PIP Comp Detect Adapter - No License or Supplier information

[samuelc7]

The scan manifest file that Component Detection creates shows license and author information of each pip package that was detected. The sbom-tool does not correctly collect that information - it shows "NO ASSERTION" for the license declared and "NO ASSERTION" for the supplier:

ScanManifest-2024....json (Comp Detect file)

"component": {
        "name": "torch",
        "version": "2.5.1",
        "author": "PyTorch Team",
        "license": "BSD-3-Clause",
        "type": "Pip",
        "id": "torch 2.5.1 - pip",
        "packageUrl": {
          "Scheme": "pkg",
          "Type": "pypi",
          "Namespace": null,
          "Name": "torch",
          "Version": "2.5.1",
          "Qualifiers": null,
          "Subpath": null
        }
      }

manifest.spdx.json (sbom-tool)

{
      "name": "torch",
      "SPDXID": "SPDXRef-Package-A40751563D79B440AD6920A1E59C425463CBCF0A7835485457E3BAFBD06B4260",
      "downloadLocation": "NOASSERTION",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "NOASSERTION",
      "copyrightText": "NOASSERTION",
      "versionInfo": "2.5.1",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:pypi/[email protected]"
        }
      ],
      "supplier": "NOASSERTION"
    },