Find an alternative to Python-Inspector

[MarcelBochtler]

Problem Overview

We have received several reports from ORT users regarding ongoing issues with the Python Inspector 1, 2.

Additionally, there has been little to no response to issues and pull requests submitted to the Python Inspector repository, with some requests going unanswered for extended periods 3, 4. The upstream project shows minimal development activity 5, which has led ORT community members to fork the tools and maintain private forks for use within ORT.

Suggested Solution

To address these challenges, I propose creating a soft-fork of the Python Inspector within the oss-review-toolkit organization. This would allow us to maintain and improve the tool independently, as well as implement ORT-specific features that are not being actively developed upstream.

In the long term we might want to rewrite the Python / PIP support in Kotlin.

Note

This was discussed and agreed upon in the ORT TSC meeting 2026-01-13.

[sschuberth]

Now that we have the abstract CycloneDxPackageManager (used by the Erlang stuff), a way forward could be to do the same for each Python package manager that python-inspector supports. Leveraging https://github.com/CycloneDX/cyclonedx-python could be a starting point.