Skip to content

Commit

Permalink
chore: update SBOM for Python 3.10 (#4490)
Browse files Browse the repository at this point in the history 
Co-authored-by: GitHub <[email protected]>
  • Loading branch information
@github-actions @web-flow
github-actions[bot] and web-flow authored Oct 7, 2024
1 parent 10035b5 commit fdd570d
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 33 deletions.
35 changes: 18 additions & 17 deletions sbom/cve-bin-tool-py3.10.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:a49b3b2e-848e-4270-b4b6-2c42aabe82e9",
"serialNumber": "urn:uuid:6e552fed-4009-40c8-963a-a1103b9e34b5",
"version": 1,
"metadata": {
"timestamp": "2024-09-30T00:40:12Z",
"timestamp": "2024-10-07T00:38:19Z",
"lifecycles": [
{
"phase": "build"
Expand All @@ -15,7 +15,7 @@
"components": [
{
"name": "sbom4python",
"version": "0.11.2",
"version": "0.11.3",
"type": "application"
}
]
Expand Down Expand Up @@ -79,7 +79,7 @@
"type": "library",
"bom-ref": "2-aiohttp",
"name": "aiohttp",
"version": "3.10.8",
"version": "3.10.9",
"description": "Async http client/server framework (asyncio)",
"licenses": [
{
Expand All @@ -97,12 +97,12 @@
"comment": "Home page for project"
},
{
"url": "https://pypi.org/project/aiohttp/3.10.8/#files",
"url": "https://pypi.org/project/aiohttp/3.10.9/#files",
"type": "distribution",
"comment": "Download location for component"
}
],
"purl": "pkg:pypi/[email protected].8",
"purl": "pkg:pypi/[email protected].9",
"properties": [
{
"name": "language",
Expand All @@ -118,7 +118,7 @@
"type": "library",
"bom-ref": "3-aiohappyeyeballs",
"name": "aiohappyeyeballs",
"version": "2.4.2",
"version": "2.4.3",
"supplier": {
"name": "J. Nick Koston",
"contact": [
Expand All @@ -127,13 +127,13 @@
}
]
},
"cpe": "cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.2:*:*:*:*:*:*:*",
"cpe": "cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.3:*:*:*:*:*:*:*",
"description": "Happy Eyeballs for asyncio",
"licenses": [
{
"license": {
"id": "Python-2.0.1",
"url": "https://www.python.org/download/releases/2.0.1/license/",
"id": "PSF-2.0",
"url": "https://opensource.org/licenses/Python-2.0",
"acknowledgement": "concluded"
}
}
Expand All @@ -145,12 +145,12 @@
"comment": "Home page for project"
},
{
"url": "https://pypi.org/project/aiohappyeyeballs/2.4.2/#files",
"url": "https://pypi.org/project/aiohappyeyeballs/2.4.3/#files",
"type": "distribution",
"comment": "Download location for component"
}
],
"purl": "pkg:pypi/[email protected].2",
"purl": "pkg:pypi/[email protected].3",
"properties": [
{
"name": "language",
Expand Down Expand Up @@ -2745,7 +2745,7 @@
"type": "library",
"bom-ref": "55-rich",
"name": "rich",
"version": "13.8.1",
"version": "13.9.2",
"supplier": {
"name": "Will McGugan",
"contact": [
Expand All @@ -2754,7 +2754,7 @@
}
]
},
"cpe": "cpe:2.3:a:will_mcgugan:rich:13.8.1:*:*:*:*:*:*:*",
"cpe": "cpe:2.3:a:will_mcgugan:rich:13.9.2:*:*:*:*:*:*:*",
"description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal",
"licenses": [
{
Expand All @@ -2772,12 +2772,12 @@
"comment": "Home page for project"
},
{
"url": "https://pypi.org/project/rich/13.8.1/#files",
"url": "https://pypi.org/project/rich/13.9.2/#files",
"type": "distribution",
"comment": "Download location for component"
}
],
"purl": "pkg:pypi/rich@13.8.1",
"purl": "pkg:pypi/rich@13.9.2",
"properties": [
{
"name": "language",
Expand Down Expand Up @@ -3893,7 +3893,8 @@
"ref": "55-rich",
"dependsOn": [
"56-markdown-it-py",
"58-pygments"
"58-pygments",
"9-typing-extensions"
]
},
{
Expand Down
33 changes: 17 additions & 16 deletions sbom/cve-bin-tool-py3.10.spdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: Python-cve-bin-tool
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-4705584a-ef66-4c66-b17b-3a81ce10e8e5
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-f342fd75-77a2-483b-8170-2340b13d2867
LicenseListVersion: 3.22
Creator: Tool: sbom4python-0.11.2
Created: 2024-09-30T00:38:38Z
Creator: Tool: sbom4python-0.11.3
Created: 2024-10-07T00:37:22Z
CreatorComment: <text>This document has been automatically generated.</text>
#####

Expand All @@ -27,34 +27,34 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.4:*:*:*:*:*:*

PackageName: aiohttp
SPDXID: SPDXRef-2-aiohttp
PackageVersion: 3.10.8
PackageVersion: 3.10.9
PrimaryPackagePurpose: LIBRARY
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.10.8/#files
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.10.9/#files
FilesAnalyzed: false
PackageHomePage: https://github.com/aio-libs/aiohttp
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: Apache-2.0
PackageLicenseComments: <text>aiohttp declares Apache 2 which is not currently a valid SPDX License identifier or expression.</text>
PackageCopyrightText: NOASSERTION
PackageSummary: <text>Async http client/server framework (asyncio)</text>
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].8
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].9
#####

PackageName: aiohappyeyeballs
SPDXID: SPDXRef-3-aiohappyeyeballs
PackageVersion: 2.4.2
PackageVersion: 2.4.3
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Organization: J. Nick Koston ([email protected])
PackageDownloadLocation: https://pypi.org/project/aiohappyeyeballs/2.4.2/#files
PackageDownloadLocation: https://pypi.org/project/aiohappyeyeballs/2.4.3/#files
FilesAnalyzed: false
PackageHomePage: https://github.com/aio-libs/aiohappyeyeballs
PackageLicenseDeclared: Python-2.0.1
PackageLicenseConcluded: Python-2.0.1
PackageLicenseDeclared: PSF-2.0
PackageLicenseConcluded: PSF-2.0
PackageCopyrightText: NOASSERTION
PackageSummary: <text>Happy Eyeballs for asyncio</text>
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].2
ExternalRef: SECURITY cpe23Type cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].3
ExternalRef: SECURITY cpe23Type cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.3:*:*:*:*:*:*:*
#####

PackageName: aiosignal
Expand Down Expand Up @@ -917,18 +917,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_purl_authors:packageurl-python:0.1

PackageName: rich
SPDXID: SPDXRef-55-rich
PackageVersion: 13.8.1
PackageVersion: 13.9.2
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Will McGugan ([email protected])
PackageDownloadLocation: https://pypi.org/project/rich/13.8.1/#files
PackageDownloadLocation: https://pypi.org/project/rich/13.9.2/#files
FilesAnalyzed: false
PackageHomePage: https://github.com/Textualize/rich
PackageLicenseDeclared: MIT
PackageLicenseConcluded: MIT
PackageCopyrightText: NOASSERTION
PackageSummary: <text>Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal</text>
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/rich@13.8.1
ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.8.1:*:*:*:*:*:*:*
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/rich@13.9.2
ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.9.2:*:*:*:*:*:*:*
#####

PackageName: markdown-it-py
Expand Down Expand Up @@ -1326,6 +1326,7 @@ Relationship: SPDXRef-53-csaf-tool DEPENDS_ON SPDXRef-54-packageurl-python
Relationship: SPDXRef-53-csaf-tool DEPENDS_ON SPDXRef-55-rich
Relationship: SPDXRef-55-rich DEPENDS_ON SPDXRef-56-markdown-it-py
Relationship: SPDXRef-55-rich DEPENDS_ON SPDXRef-58-pygments
Relationship: SPDXRef-55-rich DEPENDS_ON SPDXRef-9-typing-extensions
Relationship: SPDXRef-56-markdown-it-py DEPENDS_ON SPDXRef-57-mdurl
Relationship: SPDXRef-60-plotly DEPENDS_ON SPDXRef-59-packaging
Relationship: SPDXRef-60-plotly DEPENDS_ON SPDXRef-61-tenacity
Expand Down

0 comments on commit fdd570d

Please sign in to comment.