Skip to content

Commit 1ea5a01

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.12 (#4027)
Co-authored-by: GitHub <[email protected]>
1 parent db8b5b0 commit 1ea5a01

File tree

2 files changed

+44
-51
lines changed

2 files changed

+44
-51
lines changed

‎sbom/cve-bin-tool-py3.12.json

Lines changed: 22 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:f6992a7b-132d-412c-9441-05c8df1f6129",
5+
"serialNumber": "urn:uuid:1134ea94-6349-4262-b57f-e37ae9566c26",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-04-08T00:27:35Z",
8+
"timestamp": "2024-04-15T02:43:09Z",
99
"tools": {
1010
"components": [
1111
{
@@ -26,7 +26,7 @@
2626
"type": "application",
2727
"bom-ref": "1-cve-bin-tool",
2828
"name": "cve-bin-tool",
29-
"version": "3.3rc2",
29+
"version": "3.3",
3030
"supplier": {
3131
"name": "Terri Oda",
3232
"contact": [
@@ -35,12 +35,12 @@
3535
}
3636
]
3737
},
38-
"cpe": "cpe:2.3:a:terri_oda:cve-bin-tool:3.3rc2:*:*:*:*:*:*:*",
38+
"cpe": "cpe:2.3:a:terri_oda:cve-bin-tool:3.3:*:*:*:*:*:*:*",
3939
"description": "CVE Binary Checker Tool",
4040
"hashes": [
4141
{
4242
"alg": "SHA-1",
43-
"content": "c491590aeea36235930d1c6b8480d2489a470ece"
43+
"content": "83e30ee0f640bce7a20d4346c85873d359c05d1f"
4444
}
4545
],
4646
"licenses": [
@@ -53,12 +53,12 @@
5353
],
5454
"externalReferences": [
5555
{
56-
"url": "https://pypi.org/project/cve-bin-tool/3.3rc2",
56+
"url": "https://pypi.org/project/cve-bin-tool/3.3",
5757
"type": "distribution",
5858
"comment": "Download location for component"
5959
}
6060
],
61-
"purl": "pkg:pypi/cve-bin-tool@3.3rc2",
61+
"purl": "pkg:pypi/cve-bin-tool@3.3",
6262
"properties": [
6363
{
6464
"name": "language",
@@ -74,7 +74,7 @@
7474
"type": "library",
7575
"bom-ref": "2-aiohttp",
7676
"name": "aiohttp",
77-
"version": "3.9.3",
77+
"version": "3.9.4",
7878
"description": "Async http client/server framework (asyncio)",
7979
"licenses": [
8080
{
@@ -86,12 +86,12 @@
8686
],
8787
"externalReferences": [
8888
{
89-
"url": "https://pypi.org/project/aiohttp/3.9.3",
89+
"url": "https://pypi.org/project/aiohttp/3.9.4",
9090
"type": "distribution",
9191
"comment": "Download location for component"
9292
}
9393
],
94-
"purl": "pkg:pypi/[email protected].3",
94+
"purl": "pkg:pypi/[email protected].4",
9595
"properties": [
9696
{
9797
"name": "language",
@@ -308,7 +308,7 @@
308308
"type": "library",
309309
"bom-ref": "8-idna",
310310
"name": "idna",
311-
"version": "3.6",
311+
"version": "3.7",
312312
"supplier": {
313313
"name": "Kim Davies",
314314
"contact": [
@@ -317,16 +317,16 @@
317317
}
318318
]
319319
},
320-
"cpe": "cpe:2.3:a:kim_davies:idna:3.6:*:*:*:*:*:*:*",
320+
"cpe": "cpe:2.3:a:kim_davies:idna:3.7:*:*:*:*:*:*:*",
321321
"description": "Internationalized Domain Names in Applications (IDNA)",
322322
"externalReferences": [
323323
{
324-
"url": "https://pypi.org/project/idna/3.6",
324+
"url": "https://pypi.org/project/idna/3.7",
325325
"type": "distribution",
326326
"comment": "Download location for component"
327327
}
328328
],
329-
"purl": "pkg:pypi/idna@3.6",
329+
"purl": "pkg:pypi/idna@3.7",
330330
"properties": [
331331
{
332332
"name": "language",
@@ -424,7 +424,7 @@
424424
"type": "library",
425425
"bom-ref": "11-cvss",
426426
"name": "cvss",
427-
"version": "3.0",
427+
"version": "3.1",
428428
"supplier": {
429429
"name": "Stanislav Red Hat Product Security",
430430
"contact": [
@@ -433,14 +433,8 @@
433433
}
434434
]
435435
},
436-
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.0:*:*:*:*:*:*:*",
436+
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*",
437437
"description": "CVSS2/3/4 library with interactive calculator for Python 2 and Python 3",
438-
"hashes": [
439-
{
440-
"alg": "SHA-1",
441-
"content": "c637e63a16b7411c6135b5ae8bb5408d06d89b41"
442-
}
443-
],
444438
"licenses": [
445439
{
446440
"license": {
@@ -451,12 +445,12 @@
451445
],
452446
"externalReferences": [
453447
{
454-
"url": "https://pypi.org/project/cvss/3.0",
448+
"url": "https://pypi.org/project/cvss/3.1",
455449
"type": "distribution",
456450
"comment": "Download location for component"
457451
}
458452
],
459-
"purl": "pkg:pypi/cvss@3.0",
453+
"purl": "pkg:pypi/cvss@3.1",
460454
"properties": [
461455
{
462456
"name": "language",
@@ -652,7 +646,7 @@
652646
"type": "library",
653647
"bom-ref": "16-argcomplete",
654648
"name": "argcomplete",
655-
"version": "3.2.3",
649+
"version": "3.3.0",
656650
"supplier": {
657651
"name": "Andrey Kislyuk",
658652
"contact": [
@@ -661,7 +655,7 @@
661655
}
662656
]
663657
},
664-
"cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.2.3:*:*:*:*:*:*:*",
658+
"cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.3.0:*:*:*:*:*:*:*",
665659
"description": "Bash tab completion for argparse",
666660
"licenses": [
667661
{
@@ -673,12 +667,12 @@
673667
],
674668
"externalReferences": [
675669
{
676-
"url": "https://pypi.org/project/argcomplete/3.2.3",
670+
"url": "https://pypi.org/project/argcomplete/3.3.0",
677671
"type": "distribution",
678672
"comment": "Download location for component"
679673
}
680674
],
681-
"purl": "pkg:pypi/argcomplete@3.2.3",
675+
"purl": "pkg:pypi/argcomplete@3.3.0",
682676
"properties": [
683677
{
684678
"name": "language",

‎sbom/cve-bin-tool-py3.12.spdx

Lines changed: 22 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,42 +2,42 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-e6f8ebcd-5a53-4c80-8ee1-90be752f102d
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-54b655be-6b8b-4720-8b97-b17adec09373
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.4
8-
Created: 2024-04-08T00:26:15Z
8+
Created: 2024-04-15T02:41:54Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

1212
PackageName: cve-bin-tool
1313
SPDXID: SPDXRef-Package-1-cve-bin-tool
14-
PackageVersion: 3.3rc2
14+
PackageVersion: 3.3
1515
PrimaryPackagePurpose: APPLICATION
1616
PackageSupplier: Person: Terri Oda ([email protected])
17-
PackageDownloadLocation: https://pypi.org/project/cve-bin-tool/3.3rc2
17+
PackageDownloadLocation: https://pypi.org/project/cve-bin-tool/3.3
1818
FilesAnalyzed: false
19-
PackageChecksum: SHA1: c491590aeea36235930d1c6b8480d2489a470ece
19+
PackageChecksum: SHA1: 83e30ee0f640bce7a20d4346c85873d359c05d1f
2020
PackageLicenseDeclared: GPL-3.0-or-later
2121
PackageLicenseConcluded: GPL-3.0-or-later
2222
PackageCopyrightText: NOASSERTION
2323
PackageSummary: <text>CVE Binary Checker Tool</text>
24-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cve-bin-tool@3.3rc2
25-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.3rc2:*:*:*:*:*:*:*
24+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cve-bin-tool@3.3
25+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.3:*:*:*:*:*:*:*
2626
#####
2727

2828
PackageName: aiohttp
2929
SPDXID: SPDXRef-Package-2-aiohttp
30-
PackageVersion: 3.9.3
30+
PackageVersion: 3.9.4
3131
PrimaryPackagePurpose: LIBRARY
3232
PackageSupplier: NOASSERTION
33-
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.9.3
33+
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.9.4
3434
FilesAnalyzed: false
3535
PackageLicenseDeclared: NOASSERTION
3636
PackageLicenseConcluded: Apache-2.0
3737
PackageLicenseComments: <text>aiohttp declares Apache 2 which is not currently a valid SPDX License identifier or expression.</text>
3838
PackageCopyrightText: NOASSERTION
3939
PackageSummary: <text>Async http client/server framework (asyncio)</text>
40-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].3
40+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].4
4141
#####
4242

4343
PackageName: aiosignal
@@ -120,17 +120,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.4:*:*:*:*:*:*:
120120

121121
PackageName: idna
122122
SPDXID: SPDXRef-Package-8-idna
123-
PackageVersion: 3.6
123+
PackageVersion: 3.7
124124
PrimaryPackagePurpose: LIBRARY
125125
PackageSupplier: Person: Kim Davies ([email protected])
126-
PackageDownloadLocation: https://pypi.org/project/idna/3.6
126+
PackageDownloadLocation: https://pypi.org/project/idna/3.7
127127
FilesAnalyzed: false
128128
PackageLicenseDeclared: NOASSERTION
129129
PackageLicenseConcluded: NOASSERTION
130130
PackageCopyrightText: NOASSERTION
131131
PackageSummary: <text>Internationalized Domain Names in Applications (IDNA)</text>
132-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/idna@3.6
133-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.6:*:*:*:*:*:*:*
132+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/idna@3.7
133+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.7:*:*:*:*:*:*:*
134134
#####
135135

136136
PackageName: beautifulsoup4
@@ -167,19 +167,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:isaac_muse:soupsieve:2.5:*:*:*:*:*:*:*
167167

168168
PackageName: cvss
169169
SPDXID: SPDXRef-Package-11-cvss
170-
PackageVersion: 3.0
170+
PackageVersion: 3.1
171171
PrimaryPackagePurpose: LIBRARY
172172
PackageSupplier: Organization: Stanislav Red Hat Product Security ([email protected])
173-
PackageDownloadLocation: https://pypi.org/project/cvss/3.0
173+
PackageDownloadLocation: https://pypi.org/project/cvss/3.1
174174
FilesAnalyzed: false
175-
PackageChecksum: SHA1: c637e63a16b7411c6135b5ae8bb5408d06d89b41
176175
PackageLicenseDeclared: NOASSERTION
177176
PackageLicenseConcluded: LGPL-3.0-or-later
178177
PackageLicenseComments: <text>cvss declares LGPLv3+ which is not currently a valid SPDX License identifier or expression.</text>
179178
PackageCopyrightText: NOASSERTION
180179
PackageSummary: <text>CVSS2/3/4 library with interactive calculator for Python 2 and Python 3</text>
181-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cvss@3.0
182-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.0:*:*:*:*:*:*:*
180+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cvss@3.1
181+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*
183182
#####
184183

185184
PackageName: defusedxml
@@ -249,18 +248,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.27:*:*:*:*:*:*:*
249248

250249
PackageName: argcomplete
251250
SPDXID: SPDXRef-Package-16-argcomplete
252-
PackageVersion: 3.2.3
251+
PackageVersion: 3.3.0
253252
PrimaryPackagePurpose: LIBRARY
254253
PackageSupplier: Person: Andrey Kislyuk ([email protected])
255-
PackageDownloadLocation: https://pypi.org/project/argcomplete/3.2.3
254+
PackageDownloadLocation: https://pypi.org/project/argcomplete/3.3.0
256255
FilesAnalyzed: false
257256
PackageLicenseDeclared: NOASSERTION
258257
PackageLicenseConcluded: Apache-2.0
259258
PackageLicenseComments: <text>argcomplete declares Apache Software License which is not currently a valid SPDX License identifier or expression.</text>
260259
PackageCopyrightText: NOASSERTION
261260
PackageSummary: <text>Bash tab completion for argparse</text>
262-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/argcomplete@3.2.3
263-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_kislyuk:argcomplete:3.2.3:*:*:*:*:*:*:*
261+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/argcomplete@3.3.0
262+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_kislyuk:argcomplete:3.3.0:*:*:*:*:*:*:*
264263
#####
265264

266265
PackageName: crcmod

0 commit comments

Comments
 (0)