal/utils/pyproject.py
+++ b/cyclonedx_py/_internal/utils/pyproject.py
@@ -15,7 +15,6 @@
 def pyproject2component(data: Dict[str, Any], *,
                         type: 'ComponentType') -> 'Component':
     tool = data.get('tool', {})
-    # TODO decide based on install engine
     if 'poetry' in tool:
         return poetry2component(tool['poetry'], type=type)
     if 'project' in data:
@@ -43,7 +42,6 @@ def pyproject_file2component(pyproject_file: str, *,
 
 def pyproject2dependencies(data: Dict[str, Any]) -> Iterator['Requirement']:
     tool = data.get('tool', {})
-    # TODO decide based on install engine
     if 'poetry' in tool:
         return poetry2dependencies(tool['poetry'])
     if 'project' in data:
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
index c719b39f..dddbc81c 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
@@ -880,9 +880,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
index 212270c7..43608693 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
@@ -702,9 +702,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
index c2b94778..3424594d 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
@@ -347,6 +347,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:required-extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.20.0",
       "type": "library",
       "version": "4.20.0"
@@ -880,9 +886,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
index 3df7b5ee..baedf474 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
@@ -296,6 +296,9 @@
           <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:required-extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
       <name>jsonschema-specifications</name>
@@ -705,9 +708,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
index 90a65cf5..c23c15e6 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
@@ -347,6 +347,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:required-extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.20.0",
       "type": "library",
       "version": "4.20.0"
@@ -880,9 +886,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
index 0813104f..09d4a4ae 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
@@ -323,6 +323,9 @@
           <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:required-extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
       <name>jsonschema-specifications</name>
@@ -732,9 +735,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
index 9477ed31..0ab017d3 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
@@ -347,6 +347,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:required-extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.20.0",
       "type": "library",
       "version": "4.20.0"
@@ -880,9 +886,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
index c547b7a8..41ed6c7a 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
@@ -323,6 +323,9 @@
           <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:required-extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
       <name>jsonschema-specifications</name>
@@ -732,9 +735,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
index 72561115..c38d1503 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
index 8fdb212f..f10cb0d6 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
index 7c9ce9ab..157f748d 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
@@ -314,7 +314,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
index f8a0a8d5..2847e441 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
index f90b33b5..969e50b9 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
@@ -314,7 +314,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
index 99a61427..f3a04fd6 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
index 155bcb7e..20114425 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
@@ -314,7 +314,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
index d9515fb0..bc128733 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
index 72561115..c38d1503 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
index 8fdb212f..f10cb0d6 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
index 5e7368e1..1788c354 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
index 085224be..329d1719 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
index 7e3db0bb..ddcaaea4 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
index 6bb8b4c3..466dab8f 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
index 2a23a3b3..275831e7 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
index d2f38aca..39623a12 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
index 2df1f738..d954129e 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
@@ -46,7 +46,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
index e4989cef..6969edfd 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
index 8b631e7f..24bb7ed6 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
@@ -70,7 +70,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
index 59b1587d..fa42bfa1 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
index 22dd7272..eb087833 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
@@ -70,7 +70,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
index c7fa4536..c67240de 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
index a6752f97..7f3deba0 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
@@ -70,7 +70,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
index c2e27207..7a494b2a 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
index eb07f486..b7e0f77a 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
@@ -64,7 +64,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
index 74bdf4f8..afbd5901 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
index 799ca196..c2131420 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
index 8c5b3db8..a5b780c9 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
index 9b7c5e77..2b7e6452 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
index 26fe0e86..b8e940d9 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
index 7abf6e76..0a0a832e 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
index 7c158e6b..f8d20acc 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
index eb07f486..b7e0f77a 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
@@ -64,7 +64,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
index 74bdf4f8..afbd5901 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
index 799ca196..c2131420 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
index 8c5b3db8..a5b780c9 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
index 9b7c5e77..2b7e6452 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
index 26fe0e86..b8e940d9 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
index 7abf6e76..0a0a832e 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
index 7c158e6b..f8d20acc 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
index eeff306d..18bd3d78 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
@@ -148,7 +148,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
index c444cea3..828f87d4 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
index 0b6c0c8f..d739394d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
@@ -238,7 +238,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
index ceefbe21..58185519 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
index 003e0d62..743b82d3 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
@@ -238,7 +238,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
index e084b603..881953d3 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
index 0110a1b6..5b288776 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
@@ -238,7 +238,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
index 5218aa98..469f4989 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
index 2e43e617..f5070a62 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
index 279a3f1d..2283fa1e 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
index 6bf2d91c..0cdad807 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
@@ -310,7 +310,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
index 8669b5f9..fe208c82 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
index dfe326a2..44cfe868 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
@@ -310,7 +310,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
index 01af8426..398ee4cf 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
index d4336606..2544d863 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
@@ -310,7 +310,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
index e9cfa7ff..42fb3d7d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
index 2e43e617..f5070a62 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
index 279a3f1d..2283fa1e 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
index e38ae0d9..df5a5cca 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
index 7d0eee4d..c487f600 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
index 775514f6..64905c9f 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
index afea6987..4a30b994 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
index 809b6e0a..f6c1cd2f 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
index 16dbc8d9..6c156072 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
index 568e0c09..9a294beb 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
index 6dbbe4bb..cfe88429 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
index 647522ce..ab0aff6c 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
index 57ffb583..e02223d7 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
index 036a231d..24180782 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
index b146d784..4da28db5 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
index fab602de..4e765a34 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
index 731a93f0..d329d28f 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
index 20d926a5..c4ed24b7 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
@@ -34,7 +34,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
index 0b4cbb8f..50e031a6 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
index b1963871..ab8c21a2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
index 862e229d..546a4a19 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
index 667fdaa3..35e48f2f 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
index 5f6bedbc..888872f2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
index f7dda794..3a00590e 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
index 69719a18..7c578aee 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
index 20d926a5..c4ed24b7 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
@@ -34,7 +34,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
index 0b4cbb8f..50e031a6 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
index b1963871..ab8c21a2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
index 862e229d..546a4a19 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
index 667fdaa3..35e48f2f 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
index 5f6bedbc..888872f2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
index f7dda794..3a00590e 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
index 69719a18..7c578aee 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
index 7ffeaf78..cb8be747 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
@@ -136,7 +136,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
index 3edba13c..6f6fc213 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
index bdc1dcc8..3ba3db46 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
@@ -230,7 +230,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
index c0883ed7..b756a06a 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
index 768780f6..bf42ec21 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
@@ -230,7 +230,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
index 3cceb16c..3b4ed18c 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
index 557f3a44..54a4bf3e 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
@@ -230,7 +230,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
index 426e4d09..c6402307 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
index 7ffeaf78..cb8be747 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
@@ -136,7 +136,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
index 3edba13c..6f6fc213 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
index 893677fa..3200fa58 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
@@ -202,7 +202,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
index b95ce7da..7e74e040 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
index 96529c93..576d18ad 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
@@ -202,7 +202,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
index 4f36ca4c..77e8944b 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
index dc07211d..9b387f20 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
@@ -202,7 +202,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
index 58279c6d..301cba77 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
index 074a680e..8d742ad5 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
@@ -58,7 +58,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
index 62f6a5a8..346d9e2b 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
index a59130b5..c9dd9774 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
index 5ed17059..5a14f0aa 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
index bc52832c..c48c39c8 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
index 573cce19..ae4187ec 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
index 9b392530..cdd0b94d 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
index 3b7bc58f..ff2b41d4 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
index 117389e7..bfbb0ebc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
@@ -579,7 +579,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
index bc8621a6..f80f5cc7 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
index fdab87d0..e5bb2314 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
@@ -1149,7 +1149,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
index 8446a2cf..828dd5ef 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
index 14a81265..a3f6ba9b 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
@@ -1149,7 +1149,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
index 2431430b..1d76c835 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
index 69c5b059..91aa48bd 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
@@ -1149,7 +1149,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
index a5d6bb77..29c8f6ea 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
index 117389e7..bfbb0ebc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
@@ -579,7 +579,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
index bc8621a6..f80f5cc7 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
index 30e9be4a..7d1cd297 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
@@ -1113,7 +1113,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
index 1cbf3707..7f1ed55f 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
index 734c8b91..67dd1ef0 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
@@ -1113,7 +1113,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
index 9824e0cc..b63cbe51 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
index 66414712..8e6f12fc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
@@ -1113,7 +1113,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
index bbbf7ebc..02737f3a 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
index 5b7ae2dc..048767d9 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
@@ -34,7 +34,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
index 624e73bb..bcd40111 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
index 0a2f3a87..76ed92c9 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
index e83010ac..f7455eb5 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
index 28b52532..3b9b0c87 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
index 3e2d37c0..3dc08218 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
index 3f07b200..ba019727 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
index fe3175ff..d1c75ff8 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
index 04879dc8..9fa9ff65 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
@@ -107,7 +107,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
index e20c5504..19802b19 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
index 5088af8b..b2c46da2 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
@@ -157,7 +157,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
index fa7050b3..c244f88f 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
index a04a5d1a..9d2c8300 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
@@ -157,7 +157,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
index cc4ba787..1f607a1b 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
index bfeaa928..913113e4 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
@@ -157,7 +157,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
index a23f8981..44355a61 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
index 6ea5df78..f9f876b3 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
@@ -1114,7 +1114,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
index d1cc5a31..c8224de0 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
index 8fe68cb9..c6f3eedd 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
@@ -2104,7 +2104,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
index f72b3a59..f6bbeb3e 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
index 3cb68473..04eeeac3 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
@@ -2104,7 +2104,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
index e44170fa..a8c170b9 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
index c37085fc..db2452cd 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
@@ -2104,7 +2104,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
index 0c8f6a82..528baa03 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
index 91dc7cd4..2a8d2398 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
@@ -1672,7 +1672,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
index fcdde56b..300bf5ad 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
index 6adc36ef..a6d6fd0d 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
@@ -3150,7 +3150,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
index ac579c1f..d93b0190 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
index 4ee45fb8..6eaa1df7 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
@@ -3150,7 +3150,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
index e5011131..30970c19 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
index 07814609..740ee9f9 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
@@ -3150,7 +3150,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
index c4effd6e..8735804d 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
index a7300a42..e58e8a4b 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
index 34de6cf4..c84c6d15 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
index 8bae5aea..91ac068e 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
@@ -318,7 +318,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
index af433927..6c118f5e 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
index 035b6d1c..a8029f73 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
@@ -318,7 +318,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
index 0362fc2f..87adbbd8 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
index 74c673a4..85902458 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
@@ -318,7 +318,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
index 370f7753..f9be05a1 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
index a7300a42..e58e8a4b 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
index 34de6cf4..c84c6d15 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
index 378bdc31..be2081c7 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
index a0ad8a44..9661ab11 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
index 742375a5..6b8eed0e 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
index c62a1516..2d97e3b7 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
index f13eb38d..84edcb56 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
index 8d3c8b2d..1ea3521a 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
index d16cccf9..64718d0c 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
index 274b72a8..00d95863 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
index a751b6ec..24199c42 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
index 8a925f4f..f26726dc 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
index a0628524..2666e3fa 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
index b4f8191b..0c32ddc5 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
index b1ba942b..b6a380f0 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
index d2ea971e..5df22f16 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
index d16cccf9..64718d0c 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
index 274b72a8..00d95863 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
index a751b6ec..24199c42 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
index 8a925f4f..f26726dc 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
index a0628524..2666e3fa 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
index b4f8191b..0c32ddc5 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
index b1ba942b..b6a380f0 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
index d2ea971e..5df22f16 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
index d16cccf9..64718d0c 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
index 274b72a8..00d95863 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
index a751b6ec..24199c42 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
index 8a925f4f..f26726dc 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
index a0628524..2666e3fa 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
index b4f8191b..0c32ddc5 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
index b1ba942b..b6a380f0 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
index d2ea971e..5df22f16 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
index 797b0a86..fdfd7f0b 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
@@ -91,7 +91,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
index b17b4642..89c29485 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
index 4e2d86ef..14c3ba63 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
@@ -123,7 +123,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
index ccd1a1be..28c2d00e 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
index 9ae1a00e..5a0767f9 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
@@ -123,7 +123,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
index a45c5c08..a57c21c3 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
index d0dc7b6c..ef00a489 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
@@ -123,7 +123,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
index e49d1d6e..0f696633 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
index 797b0a86..fdfd7f0b 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
@@ -91,7 +91,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
index b17b4642..89c29485 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
index f3213fc0..b4d0630d 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
@@ -131,7 +131,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
index 3011ef0d..ad79f909 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
index c6036268..daadddcc 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
@@ -131,7 +131,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
index c56d5f70..8d5dcfb8 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
index 602b7f77..1a98f44c 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
@@ -131,7 +131,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
index f32fabe2..8243784f 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
index 797b0a86..fdfd7f0b 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
@@ -91,7 +91,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
index b17b4642..89c29485 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
index 217b31e8..4b7970f5 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
@@ -143,7 +143,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
index 4d5a71a5..530aa048 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
index 51efd3c8..9d6e60d9 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
@@ -143,7 +143,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
index a9a79d94..e85e44d1 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
index 2204f69d..a90489ee 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
@@ -143,7 +143,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
index ad53ea7f..9c4228bb 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>

From 46278fd32e8ae32fa6111ef82cfbe1ee59c963b9 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 22:12:01 +0100
Subject: [PATCH 04/17] more

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .envrc                                        |   3 +
 cyclonedx_py/_internal/environment.py         |  88 ++++++++------
 cyclonedx_py/_internal/pipenv.py              |   2 +-
 cyclonedx_py/_internal/utils/poetry.py        |   2 +-
 pyproject.toml                                |   3 +
 .../infiles/environment/editable-self/init.py |   7 +-
 tests/_data/infiles/environment/local/init.py |   7 +-
 .../_data/infiles/environment/no-deps/init.py |   2 -
 .../infiles/environment/via-pipenv/Pipfile    |  18 +++
 .../environment/via-pipenv/Pipfile.lock       |  99 ++++++++++++++++
 .../infiles/environment/via-pipenv/init.py    |  44 +++++++
 .../environment/via-pipenv/pyproject.toml     |  42 +++++++
 .../infiles/environment/via-poetry/dummy.py   |   0
 .../infiles/environment/via-poetry/init.py    |  32 ++++++
 .../environment/via-poetry/poetry.lock        | 108 ++++++++++++++++++
 .../environment/via-poetry/poetry.toml        |   6 +
 .../environment/via-poetry/pyproject.toml     |  51 +++++++++
 .../infiles/environment/with-extras/init.py   |   4 +-
 .../infiles/environment/with-urls/init.py     |   7 +-
 tests/_data/infiles/pipenv/.envrc             |   6 +-
 tests/_data/infiles/poetry/.envrc             |   5 -
 .../environment/venv_via-pipenv_1.0.xml.bin   |  12 ++
 .../environment/venv_via-pipenv_1.1.xml.bin   |  22 ++++
 .../environment/venv_via-pipenv_1.2.json.bin  |  99 ++++++++++++++++
 .../environment/venv_via-pipenv_1.2.xml.bin   |  76 ++++++++++++
 .../environment/venv_via-pipenv_1.3.json.bin  | 105 +++++++++++++++++
 .../environment/venv_via-pipenv_1.3.xml.bin   |  79 +++++++++++++
 .../environment/venv_via-pipenv_1.4.json.bin  | 101 ++++++++++++++++
 .../environment/venv_via-pipenv_1.4.xml.bin   | 106 +++++++++++++++++
 .../environment/venv_via-pipenv_1.5.json.bin  | 101 ++++++++++++++++
 .../environment/venv_via-pipenv_1.5.xml.bin   | 106 +++++++++++++++++
 .../environment/venv_via-poetry_1.0.xml.bin   |  12 ++
 .../environment/venv_via-poetry_1.1.xml.bin   |  22 ++++
 .../environment/venv_via-poetry_1.2.json.bin  |  99 ++++++++++++++++
 .../environment/venv_via-poetry_1.2.xml.bin   |  76 ++++++++++++
 .../environment/venv_via-poetry_1.3.json.bin  | 105 +++++++++++++++++
 .../environment/venv_via-poetry_1.3.xml.bin   |  79 +++++++++++++
 .../environment/venv_via-poetry_1.4.json.bin  | 101 ++++++++++++++++
 .../environment/venv_via-poetry_1.4.xml.bin   | 106 +++++++++++++++++
 .../environment/venv_via-poetry_1.5.json.bin  | 101 ++++++++++++++++
 .../environment/venv_via-poetry_1.5.xml.bin   | 106 +++++++++++++++++
 tests/integration/test_cli_environment.py     |  23 ++--
 42 files changed, 2098 insertions(+), 75 deletions(-)
 create mode 100644 .envrc
 mode change 100755 => 100644 tests/_data/infiles/environment/editable-self/init.py
 mode change 100755 => 100644 tests/_data/infiles/environment/local/init.py
 mode change 100755 => 100644 tests/_data/infiles/environment/no-deps/init.py
 create mode 100644 tests/_data/infiles/environment/via-pipenv/Pipfile
 create mode 100644 tests/_data/infiles/environment/via-pipenv/Pipfile.lock
 create mode 100644 tests/_data/infiles/environment/via-pipenv/init.py
 create mode 100644 tests/_data/infiles/environment/via-pipenv/pyproject.toml
 create mode 100644 tests/_data/infiles/environment/via-poetry/dummy.py
 create mode 100644 tests/_data/infiles/environment/via-poetry/init.py
 create mode 100644 tests/_data/infiles/environment/via-poetry/poetry.lock
 create mode 100644 tests/_data/infiles/environment/via-poetry/poetry.toml
 create mode 100644 tests/_data/infiles/environment/via-poetry/pyproject.toml
 mode change 100755 => 100644 tests/_data/infiles/environment/with-extras/init.py
 mode change 100755 => 100644 tests/_data/infiles/environment/with-urls/init.py
 delete mode 100644 tests/_data/infiles/poetry/.envrc
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin

diff --git a/.envrc b/.envrc
new file mode 100644
index 00000000..72c4d136
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,3 @@
+# https://pipenv.pypa.io/en/latest/configuration.html
+export PIPENV_IGNORE_VIRTUALENVS=1
+
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 77554cb2..e11c35ea 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -28,6 +28,10 @@
     from cyclonedx.model.component import Component, ComponentType
     from packaging.requirements import Requirement
 
+    from .utils.pep610 import PackageSource
+
+    T_AllComponents = Dict[str, Tuple['Component', Iterable[Requirement]]]
+
 
 # !!! be as lazy loading as possible, as greedy as needed
 # TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
@@ -143,17 +147,14 @@ def __add_components(self, bom: 'Bom',
                          **kwargs: Any) -> None:
         from importlib.metadata import distributions
 
-        from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentType
-        from packageurl import PackageURL
         from packaging.requirements import Requirement
 
-        from . import PropertyName
         from .utils.cdx import licenses_fixup
         from .utils.packaging import metadata2extrefs, metadata2licenses
-        from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref, packagesource4dist
+        from .utils.pep610 import packagesource4dist
 
-        all_components: Dict[str, Tuple['Component', Iterable[Requirement]]] = {}
+        all_components: 'T_AllComponents' = {}
         self._logger.debug('distribution context args: %r', kwargs)
         self._logger.info('discovering distributions...')
         for dist in distributions(**kwargs):
@@ -170,35 +171,8 @@ def __add_components(self, bom: 'Bom',
                 external_references=metadata2extrefs(dist_meta),
                 # path of dist-package on disc? naaa... a package may have multiple files/folders on disc
             )
-            packagesource = packagesource4dist(dist)
-            purl_qs = {}  # https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
-            purl_subpath = None
-            if packagesource is not None:
-                if packagesource.subdirectory:
-                    component.properties.add(Property(name=PropertyName.PackageSourceSubdirectory.value,
-                                                      value=packagesource.subdirectory))
-                    purl_subpath = packagesource.subdirectory
-                if isinstance(packagesource, PackageSourceVcs):
-                    purl_qs['vcs_url'] = f'{packagesource.vcs}+{packagesource.url}@{packagesource.commit_id}'
-                    component.properties.add(Property(name=PropertyName.PackageSourceVcsCommitId.value,
-                                                      value=packagesource.commit_id))
-                    if packagesource.requested_revision:
-                        component.properties.add(Property(name=PropertyName.PackageSourceVcsRequestedRevision.value,
-                                                          value=packagesource.requested_revision))
-                elif isinstance(packagesource, PackageSourceArchive):
-                    if '://files.pythonhosted.org/' not in packagesource.url:
-                        # skip PURL bloat, do not add implicit information
-                        purl_qs['download_url'] = packagesource.url
-                packagesource_extref = packagesource2extref(packagesource)
-                if packagesource_extref is not None:
-                    component.external_references.add(packagesource_extref)
-                del packagesource_extref
-            if packagesource is None or not packagesource.url.startswith('file://'):
-                # no purl for locals and unpublished packages
-                component.purl = PackageURL('pypi', name=dist_name, version=dist_version,
-                                            qualifiers=purl_qs, subpath=purl_subpath)
-            del dist_meta, dist_name, dist_version, packagesource, purl_qs
-
+            del dist_meta, dist_name, dist_version
+            self.__component_add_extred_and_purl(component, packagesource4dist(dist))
             all_components[component.name.lower()] = component, map(Requirement, dist.requires or ())
 
             self._logger.info('add component for package %r', component.name)
@@ -214,6 +188,14 @@ def __add_components(self, bom: 'Bom',
                 del root_c_existed
             all_components[root_c_lcname] = rc
             bom.metadata.component = root_c
+            self._logger.debug('root-component: %r', root_c)
+
+        self.__finalize_dependencies(bom, all_components)
+
+    def __finalize_dependencies(self, bom: 'Bom', all_components: 'T_AllComponents') -> None:
+        from cyclonedx.model import Property
+
+        from . import PropertyName
 
         for component, requires in all_components.values():
             component_deps: List[Component] = []
@@ -229,9 +211,45 @@ def __add_components(self, bom: 'Bom',
                     Property(
                         name=PropertyName.PackageExtra.value,
                         value=extra
-                    ) for extra in req.extras)
+                    ) for extra in req.extras
+                )
             bom.register_dependency(component, component_deps)
 
+    def __component_add_extred_and_purl(self, component: 'Component',
+                                        packagesource: Optional['PackageSource']) -> None:
+        from cyclonedx.model import Property
+        from packageurl import PackageURL
+
+        from . import PropertyName
+        from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref
+
+        purl_qs = {}  # https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+        purl_subpath = None
+        if packagesource is not None:
+            if packagesource.subdirectory:
+                component.properties.add(Property(name=PropertyName.PackageSourceSubdirectory.value,
+                                                  value=packagesource.subdirectory))
+                purl_subpath = packagesource.subdirectory
+            if isinstance(packagesource, PackageSourceVcs):
+                purl_qs['vcs_url'] = f'{packagesource.vcs}+{packagesource.url}@{packagesource.commit_id}'
+                component.properties.add(Property(name=PropertyName.PackageSourceVcsCommitId.value,
+                                                  value=packagesource.commit_id))
+                if packagesource.requested_revision:
+                    component.properties.add(Property(name=PropertyName.PackageSourceVcsRequestedRevision.value,
+                                                      value=packagesource.requested_revision))
+            elif isinstance(packagesource, PackageSourceArchive):
+                if '://files.pythonhosted.org/' not in packagesource.url:
+                    # skip PURL bloat, do not add implicit information
+                    purl_qs['download_url'] = packagesource.url
+            packagesource_extref = packagesource2extref(packagesource)
+            if packagesource_extref is not None:
+                component.external_references.add(packagesource_extref)
+            del packagesource_extref
+        if packagesource is None or not packagesource.url.startswith('file://'):
+            # no purl for locals and unpublished packages
+            component.purl = PackageURL('pypi', name=component.name, version=component.version,
+                                        qualifiers=purl_qs, subpath=purl_subpath)
+
     @staticmethod
     def __py_interpreter(value: str) -> str:
         from os.path import exists, isdir, join
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 1c2de12c..9f89ec56 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -61,7 +61,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        type=arpaese_split((' ', ',')),
                        default=[])
         p.add_argument('-d', '--dev',
-                       help='both develop and default packages [env var: PIPENV_DEV]',
+                       help='Analyse both develop and default packages [env var: PIPENV_DEV]',
                        action='store_true',
                        dest='dev',
                        default=getenv('PIPENV_DEV', '').lower() in ('1', 'true', 'yes', 'on'))
diff --git a/cyclonedx_py/_internal/utils/poetry.py b/cyclonedx_py/_internal/utils/poetry.py
index c0349af9..dc5c1c31 100644
--- a/cyclonedx_py/_internal/utils/poetry.py
+++ b/cyclonedx_py/_internal/utils/poetry.py
@@ -94,7 +94,7 @@ def poetry2dependencies(poetry: Dict[str, Any]) -> Generator['Requirement', None
         poetry.get('dev-dependencies', {}).items(),
         chain.from_iterable(
             group.get('dependencies', {}).items()
-            for group in poetry.get('group', {}).items()
+            for group in poetry.get('group', {}).values()
         )
     ):
         req = Requirement(name)
diff --git a/pyproject.toml b/pyproject.toml
index 85a2bc69..6e972138 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -75,6 +75,9 @@ types-toml = "^0.10.0"
 setuptools = ">= 47.0.0"
 # `pip --python <...> install` needed fot setup/ini of test-beds
 pip = ">=22.3"
+# tools that may create venvs...
+pipenv = ">=2023.11.5"
+poetry = "*"  # the one from the host system is enough
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'
diff --git a/tests/_data/infiles/environment/editable-self/init.py b/tests/_data/infiles/environment/editable-self/init.py
old mode 100755
new mode 100644
index 5fe23576..6eefdae4
--- a/tests/_data/infiles/environment/editable-self/init.py
+++ b/tests/_data/infiles/environment/editable-self/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -12,7 +10,8 @@
 
 __all__ = ['main']
 
-env_dir = join(dirname(__file__), '.venv')
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
 
 
 def pip_install(*args: str) -> None:
@@ -24,7 +23,7 @@ def pip_install(*args: str) -> None:
         *args
     )
     print('+ ', *call)
-    check_call(call, shell=False)  # nosec:B603
+    check_call(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
 
 
 def main() -> None:
diff --git a/tests/_data/infiles/environment/local/init.py b/tests/_data/infiles/environment/local/init.py
old mode 100755
new mode 100644
index 507d3995..8fe5bb93
--- a/tests/_data/infiles/environment/local/init.py
+++ b/tests/_data/infiles/environment/local/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -12,7 +10,8 @@
 
 __all__ = ['main']
 
-env_dir = join(dirname(__file__), '.venv')
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
 
 localpackages_dir = abspath(join(dirname(__file__), '..', '..', '_helpers', 'local_pckages'))
 
@@ -26,7 +25,7 @@ def pip_install(*args: str) -> None:
         *args
     )
     print('+ ', *call)
-    check_call(call, shell=False)  # nosec:B603
+    check_call(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
 
 
 def main() -> None:
diff --git a/tests/_data/infiles/environment/no-deps/init.py b/tests/_data/infiles/environment/no-deps/init.py
old mode 100755
new mode 100644
index 1f18d264..537b90ab
--- a/tests/_data/infiles/environment/no-deps/init.py
+++ b/tests/_data/infiles/environment/no-deps/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
diff --git a/tests/_data/infiles/environment/via-pipenv/Pipfile b/tests/_data/infiles/environment/via-pipenv/Pipfile
new file mode 100644
index 00000000..0df0f6a2
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/Pipfile
@@ -0,0 +1,18 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+toml = ">=0.10.2, <0.11"
+
+[dev-packages]
+ddt = ">=1.6.0, <2"
+
+# custom catrogys/groups
+# see https://pipenv.pypa.io/en/latest/pipfile.html#package-category-groups
+
+[categoryB]
+colorama = ">=0.4.3"
+
+[groupA]
+isoduration = "==20.11.0"
+colorama = ">=0.4, <0.5"
diff --git a/tests/_data/infiles/environment/via-pipenv/Pipfile.lock b/tests/_data/infiles/environment/via-pipenv/Pipfile.lock
new file mode 100644
index 00000000..668b5145
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/Pipfile.lock
@@ -0,0 +1,99 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "89162a3ad75438bdbaf691099103dfacb02ee2d655ab1369b20abd1da4250457"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "categoryB": {
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        }
+    },
+    "default": {
+        "toml": {
+            "hashes": [
+                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
+                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==0.10.2"
+        }
+    },
+    "develop": {
+        "ddt": {
+            "hashes": [
+                "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114",
+                "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            ],
+            "index": "pypi",
+            "version": "==1.7.0"
+        }
+    },
+    "groupA": {
+        "arrow": {
+            "hashes": [
+                "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80",
+                "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==1.3.0"
+        },
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        },
+        "isoduration": {
+            "hashes": [
+                "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9",
+                "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '3.7'",
+            "version": "==20.11.0"
+        },
+        "python-dateutil": {
+            "hashes": [
+                "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
+                "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==2.8.2"
+        },
+        "six": {
+            "hashes": [
+                "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+                "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.16.0"
+        },
+        "types-python-dateutil": {
+            "hashes": [
+                "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b",
+                "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            ],
+            "version": "==2.8.19.14"
+        }
+    }
+}
diff --git a/tests/_data/infiles/environment/via-pipenv/init.py b/tests/_data/infiles/environment/via-pipenv/init.py
new file mode 100644
index 00000000..a413daa5
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/init.py
@@ -0,0 +1,44 @@
+"""
+initialize this testbed.
+"""
+
+from os.path import dirname, join
+from shutil import rmtree
+from subprocess import CompletedProcess, run  # nosec:B404
+from sys import executable
+
+__all__ = ['main']
+
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
+
+
+def pipenv_run(*args: str) -> CompletedProcess:
+    # pipenv is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pipenv',
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, cwd=this_dir, env={
+        'PIPENV_VENV_IN_PROJECT': '1',
+        'PIPENV_IGNORE_VIRTUALENVS': '1',
+        'PIPENV_NO_INHERIT': '1',
+        'PIPENV_NOSPIN': '1',
+        'PATH': '',  # existence is required for strange reasons
+    }, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def main() -> None:
+
+    rmtree(env_dir, ignore_errors=True)  # needed to reinit partially stripped evn
+    pipenv_run('install', '--deploy', '--no-site-packages')
+    # uninstall things that were coming with virtualenv, that were not wanted in the first place
+    pipenv_run('run', 'pip', 'uninstall', '--yes', 'wheel', 'setuptools', 'pip')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/via-pipenv/pyproject.toml b/tests/_data/infiles/environment/via-pipenv/pyproject.toml
new file mode 100644
index 00000000..e63d70d0
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/pyproject.toml
@@ -0,0 +1,42 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "via-pipenv"
+version = "0.1.0"
+description = "packages with all meta, and some deps"
+license = {text="Apache-2.0 OR MIT"}
+readme = "README.md"
+requires-python = ">=3.8"
+
+#  dynamic = [] # TODO
+
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+
+keywords = ["packaging", "pipenv", "test"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
+
+dependencies = [
+  'toml'
+]
+optional-dependencies = { 'foo'=['ddt'] }
+
+# entry-point = {} # TODO
+
+# gui-scripts = {} # TODO
+# scripts = {} # TODO
+
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
diff --git a/tests/_data/infiles/environment/via-poetry/dummy.py b/tests/_data/infiles/environment/via-poetry/dummy.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/_data/infiles/environment/via-poetry/init.py b/tests/_data/infiles/environment/via-poetry/init.py
new file mode 100644
index 00000000..dca1396e
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/init.py
@@ -0,0 +1,32 @@
+"""
+initialize this testbed.
+"""
+
+from os.path import dirname
+from subprocess import CompletedProcess, run  # nosec:B404
+from sys import executable
+
+__all__ = ['main']
+
+this_dir = dirname(__file__)
+
+
+def poetry_run(*args: str) -> CompletedProcess:
+    # Poetry is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'poetry',
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def main() -> None:
+    poetry_run('install', '--no-dev', '--no-interaction', '--sync')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/via-poetry/poetry.lock b/tests/_data/infiles/environment/via-poetry/poetry.lock
new file mode 100644
index 00000000..1798d72b
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/poetry.lock
@@ -0,0 +1,108 @@
+# This file is automatically @generated by Poetry 1.7.1 and should not be changed by hand.
+
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
+[[package]]
+name = "ddt"
+version = "1.7.0"
+description = "Data-Driven/Decorated Tests"
+optional = false
+python-versions = "*"
+files = [
+    {file = "ddt-1.7.0-py2.py3-none-any.whl", hash = "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"},
+    {file = "ddt-1.7.0.tar.gz", hash = "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"},
+]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+files = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+optional = false
+python-versions = "*"
+files = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.8"
+content-hash = "6d5a229d01cb18ed9d700fa82978fc270dcf6fee5187bb7b50d1f8040074445c"
diff --git a/tests/_data/infiles/environment/via-poetry/poetry.toml b/tests/_data/infiles/environment/via-poetry/poetry.toml
new file mode 100644
index 00000000..98ce2385
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/poetry.toml
@@ -0,0 +1,6 @@
+[virtualenvs]
+in-project = true
+[virtualenvs.options]
+no-pip = true
+no-setuptools = true
+system-site-packages = false
diff --git a/tests/_data/infiles/environment/via-poetry/pyproject.toml b/tests/_data/infiles/environment/via-poetry/pyproject.toml
new file mode 100644
index 00000000..223517a8
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/pyproject.toml
@@ -0,0 +1,51 @@
+[tool.poetry]
+## https://python-poetry.org/docs/pyproject/
+name = "via-poetry"
+license = "Apache-2.0 OR MIT"
+version = "0.1.0"
+description = "packages with all meta, and some deps"
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+keywords = ["packaging", "poetry", "test"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
+packages = [
+  { include = "dummy.py" }
+]
+
+[tool.poetry.urls]
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+[tool.poetry.dependencies]
+python = "^3.8"
+toml = "^0.10.2"
+
+[tool.poetry.group.dev.dependencies]
+ddt = "^1.6.0"
+
+[tool.poetry.group.groupB.dependencies]
+isoduration = "^20.10"
+
+[tool.poetry.group.groupA]
+optional = true
+
+[tool.poetry.group.groupA.dependencies]
+isoduration = "^20.11"
+colorama = "^0.4.6"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/environment/with-extras/init.py b/tests/_data/infiles/environment/with-extras/init.py
old mode 100755
new mode 100644
index 9f090d6a..253b0493
--- a/tests/_data/infiles/environment/with-extras/init.py
+++ b/tests/_data/infiles/environment/with-extras/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -26,7 +24,7 @@ def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, **kwargs, shell=False)  # nosec:B603
+    res = run(call, **kwargs, cwd=this_dir, env={}, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/infiles/environment/with-urls/init.py b/tests/_data/infiles/environment/with-urls/init.py
old mode 100755
new mode 100644
index ae264e1d..31e23f39
--- a/tests/_data/infiles/environment/with-urls/init.py
+++ b/tests/_data/infiles/environment/with-urls/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -8,7 +6,6 @@
 from os.path import dirname, join
 from subprocess import CompletedProcess, run  # nosec:B404
 from sys import executable
-from typing import Any
 from venv import EnvBuilder
 
 __all__ = ['main']
@@ -17,7 +14,7 @@
 env_dir = join(this_dir, '.venv')
 
 
-def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
+def pip_run(*args: str) -> CompletedProcess:
     # pip is not API, but a CLI -- call it like that!
     call = (
         executable, '-m', 'pip',
@@ -25,7 +22,7 @@ def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, **kwargs, shell=False)  # nosec:B603
+    res = run(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/infiles/pipenv/.envrc b/tests/_data/infiles/pipenv/.envrc
index 213e1725..72c4d136 100644
--- a/tests/_data/infiles/pipenv/.envrc
+++ b/tests/_data/infiles/pipenv/.envrc
@@ -1,5 +1,3 @@
 # https://pipenv.pypa.io/en/latest/configuration.html
-export PIPENV_VENV_IN_PROJECT=1
-export PIPENV_SITE_PACKAGES=0
-export PIPENV_DEV=1
-export PIPENV_NO_INHERIT=1
+export PIPENV_IGNORE_VIRTUALENVS=1
+
diff --git a/tests/_data/infiles/poetry/.envrc b/tests/_data/infiles/poetry/.envrc
deleted file mode 100644
index 381b3157..00000000
--- a/tests/_data/infiles/poetry/.envrc
+++ /dev/null
@@ -1,5 +0,0 @@
-# https://python-poetry.org/docs/configuration/#using-environment-variables
-export POETRY_VIRTUALENVS_IN_PROJECT=1
-export POETRY_VIRTUALENVS_OPTIONS_NO_PIP=1
-export POETRY_VIRTUALENVS_OPTIONS_NO_SETUPTOOLS=1
-export POETRY_VIRTUALENVS_OPTIONS_SYSTEM_SITE_PACKAGES=0
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin
new file mode 100644
index 00000000..2316393a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin
new file mode 100644
index 00000000..31bbeab3
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin
new file mode 100644
index 00000000..b834d0c1
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin
@@ -0,0 +1,99 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin
new file mode 100644
index 00000000..1efec495
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin
@@ -0,0 +1,76 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin
new file mode 100644
index 00000000..96f86ca8
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin
@@ -0,0 +1,105 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin
new file mode 100644
index 00000000..91b0d73d
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin
new file mode 100644
index 00000000..1fe8a128
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin
new file mode 100644
index 00000000..7717aa82
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin
new file mode 100644
index 00000000..ba06f83c
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin
new file mode 100644
index 00000000..4e309e52
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin
new file mode 100644
index 00000000..2316393a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin
new file mode 100644
index 00000000..31bbeab3
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin
new file mode 100644
index 00000000..81fea90f
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin
@@ -0,0 +1,99 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin
new file mode 100644
index 00000000..2dd144db
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin
@@ -0,0 +1,76 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin
new file mode 100644
index 00000000..54a91215
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin
@@ -0,0 +1,105 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin
new file mode 100644
index 00000000..a1ec9fa9
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin
new file mode 100644
index 00000000..b4255d0a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin
new file mode 100644
index 00000000..64dcc67e
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin
new file mode 100644
index 00000000..942d9e23
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin
new file mode 100644
index 00000000..709ba71f
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
index 11540fc9..6b2e96f9 100644
--- a/tests/integration/test_cli_environment.py
+++ b/tests/integration/test_cli_environment.py
@@ -33,11 +33,9 @@
 from tests import INFILES_DIRECTORY, INIT_TESTBEDS, SUPPORTED_OF_SV, SnapshotMixin, make_comparable
 
 initfiles = glob(join(INFILES_DIRECTORY, 'environment', '*', 'init.py'))
-projectdirs = list(dirname(initfile) for initfile in initfiles)
-
 test_data = tuple(
     (f'{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
-    for projectdir in projectdirs
+    for projectdir in (dirname(initfile) for initfile in initfiles)
     for of, sv in SUPPORTED_OF_SV
 )
 
@@ -49,17 +47,20 @@ def test_data_file_filter(s: str) -> Generator[Any, None, None]:
 @ddt
 class TestCliEnvironment(TestCase, SnapshotMixin):
 
+    @classmethod
+    def __setup_testbeds_init(cls) -> None:
+        for initfile in initfiles:
+            print('setup init testbed:', initfile)
+            res = run((executable, initfile),
+                      capture_output=True, encoding='utf8', shell=False)  # nosec:B603
+            if res.returncode != 0:
+                raise RuntimeError(
+                    f'failed init: {initfile}\nstdout: {res.stdout}\nstderr: {res.stderr}\n')
+
     @classmethod
     def setUpClass(cls) -> None:
         if INIT_TESTBEDS:
-            for initfile in initfiles:
-                print('setup environment testbed:', initfile)
-                res = run([executable, initfile],
-                          capture_output=True, encoding='utf8', shell=False)  # nosec:B603
-                if res.returncode != 0:
-                    raise RuntimeError(f'failed init :\n'
-                                       f'stdout: {res.stdout}\n'
-                                       f'stderr: {res.stderr}\n')
+            cls.__setup_testbeds_init()
 
     @named_data(
         ('does-not-exist', 'something-that-must-not-exist.testing', 'No such file or directory'),

From 6e66ffd215f4d7a867740b3978eaf097b0299831 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 22:18:07 +0100
Subject: [PATCH 05/17] refacto

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/integration/test_cli_environment.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
index 6b2e96f9..fff6fc12 100644
--- a/tests/integration/test_cli_environment.py
+++ b/tests/integration/test_cli_environment.py
@@ -35,7 +35,7 @@
 initfiles = glob(join(INFILES_DIRECTORY, 'environment', '*', 'init.py'))
 test_data = tuple(
     (f'{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
-    for projectdir in (dirname(initfile) for initfile in initfiles)
+    for projectdir in map(dirname, initfiles)
     for of, sv in SUPPORTED_OF_SV
 )
 

From 1cbab36d99a40c8643d40a2b190b3d35d00da1ee Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 23:51:32 +0100
Subject: [PATCH 06/17] win tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml                                |  3 +-
 .../infiles/environment/editable-self/init.py |  2 +-
 tests/_data/infiles/environment/local/init.py |  2 +-
 .../infiles/environment/via-pipenv/init.py    | 28 +++++++++++++++----
 .../infiles/environment/via-poetry/init.py    |  8 ++++--
 .../infiles/environment/with-extras/init.py   |  2 +-
 .../infiles/environment/with-urls/init.py     |  2 +-
 .../environment/venv_local_1.3.json.bin       | 12 --------
 .../environment/venv_local_1.3.xml.bin        |  6 ----
 .../environment/venv_local_1.4.json.bin       | 12 --------
 .../environment/venv_local_1.4.xml.bin        |  6 ----
 .../environment/venv_local_1.5.json.bin       | 12 --------
 .../environment/venv_local_1.5.xml.bin        |  6 ----
 .../environment/venv_with-urls_1.3.json.bin   | 12 --------
 .../environment/venv_with-urls_1.3.xml.bin    |  6 ----
 .../environment/venv_with-urls_1.4.json.bin   | 12 --------
 .../environment/venv_with-urls_1.4.xml.bin    |  6 ----
 .../environment/venv_with-urls_1.5.json.bin   | 12 --------
 .../environment/venv_with-urls_1.5.xml.bin    |  6 ----
 tests/integration/test_cli_environment.py     |  2 +-
 20 files changed, 35 insertions(+), 122 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 6e972138..11eef518 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -74,8 +74,7 @@ types-toml = "^0.10.0"
 # see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
 setuptools = ">= 47.0.0"
 # `pip --python <...> install` needed fot setup/ini of test-beds
-pip = ">=22.3"
-# tools that may create venvs...
+pip = ">=22.0"
 pipenv = ">=2023.11.5"
 poetry = "*"  # the one from the host system is enough
 
diff --git a/tests/_data/infiles/environment/editable-self/init.py b/tests/_data/infiles/environment/editable-self/init.py
index 6eefdae4..a3a7d080 100644
--- a/tests/_data/infiles/environment/editable-self/init.py
+++ b/tests/_data/infiles/environment/editable-self/init.py
@@ -23,7 +23,7 @@ def pip_install(*args: str) -> None:
         *args
     )
     print('+ ', *call)
-    check_call(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
+    check_call(call, cwd=this_dir, shell=False)  # nosec:B603
 
 
 def main() -> None:
diff --git a/tests/_data/infiles/environment/local/init.py b/tests/_data/infiles/environment/local/init.py
index 8fe5bb93..7bfa4f1d 100644
--- a/tests/_data/infiles/environment/local/init.py
+++ b/tests/_data/infiles/environment/local/init.py
@@ -25,7 +25,7 @@ def pip_install(*args: str) -> None:
         *args
     )
     print('+ ', *call)
-    check_call(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
+    check_call(call, cwd=this_dir, shell=False)  # nosec:B603
 
 
 def main() -> None:
diff --git a/tests/_data/infiles/environment/via-pipenv/init.py b/tests/_data/infiles/environment/via-pipenv/init.py
index a413daa5..490e371e 100644
--- a/tests/_data/infiles/environment/via-pipenv/init.py
+++ b/tests/_data/infiles/environment/via-pipenv/init.py
@@ -2,10 +2,12 @@
 initialize this testbed.
 """
 
+from os import environ
 from os.path import dirname, join
 from shutil import rmtree
 from subprocess import CompletedProcess, run  # nosec:B404
 from sys import executable
+from typing import Any
 
 __all__ = ['main']
 
@@ -20,24 +22,40 @@ def pipenv_run(*args: str) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, cwd=this_dir, env={
+    res = run(call, cwd=this_dir, env=environ | {
         'PIPENV_VENV_IN_PROJECT': '1',
         'PIPENV_IGNORE_VIRTUALENVS': '1',
         'PIPENV_NO_INHERIT': '1',
         'PIPENV_NOSPIN': '1',
-        'PATH': '',  # existence is required for strange reasons
-    }, shell=False)  # nosec:B603
+    }, shell=True)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
+    # pip is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pip',
+        '--python', env_dir,
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, **kwargs, cwd=this_dir, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
 
 
 def main() -> None:
+    # needed to reinit partially stripped evn
+    rmtree(env_dir, ignore_errors=True)
 
-    rmtree(env_dir, ignore_errors=True)  # needed to reinit partially stripped evn
+    # the actual setuo
     pipenv_run('install', '--deploy', '--no-site-packages')
+
     # uninstall things that were coming with virtualenv, that were not wanted in the first place
-    pipenv_run('run', 'pip', 'uninstall', '--yes', 'wheel', 'setuptools', 'pip')
+    pip_run('uninstall', '--require-virtualenv', '--no-input', '--yes', 'wheel', 'setuptools', 'pip')
 
 
 if __name__ == '__main__':
diff --git a/tests/_data/infiles/environment/via-poetry/init.py b/tests/_data/infiles/environment/via-poetry/init.py
index dca1396e..aa593be0 100644
--- a/tests/_data/infiles/environment/via-poetry/init.py
+++ b/tests/_data/infiles/environment/via-poetry/init.py
@@ -2,6 +2,7 @@
 initialize this testbed.
 """
 
+from os import environ
 from os.path import dirname
 from subprocess import CompletedProcess, run  # nosec:B404
 from sys import executable
@@ -18,14 +19,17 @@ def poetry_run(*args: str) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
+    res = run(call, cwd=this_dir, env=environ | {
+        'VIRTUAL_ENV': '',
+    }, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
 
 
 def main() -> None:
-    poetry_run('install', '--no-dev', '--no-interaction', '--sync')
+    poetry_run('install', '--no-dev', '--sync',
+               '--no-interaction', '--no-ansi')
 
 
 if __name__ == '__main__':
diff --git a/tests/_data/infiles/environment/with-extras/init.py b/tests/_data/infiles/environment/with-extras/init.py
index 253b0493..c189c62e 100644
--- a/tests/_data/infiles/environment/with-extras/init.py
+++ b/tests/_data/infiles/environment/with-extras/init.py
@@ -24,7 +24,7 @@ def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, **kwargs, cwd=this_dir, env={}, shell=False)  # nosec:B603
+    res = run(call, **kwargs, cwd=this_dir, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/infiles/environment/with-urls/init.py b/tests/_data/infiles/environment/with-urls/init.py
index 31e23f39..a19c91ad 100644
--- a/tests/_data/infiles/environment/with-urls/init.py
+++ b/tests/_data/infiles/environment/with-urls/init.py
@@ -22,7 +22,7 @@ def pip_run(*args: str) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, cwd=this_dir, env={}, shell=False)  # nosec:B603
+    res = run(call, cwd=this_dir, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.json.bin b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
index 3e09434a..265d652d 100644
--- a/tests/_data/snapshots/environment/venv_local_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
@@ -6,12 +6,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
-            }
-          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
         }
@@ -33,12 +27,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
-            }
-          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
         }
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
index 9c663c20..bac3bb3f 100644
--- a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
@@ -36,9 +36,6 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
-          </hashes>
         </reference>
       </externalReferences>
     </component>
@@ -55,9 +52,6 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
-          </hashes>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.json.bin b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
index e6298492..7f96bcc6 100644
--- a/tests/_data/snapshots/environment/venv_local_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
@@ -6,12 +6,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
-            }
-          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
         }
@@ -33,12 +27,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
-            }
-          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
         }
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
index c3ad1442..ed18d84d 100644
--- a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
@@ -63,9 +63,6 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
-          </hashes>
         </reference>
       </externalReferences>
     </component>
@@ -82,9 +79,6 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
-          </hashes>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.json.bin b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
index 948eeb0b..4e467887 100644
--- a/tests/_data/snapshots/environment/venv_local_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
@@ -6,12 +6,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
-            }
-          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
         }
@@ -33,12 +27,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
-            }
-          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
         }
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
index 13138e0a..6a78016f 100644
--- a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
@@ -63,9 +63,6 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
-          </hashes>
         </reference>
       </externalReferences>
     </component>
@@ -82,9 +79,6 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
-          </hashes>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
index 37ed42b1..65a504e1 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
@@ -41,12 +41,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
@@ -74,12 +68,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
-            }
-          ],
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
index 76e947dc..29657733 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
@@ -61,9 +61,6 @@
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
@@ -85,9 +82,6 @@
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
-          </hashes>
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
index dd7ac2ae..5c824b14 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
@@ -41,12 +41,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
@@ -74,12 +68,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
-            }
-          ],
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
index a050a70a..74d82538 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
@@ -88,9 +88,6 @@
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
@@ -112,9 +109,6 @@
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
-          </hashes>
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
index cbeba0ac..37349d0d 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
@@ -41,12 +41,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
@@ -74,12 +68,6 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
-            }
-          ],
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
index c962bfd9..4a3f09dd 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
@@ -88,9 +88,6 @@
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
@@ -112,9 +109,6 @@
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
           <comment>PackageSource: Archive</comment>
-          <hashes>
-            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
-          </hashes>
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
index 6b2e96f9..aa3b287e 100644
--- a/tests/integration/test_cli_environment.py
+++ b/tests/integration/test_cli_environment.py
@@ -52,7 +52,7 @@ def __setup_testbeds_init(cls) -> None:
         for initfile in initfiles:
             print('setup init testbed:', initfile)
             res = run((executable, initfile),
-                      capture_output=True, encoding='utf8', shell=False)  # nosec:B603
+                      capture_output=True, encoding='utf8', errors='replace', shell=False)  # nosec:B603
             if res.returncode != 0:
                 raise RuntimeError(
                     f'failed init: {initfile}\nstdout: {res.stdout}\nstderr: {res.stderr}\n')

From 6989d2603e9aa382ff08ace29e09fdd1b46a9deb Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 23 Dec 2023 23:55:57 +0100
Subject: [PATCH 07/17] tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../snapshots/environment/venv_local_1.3.json.bin    | 12 ++++++++++++
 .../snapshots/environment/venv_local_1.3.xml.bin     |  6 ++++++
 .../snapshots/environment/venv_local_1.4.json.bin    | 12 ++++++++++++
 .../snapshots/environment/venv_local_1.4.xml.bin     |  6 ++++++
 .../snapshots/environment/venv_local_1.5.json.bin    | 12 ++++++++++++
 .../snapshots/environment/venv_local_1.5.xml.bin     |  6 ++++++
 .../environment/venv_with-urls_1.3.json.bin          | 12 ++++++++++++
 .../snapshots/environment/venv_with-urls_1.3.xml.bin |  6 ++++++
 .../environment/venv_with-urls_1.4.json.bin          | 12 ++++++++++++
 .../snapshots/environment/venv_with-urls_1.4.xml.bin |  6 ++++++
 .../environment/venv_with-urls_1.5.json.bin          | 12 ++++++++++++
 .../snapshots/environment/venv_with-urls_1.5.xml.bin |  6 ++++++
 12 files changed, 108 insertions(+)

diff --git a/tests/_data/snapshots/environment/venv_local_1.3.json.bin b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
index 265d652d..3e09434a 100644
--- a/tests/_data/snapshots/environment/venv_local_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
@@ -6,6 +6,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
+            }
+          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
         }
@@ -27,6 +33,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
+            }
+          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
         }
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
index bac3bb3f..9c663c20 100644
--- a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
@@ -36,6 +36,9 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
+          </hashes>
         </reference>
       </externalReferences>
     </component>
@@ -52,6 +55,9 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
+          </hashes>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.json.bin b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
index 7f96bcc6..e6298492 100644
--- a/tests/_data/snapshots/environment/venv_local_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
@@ -6,6 +6,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
+            }
+          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
         }
@@ -27,6 +33,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
+            }
+          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
         }
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
index ed18d84d..c3ad1442 100644
--- a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
@@ -63,6 +63,9 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
+          </hashes>
         </reference>
       </externalReferences>
     </component>
@@ -79,6 +82,9 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
+          </hashes>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.json.bin b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
index 4e467887..948eeb0b 100644
--- a/tests/_data/snapshots/environment/venv_local_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
@@ -6,6 +6,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
+            }
+          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
         }
@@ -27,6 +33,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
+            }
+          ],
           "type": "distribution",
           "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
         }
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
index 6a78016f..13138e0a 100644
--- a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
@@ -63,6 +63,9 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
+          </hashes>
         </reference>
       </externalReferences>
     </component>
@@ -79,6 +82,9 @@
         <reference type="distribution">
           <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
+          </hashes>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
index 65a504e1..37ed42b1 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
@@ -41,6 +41,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
@@ -68,6 +74,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
index 29657733..76e947dc 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
@@ -61,6 +61,9 @@
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
@@ -82,6 +85,9 @@
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
+          </hashes>
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
index 5c824b14..dd7ac2ae 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
@@ -41,6 +41,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
@@ -68,6 +74,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
index 74d82538..a050a70a 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
@@ -88,6 +88,9 @@
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
@@ -109,6 +112,9 @@
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
+          </hashes>
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
index 37349d0d..cbeba0ac 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
@@ -41,6 +41,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
@@ -68,6 +74,12 @@
       "externalReferences": [
         {
           "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
index 4a3f09dd..c962bfd9 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
@@ -88,6 +88,9 @@
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
@@ -109,6 +112,9 @@
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
           <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
+          </hashes>
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>

From 610dac07cb347c680fd929f99d100da16a3bb254 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:11:46 +0100
Subject: [PATCH 08/17] ff

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

From bd993e42c9e46632bc84735565ea9c135f703a7a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:22:20 +0100
Subject: [PATCH 09/17] try pinning foo

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 11eef518..80433314 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -73,10 +73,10 @@ types-toml = "^0.10.0"
 # min version required to be able to install some dependencies
 # see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
 setuptools = ">= 47.0.0"
-# `pip --python <...> install` needed fot setup/ini of test-beds
-pip = ">=22.0"
+# install` needed fot setup/ini of test-beds
+pip = ">=23.0"
 pipenv = ">=2023.11.5"
-poetry = "*"  # the one from the host system is enough
+poetry = "^1.7"  # the one from the host system is enough
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'

From 615ca2e87b4319ca8eca96d8bd329cab468e943e Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:25:37 +0100
Subject: [PATCH 10/17] poetry conf

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 poetry.toml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 poetry.toml

diff --git a/poetry.toml b/poetry.toml
new file mode 100644
index 00000000..c3cbc30e
--- /dev/null
+++ b/poetry.toml
@@ -0,0 +1,6 @@
+[virtualenvs]
+in-project = true
+[virtualenvs.options]
+# these are already dev-dependencies, and therefore will come as needed
+no-pip = true
+no-setuptools = true

From 0c05a3c38572fad365046b180e3362fe213cf6f1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:26:43 +0100
Subject: [PATCH 11/17] poetry conf

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 poetry.toml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/poetry.toml b/poetry.toml
index c3cbc30e..923245be 100644
--- a/poetry.toml
+++ b/poetry.toml
@@ -1,5 +1,3 @@
-[virtualenvs]
-in-project = true
 [virtualenvs.options]
 # these are already dev-dependencies, and therefore will come as needed
 no-pip = true

From 973d904c0ec50fc2ee544434f3a732018522ced7 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:33:58 +0100
Subject: [PATCH 12/17] blubb

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 poetry.toml                                        | 2 ++
 tests/_data/infiles/environment/via-pipenv/init.py | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/poetry.toml b/poetry.toml
index 923245be..1865fc64 100644
--- a/poetry.toml
+++ b/poetry.toml
@@ -1,4 +1,6 @@
+
 [virtualenvs.options]
+system-site-packages = false
 # these are already dev-dependencies, and therefore will come as needed
 no-pip = true
 no-setuptools = true
diff --git a/tests/_data/infiles/environment/via-pipenv/init.py b/tests/_data/infiles/environment/via-pipenv/init.py
index 490e371e..624cfccf 100644
--- a/tests/_data/infiles/environment/via-pipenv/init.py
+++ b/tests/_data/infiles/environment/via-pipenv/init.py
@@ -27,7 +27,7 @@ def pipenv_run(*args: str) -> CompletedProcess:
         'PIPENV_IGNORE_VIRTUALENVS': '1',
         'PIPENV_NO_INHERIT': '1',
         'PIPENV_NOSPIN': '1',
-    }, shell=True)  # nosec:B603
+    }, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res

From ff894e9561d4dd4545803bfa6f766360b0dc8c59 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:50:44 +0100
Subject: [PATCH 13/17] py38

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/infiles/environment/via-pipenv/init.py | 13 +++++++------
 tests/_data/infiles/environment/via-poetry/init.py |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/tests/_data/infiles/environment/via-pipenv/init.py b/tests/_data/infiles/environment/via-pipenv/init.py
index 624cfccf..2b89aaf1 100644
--- a/tests/_data/infiles/environment/via-pipenv/init.py
+++ b/tests/_data/infiles/environment/via-pipenv/init.py
@@ -14,6 +14,12 @@
 this_dir = dirname(__file__)
 env_dir = join(this_dir, '.venv')
 
+pipenv_env = environ.copy()
+pipenv_env['PIPENV_VENV_IN_PROJECT'] = '1'
+pipenv_env['PIPENV_IGNORE_VIRTUALENVS'] = '1'
+pipenv_env['PIPENV_NO_INHERIT'] = '1'
+pipenv_env['PIPENV_NOSPIN'] = '1'
+
 
 def pipenv_run(*args: str) -> CompletedProcess:
     # pipenv is not API, but a CLI -- call it like that!
@@ -22,12 +28,7 @@ def pipenv_run(*args: str) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, cwd=this_dir, env=environ | {
-        'PIPENV_VENV_IN_PROJECT': '1',
-        'PIPENV_IGNORE_VIRTUALENVS': '1',
-        'PIPENV_NO_INHERIT': '1',
-        'PIPENV_NOSPIN': '1',
-    }, shell=False)  # nosec:B603
+    res = run(call, cwd=this_dir, env=pipenv_env, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/infiles/environment/via-poetry/init.py b/tests/_data/infiles/environment/via-poetry/init.py
index aa593be0..a6db7aca 100644
--- a/tests/_data/infiles/environment/via-poetry/init.py
+++ b/tests/_data/infiles/environment/via-poetry/init.py
@@ -19,7 +19,7 @@ def poetry_run(*args: str) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, cwd=this_dir, env=environ | {
+    res = run(call, cwd=this_dir, env=dict(environ) | {
         'VIRTUAL_ENV': '',
     }, shell=False)  # nosec:B603
     if res.returncode != 0:

From 65fe3ec4d66346870d4a5a0407fc16faee9a8c96 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:54:28 +0100
Subject: [PATCH 14/17] py38

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/infiles/environment/via-poetry/init.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/_data/infiles/environment/via-poetry/init.py b/tests/_data/infiles/environment/via-poetry/init.py
index a6db7aca..b313719c 100644
--- a/tests/_data/infiles/environment/via-poetry/init.py
+++ b/tests/_data/infiles/environment/via-poetry/init.py
@@ -12,6 +12,9 @@
 this_dir = dirname(__file__)
 
 
+poetry_env = environ.copy()
+poetry_env['VIRTUAL_ENV'] = ''
+
 def poetry_run(*args: str) -> CompletedProcess:
     # Poetry is not API, but a CLI -- call it like that!
     call = (
@@ -19,9 +22,7 @@ def poetry_run(*args: str) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, cwd=this_dir, env=dict(environ) | {
-        'VIRTUAL_ENV': '',
-    }, shell=False)  # nosec:B603
+    res = run(call, cwd=this_dir, env=poetry_env, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res

From 427dfcbcc62c9600e5ece7d7f9db6ed924050784 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 00:55:57 +0100
Subject: [PATCH 15/17] style

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/infiles/environment/via-poetry/init.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/_data/infiles/environment/via-poetry/init.py b/tests/_data/infiles/environment/via-poetry/init.py
index b313719c..7decdf04 100644
--- a/tests/_data/infiles/environment/via-poetry/init.py
+++ b/tests/_data/infiles/environment/via-poetry/init.py
@@ -15,6 +15,7 @@
 poetry_env = environ.copy()
 poetry_env['VIRTUAL_ENV'] = ''
 
+
 def poetry_run(*args: str) -> CompletedProcess:
     # Poetry is not API, but a CLI -- call it like that!
     call = (

From a5eba2c544f1df449b43cb15d9f37e08f789b2c9 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 01:03:11 +0100
Subject: [PATCH 16/17] foof

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 80433314..c6d57fb0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -76,7 +76,7 @@ setuptools = ">= 47.0.0"
 # install` needed fot setup/ini of test-beds
 pip = ">=23.0"
 pipenv = ">=2023.11.5"
-poetry = "^1.7"  # the one from the host system is enough
+poetry = "*"  # the one from the host system is enough
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'

From 20d63b215af40a13366d312e4e845b035acb58ed Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 01:07:30 +0100
Subject: [PATCH 17/17] foof

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index c6d57fb0..cbe1c50d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -73,10 +73,10 @@ types-toml = "^0.10.0"
 # min version required to be able to install some dependencies
 # see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
 setuptools = ">= 47.0.0"
-# install` needed fot setup/ini of test-beds
+# install` needed for setup/init of testbeds
 pip = ">=23.0"
 pipenv = ">=2023.11.5"
-poetry = "*"  # the one from the host system is enough
+poetry = "^1.7"
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'
