-
Notifications
You must be signed in to change notification settings - Fork 457
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: update SBOM for Python 3.8 (#4120)
Co-authored-by: GitHub <[email protected]>
- Loading branch information
1 parent
c7e2688
commit 7816fcf
Showing
2 changed files
with
43 additions
and
50 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,10 +2,10 @@ | |
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", | ||
"bomFormat": "CycloneDX", | ||
"specVersion": "1.6", | ||
"serialNumber": "urn:uuid:120bb2a5-fa0c-4b63-8098-1c048eeed9f3", | ||
"serialNumber": "urn:uuid:3178e3ea-d027-4327-a88b-1a6f2c9f1925", | ||
"version": 1, | ||
"metadata": { | ||
"timestamp": "2024-05-06T00:28:48Z", | ||
"timestamp": "2024-05-13T00:29:26Z", | ||
"tools": { | ||
"components": [ | ||
{ | ||
|
@@ -483,6 +483,12 @@ | |
}, | ||
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*", | ||
"description": "CVSS2/3/4 library with interactive calculator for Python 2 and Python 3", | ||
"hashes": [ | ||
{ | ||
"alg": "SHA-1", | ||
"content": "e4cf69bea6bcfa1cbc38dca13b9ec8bf3363a475" | ||
} | ||
], | ||
"licenses": [ | ||
{ | ||
"license": { | ||
|
@@ -652,7 +658,7 @@ | |
"type": "library", | ||
"bom-ref": "16-gsutil", | ||
"name": "gsutil", | ||
"version": "5.28", | ||
"version": "5.29", | ||
"supplier": { | ||
"name": "Google Inc .", | ||
"contact": [ | ||
|
@@ -661,7 +667,7 @@ | |
} | ||
] | ||
}, | ||
"cpe": "cpe:2.3:a:google_inc.:gsutil:5.28:*:*:*:*:*:*:*", | ||
"cpe": "cpe:2.3:a:google_inc.:gsutil:5.29:*:*:*:*:*:*:*", | ||
"description": "A command line tool for interacting with cloud storage services.", | ||
"licenses": [ | ||
{ | ||
|
@@ -673,12 +679,12 @@ | |
], | ||
"externalReferences": [ | ||
{ | ||
"url": "https://pypi.org/project/gsutil/5.28", | ||
"url": "https://pypi.org/project/gsutil/5.29", | ||
"type": "distribution", | ||
"comment": "Download location for component" | ||
} | ||
], | ||
"purl": "pkg:pypi/gsutil@5.28", | ||
"purl": "pkg:pypi/gsutil@5.29", | ||
"properties": [ | ||
{ | ||
"name": "language", | ||
|
@@ -1514,7 +1520,7 @@ | |
"type": "library", | ||
"bom-ref": "35-cryptography", | ||
"name": "cryptography", | ||
"version": "42.0.6", | ||
"version": "42.0.7", | ||
"supplier": { | ||
"name": "The Python Cryptographic Authority and individual contributors", | ||
"contact": [ | ||
|
@@ -1523,7 +1529,7 @@ | |
} | ||
] | ||
}, | ||
"cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.6:*:*:*:*:*:*:*", | ||
"cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.7:*:*:*:*:*:*:*", | ||
"description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.", | ||
"licenses": [ | ||
{ | ||
|
@@ -1532,12 +1538,12 @@ | |
], | ||
"externalReferences": [ | ||
{ | ||
"url": "https://pypi.org/project/cryptography/42.0.6", | ||
"url": "https://pypi.org/project/cryptography/42.0.7", | ||
"type": "distribution", | ||
"comment": "Download location for component" | ||
} | ||
], | ||
"purl": "pkg:pypi/[email protected].6", | ||
"purl": "pkg:pypi/[email protected].7", | ||
"properties": [ | ||
{ | ||
"name": "language", | ||
|
@@ -1940,12 +1946,6 @@ | |
"name": "markupsafe", | ||
"version": "2.1.5", | ||
"description": "Safely add untrusted strings to HTML/XML markup.", | ||
"hashes": [ | ||
{ | ||
"alg": "SHA-1", | ||
"content": "fbba4acd0312826cec9cfe18371c7df07962cb65" | ||
} | ||
], | ||
"licenses": [ | ||
{ | ||
"license": { | ||
|
@@ -2086,11 +2086,11 @@ | |
"type": "library", | ||
"bom-ref": "49-rpds-py", | ||
"name": "rpds-py", | ||
"version": "0.18.0", | ||
"version": "0.18.1", | ||
"supplier": { | ||
"name": "Julian Berman" | ||
}, | ||
"cpe": "cpe:2.3:a:julian_berman:rpds-py:0.18.0:*:*:*:*:*:*:*", | ||
"cpe": "cpe:2.3:a:julian_berman:rpds-py:0.18.1:*:*:*:*:*:*:*", | ||
"description": "Python bindings to Rust's persistent data structures (rpds)", | ||
"licenses": [ | ||
{ | ||
|
@@ -2102,12 +2102,12 @@ | |
], | ||
"externalReferences": [ | ||
{ | ||
"url": "https://pypi.org/project/rpds-py/0.18.0", | ||
"url": "https://pypi.org/project/rpds-py/0.18.1", | ||
"type": "distribution", | ||
"comment": "Download location for component" | ||
} | ||
], | ||
"purl": "pkg:pypi/[email protected].0", | ||
"purl": "pkg:pypi/[email protected].1", | ||
"properties": [ | ||
{ | ||
"name": "language", | ||
|
@@ -2420,7 +2420,7 @@ | |
"type": "library", | ||
"bom-ref": "57-tenacity", | ||
"name": "tenacity", | ||
"version": "8.2.3", | ||
"version": "8.3.0", | ||
"supplier": { | ||
"name": "Julien Danjou", | ||
"contact": [ | ||
|
@@ -2429,14 +2429,8 @@ | |
} | ||
] | ||
}, | ||
"cpe": "cpe:2.3:a:julien_danjou:tenacity:8.2.3:*:*:*:*:*:*:*", | ||
"cpe": "cpe:2.3:a:julien_danjou:tenacity:8.3.0:*:*:*:*:*:*:*", | ||
"description": "Retry code until it succeeds", | ||
"hashes": [ | ||
{ | ||
"alg": "SHA-1", | ||
"content": "41ed2420cda8ab7650a39900451099f4730266c3" | ||
} | ||
], | ||
"licenses": [ | ||
{ | ||
"license": { | ||
|
@@ -2447,12 +2441,12 @@ | |
], | ||
"externalReferences": [ | ||
{ | ||
"url": "https://pypi.org/project/tenacity/8.2.3", | ||
"url": "https://pypi.org/project/tenacity/8.3.0", | ||
"type": "distribution", | ||
"comment": "Download location for component" | ||
} | ||
], | ||
"purl": "pkg:pypi/tenacity@8.2.3", | ||
"purl": "pkg:pypi/tenacity@8.3.0", | ||
"properties": [ | ||
{ | ||
"name": "language", | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3 | |
DataLicense: CC0-1.0 | ||
SPDXID: SPDXRef-DOCUMENT | ||
DocumentName: Python-cve-bin-tool | ||
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-e22d6ccd-3b1e-4723-801c-333cec52ae09 | ||
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-43ca30d9-07f7-4748-a669-8136d177492c | ||
LicenseListVersion: 3.22 | ||
Creator: Tool: sbom4python-0.10.4 | ||
Created: 2024-05-06T00:27:03Z | ||
Created: 2024-05-13T00:27:42Z | ||
CreatorComment: <text>This document has been automatically generated.</text> | ||
##### | ||
|
||
|
@@ -189,6 +189,7 @@ PrimaryPackagePurpose: LIBRARY | |
PackageSupplier: Organization: Stanislav Red Hat Product Security ([email protected]) | ||
PackageDownloadLocation: https://pypi.org/project/cvss/3.1 | ||
FilesAnalyzed: false | ||
PackageChecksum: SHA1: e4cf69bea6bcfa1cbc38dca13b9ec8bf3363a475 | ||
PackageLicenseDeclared: NOASSERTION | ||
PackageLicenseConcluded: LGPL-3.0-or-later | ||
PackageLicenseComments: <text>cvss declares LGPLv3+ which is not currently a valid SPDX License identifier or expression.</text> | ||
|
@@ -249,18 +250,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:tomas_aparicio:filetype:1.2.0:*:*:*:*: | |
|
||
PackageName: gsutil | ||
SPDXID: SPDXRef-Package-16-gsutil | ||
PackageVersion: 5.28 | ||
PackageVersion: 5.29 | ||
PrimaryPackagePurpose: LIBRARY | ||
PackageSupplier: Person: Google Inc. ([email protected]) | ||
PackageDownloadLocation: https://pypi.org/project/gsutil/5.28 | ||
PackageDownloadLocation: https://pypi.org/project/gsutil/5.29 | ||
FilesAnalyzed: false | ||
PackageLicenseDeclared: NOASSERTION | ||
PackageLicenseConcluded: Apache-2.0 | ||
PackageLicenseComments: <text>gsutil declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text> | ||
PackageCopyrightText: NOASSERTION | ||
PackageSummary: <text>A command line tool for interacting with cloud storage services.</text> | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/gsutil@5.28 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.28:*:*:*:*:*:*:* | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/gsutil@5.29 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.29:*:*:*:*:*:*:* | ||
##### | ||
|
||
PackageName: argcomplete | ||
|
@@ -557,17 +558,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_pyopenssl_developers:pyopenssl:24. | |
|
||
PackageName: cryptography | ||
SPDXID: SPDXRef-Package-35-cryptography | ||
PackageVersion: 42.0.6 | ||
PackageVersion: 42.0.7 | ||
PrimaryPackagePurpose: LIBRARY | ||
PackageSupplier: Organization: The Python Cryptographic Authority and individual contributors ([email protected]) | ||
PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.6 | ||
PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.7 | ||
FilesAnalyzed: false | ||
PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause | ||
PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause | ||
PackageCopyrightText: NOASSERTION | ||
PackageSummary: <text>cryptography is a package which provides cryptographic recipes and primitives to Python developers.</text> | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].6 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.6:*:*:*:*:*:*:* | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].7 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.7:*:*:*:*:*:*:* | ||
##### | ||
|
||
PackageName: cffi | ||
|
@@ -721,7 +722,6 @@ PrimaryPackagePurpose: LIBRARY | |
PackageSupplier: NOASSERTION | ||
PackageDownloadLocation: https://pypi.org/project/MarkupSafe/2.1.5 | ||
FilesAnalyzed: false | ||
PackageChecksum: SHA1: fbba4acd0312826cec9cfe18371c7df07962cb65 | ||
PackageLicenseDeclared: BSD-3-Clause | ||
PackageLicenseConcluded: BSD-3-Clause | ||
PackageCopyrightText: NOASSERTION | ||
|
@@ -777,17 +777,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.35.1:*:*:* | |
|
||
PackageName: rpds-py | ||
SPDXID: SPDXRef-Package-49-rpds-py | ||
PackageVersion: 0.18.0 | ||
PackageVersion: 0.18.1 | ||
PrimaryPackagePurpose: LIBRARY | ||
PackageSupplier: Person: Julian Berman | ||
PackageDownloadLocation: https://pypi.org/project/rpds-py/0.18.0 | ||
PackageDownloadLocation: https://pypi.org/project/rpds-py/0.18.1 | ||
FilesAnalyzed: false | ||
PackageLicenseDeclared: MIT | ||
PackageLicenseConcluded: MIT | ||
PackageCopyrightText: NOASSERTION | ||
PackageSummary: <text>Python bindings to Rust's persistent data structures (rpds)</text> | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.18.0:*:*:*:*:*:*:* | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.18.1:*:*:*:*:*:*:* | ||
##### | ||
|
||
PackageName: pkgutil-resolve-name | ||
|
@@ -902,19 +902,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:5.22.0:*:*:*:*:*:*:* | |
|
||
PackageName: tenacity | ||
SPDXID: SPDXRef-Package-57-tenacity | ||
PackageVersion: 8.2.3 | ||
PackageVersion: 8.3.0 | ||
PrimaryPackagePurpose: LIBRARY | ||
PackageSupplier: Person: Julien Danjou ([email protected]) | ||
PackageDownloadLocation: https://pypi.org/project/tenacity/8.2.3 | ||
PackageDownloadLocation: https://pypi.org/project/tenacity/8.3.0 | ||
FilesAnalyzed: false | ||
PackageChecksum: SHA1: 41ed2420cda8ab7650a39900451099f4730266c3 | ||
PackageLicenseDeclared: NOASSERTION | ||
PackageLicenseConcluded: Apache-2.0 | ||
PackageLicenseComments: <text>tenacity declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text> | ||
PackageCopyrightText: NOASSERTION | ||
PackageSummary: <text>Retry code until it succeeds</text> | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/tenacity@8.2.3 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.2.3:*:*:*:*:*:*:* | ||
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/tenacity@8.3.0 | ||
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.3.0:*:*:*:*:*:*:* | ||
##### | ||
|
||
PackageName: python-gnupg | ||
|