Skip to content

Commit 34eb206

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.9 (#4026)
Co-authored-by: GitHub <[email protected]>
1 parent 1ea5a01 commit 34eb206

File tree

2 files changed

+44
-51
lines changed

2 files changed

+44
-51
lines changed

‎sbom/cve-bin-tool-py3.9.json

Lines changed: 22 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:f3b971fe-7324-4a25-872a-43efebe6bc9d",
5+
"serialNumber": "urn:uuid:86bfebc8-cd04-4c9a-98d8-90930122e373",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-04-08T00:27:26Z",
8+
"timestamp": "2024-04-15T02:43:08Z",
99
"tools": {
1010
"components": [
1111
{
@@ -26,7 +26,7 @@
2626
"type": "application",
2727
"bom-ref": "1-cve-bin-tool",
2828
"name": "cve-bin-tool",
29-
"version": "3.3rc2",
29+
"version": "3.3",
3030
"supplier": {
3131
"name": "Terri Oda",
3232
"contact": [
@@ -35,12 +35,12 @@
3535
}
3636
]
3737
},
38-
"cpe": "cpe:2.3:a:terri_oda:cve-bin-tool:3.3rc2:*:*:*:*:*:*:*",
38+
"cpe": "cpe:2.3:a:terri_oda:cve-bin-tool:3.3:*:*:*:*:*:*:*",
3939
"description": "CVE Binary Checker Tool",
4040
"hashes": [
4141
{
4242
"alg": "SHA-1",
43-
"content": "c491590aeea36235930d1c6b8480d2489a470ece"
43+
"content": "83e30ee0f640bce7a20d4346c85873d359c05d1f"
4444
}
4545
],
4646
"licenses": [
@@ -53,12 +53,12 @@
5353
],
5454
"externalReferences": [
5555
{
56-
"url": "https://pypi.org/project/cve-bin-tool/3.3rc2",
56+
"url": "https://pypi.org/project/cve-bin-tool/3.3",
5757
"type": "distribution",
5858
"comment": "Download location for component"
5959
}
6060
],
61-
"purl": "pkg:pypi/cve-bin-tool@3.3rc2",
61+
"purl": "pkg:pypi/cve-bin-tool@3.3",
6262
"properties": [
6363
{
6464
"name": "language",
@@ -74,7 +74,7 @@
7474
"type": "library",
7575
"bom-ref": "2-aiohttp",
7676
"name": "aiohttp",
77-
"version": "3.9.3",
77+
"version": "3.9.4",
7878
"description": "Async http client/server framework (asyncio)",
7979
"licenses": [
8080
{
@@ -86,12 +86,12 @@
8686
],
8787
"externalReferences": [
8888
{
89-
"url": "https://pypi.org/project/aiohttp/3.9.3",
89+
"url": "https://pypi.org/project/aiohttp/3.9.4",
9090
"type": "distribution",
9191
"comment": "Download location for component"
9292
}
9393
],
94-
"purl": "pkg:pypi/[email protected].3",
94+
"purl": "pkg:pypi/[email protected].4",
9595
"properties": [
9696
{
9797
"name": "language",
@@ -356,7 +356,7 @@
356356
"type": "library",
357357
"bom-ref": "9-idna",
358358
"name": "idna",
359-
"version": "3.6",
359+
"version": "3.7",
360360
"supplier": {
361361
"name": "Kim Davies",
362362
"contact": [
@@ -365,16 +365,16 @@
365365
}
366366
]
367367
},
368-
"cpe": "cpe:2.3:a:kim_davies:idna:3.6:*:*:*:*:*:*:*",
368+
"cpe": "cpe:2.3:a:kim_davies:idna:3.7:*:*:*:*:*:*:*",
369369
"description": "Internationalized Domain Names in Applications (IDNA)",
370370
"externalReferences": [
371371
{
372-
"url": "https://pypi.org/project/idna/3.6",
372+
"url": "https://pypi.org/project/idna/3.7",
373373
"type": "distribution",
374374
"comment": "Download location for component"
375375
}
376376
],
377-
"purl": "pkg:pypi/idna@3.6",
377+
"purl": "pkg:pypi/idna@3.7",
378378
"properties": [
379379
{
380380
"name": "language",
@@ -472,7 +472,7 @@
472472
"type": "library",
473473
"bom-ref": "12-cvss",
474474
"name": "cvss",
475-
"version": "3.0",
475+
"version": "3.1",
476476
"supplier": {
477477
"name": "Stanislav Red Hat Product Security",
478478
"contact": [
@@ -481,14 +481,8 @@
481481
}
482482
]
483483
},
484-
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.0:*:*:*:*:*:*:*",
484+
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*",
485485
"description": "CVSS2/3/4 library with interactive calculator for Python 2 and Python 3",
486-
"hashes": [
487-
{
488-
"alg": "SHA-1",
489-
"content": "c637e63a16b7411c6135b5ae8bb5408d06d89b41"
490-
}
491-
],
492486
"licenses": [
493487
{
494488
"license": {
@@ -499,12 +493,12 @@
499493
],
500494
"externalReferences": [
501495
{
502-
"url": "https://pypi.org/project/cvss/3.0",
496+
"url": "https://pypi.org/project/cvss/3.1",
503497
"type": "distribution",
504498
"comment": "Download location for component"
505499
}
506500
],
507-
"purl": "pkg:pypi/cvss@3.0",
501+
"purl": "pkg:pypi/cvss@3.1",
508502
"properties": [
509503
{
510504
"name": "language",
@@ -700,7 +694,7 @@
700694
"type": "library",
701695
"bom-ref": "17-argcomplete",
702696
"name": "argcomplete",
703-
"version": "3.2.3",
697+
"version": "3.3.0",
704698
"supplier": {
705699
"name": "Andrey Kislyuk",
706700
"contact": [
@@ -709,7 +703,7 @@
709703
}
710704
]
711705
},
712-
"cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.2.3:*:*:*:*:*:*:*",
706+
"cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.3.0:*:*:*:*:*:*:*",
713707
"description": "Bash tab completion for argparse",
714708
"licenses": [
715709
{
@@ -721,12 +715,12 @@
721715
],
722716
"externalReferences": [
723717
{
724-
"url": "https://pypi.org/project/argcomplete/3.2.3",
718+
"url": "https://pypi.org/project/argcomplete/3.3.0",
725719
"type": "distribution",
726720
"comment": "Download location for component"
727721
}
728722
],
729-
"purl": "pkg:pypi/argcomplete@3.2.3",
723+
"purl": "pkg:pypi/argcomplete@3.3.0",
730724
"properties": [
731725
{
732726
"name": "language",

‎sbom/cve-bin-tool-py3.9.spdx

Lines changed: 22 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,42 +2,42 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-179884b8-4d95-4ae4-9d55-d569d800b01a
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-07124c73-1f18-4124-ac1c-c53724579633
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.4
8-
Created: 2024-04-08T00:26:09Z
8+
Created: 2024-04-15T02:41:52Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

1212
PackageName: cve-bin-tool
1313
SPDXID: SPDXRef-Package-1-cve-bin-tool
14-
PackageVersion: 3.3rc2
14+
PackageVersion: 3.3
1515
PrimaryPackagePurpose: APPLICATION
1616
PackageSupplier: Person: Terri Oda ([email protected])
17-
PackageDownloadLocation: https://pypi.org/project/cve-bin-tool/3.3rc2
17+
PackageDownloadLocation: https://pypi.org/project/cve-bin-tool/3.3
1818
FilesAnalyzed: false
19-
PackageChecksum: SHA1: c491590aeea36235930d1c6b8480d2489a470ece
19+
PackageChecksum: SHA1: 83e30ee0f640bce7a20d4346c85873d359c05d1f
2020
PackageLicenseDeclared: GPL-3.0-or-later
2121
PackageLicenseConcluded: GPL-3.0-or-later
2222
PackageCopyrightText: NOASSERTION
2323
PackageSummary: <text>CVE Binary Checker Tool</text>
24-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cve-bin-tool@3.3rc2
25-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.3rc2:*:*:*:*:*:*:*
24+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cve-bin-tool@3.3
25+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.3:*:*:*:*:*:*:*
2626
#####
2727

2828
PackageName: aiohttp
2929
SPDXID: SPDXRef-Package-2-aiohttp
30-
PackageVersion: 3.9.3
30+
PackageVersion: 3.9.4
3131
PrimaryPackagePurpose: LIBRARY
3232
PackageSupplier: NOASSERTION
33-
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.9.3
33+
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.9.4
3434
FilesAnalyzed: false
3535
PackageLicenseDeclared: NOASSERTION
3636
PackageLicenseConcluded: Apache-2.0
3737
PackageLicenseComments: <text>aiohttp declares Apache 2 which is not currently a valid SPDX License identifier or expression.</text>
3838
PackageCopyrightText: NOASSERTION
3939
PackageSummary: <text>Async http client/server framework (asyncio)</text>
40-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].3
40+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].4
4141
#####
4242

4343
PackageName: aiosignal
@@ -137,17 +137,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.4:*:*:*:*:*:*:
137137

138138
PackageName: idna
139139
SPDXID: SPDXRef-Package-9-idna
140-
PackageVersion: 3.6
140+
PackageVersion: 3.7
141141
PrimaryPackagePurpose: LIBRARY
142142
PackageSupplier: Person: Kim Davies ([email protected])
143-
PackageDownloadLocation: https://pypi.org/project/idna/3.6
143+
PackageDownloadLocation: https://pypi.org/project/idna/3.7
144144
FilesAnalyzed: false
145145
PackageLicenseDeclared: NOASSERTION
146146
PackageLicenseConcluded: NOASSERTION
147147
PackageCopyrightText: NOASSERTION
148148
PackageSummary: <text>Internationalized Domain Names in Applications (IDNA)</text>
149-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/idna@3.6
150-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.6:*:*:*:*:*:*:*
149+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/idna@3.7
150+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.7:*:*:*:*:*:*:*
151151
#####
152152

153153
PackageName: beautifulsoup4
@@ -184,19 +184,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:isaac_muse:soupsieve:2.5:*:*:*:*:*:*:*
184184

185185
PackageName: cvss
186186
SPDXID: SPDXRef-Package-12-cvss
187-
PackageVersion: 3.0
187+
PackageVersion: 3.1
188188
PrimaryPackagePurpose: LIBRARY
189189
PackageSupplier: Organization: Stanislav Red Hat Product Security ([email protected])
190-
PackageDownloadLocation: https://pypi.org/project/cvss/3.0
190+
PackageDownloadLocation: https://pypi.org/project/cvss/3.1
191191
FilesAnalyzed: false
192-
PackageChecksum: SHA1: c637e63a16b7411c6135b5ae8bb5408d06d89b41
193192
PackageLicenseDeclared: NOASSERTION
194193
PackageLicenseConcluded: LGPL-3.0-or-later
195194
PackageLicenseComments: <text>cvss declares LGPLv3+ which is not currently a valid SPDX License identifier or expression.</text>
196195
PackageCopyrightText: NOASSERTION
197196
PackageSummary: <text>CVSS2/3/4 library with interactive calculator for Python 2 and Python 3</text>
198-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cvss@3.0
199-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.0:*:*:*:*:*:*:*
197+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cvss@3.1
198+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*
200199
#####
201200

202201
PackageName: defusedxml
@@ -266,18 +265,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.27:*:*:*:*:*:*:*
266265

267266
PackageName: argcomplete
268267
SPDXID: SPDXRef-Package-17-argcomplete
269-
PackageVersion: 3.2.3
268+
PackageVersion: 3.3.0
270269
PrimaryPackagePurpose: LIBRARY
271270
PackageSupplier: Person: Andrey Kislyuk ([email protected])
272-
PackageDownloadLocation: https://pypi.org/project/argcomplete/3.2.3
271+
PackageDownloadLocation: https://pypi.org/project/argcomplete/3.3.0
273272
FilesAnalyzed: false
274273
PackageLicenseDeclared: NOASSERTION
275274
PackageLicenseConcluded: Apache-2.0
276275
PackageLicenseComments: <text>argcomplete declares Apache Software License which is not currently a valid SPDX License identifier or expression.</text>
277276
PackageCopyrightText: NOASSERTION
278277
PackageSummary: <text>Bash tab completion for argparse</text>
279-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/argcomplete@3.2.3
280-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_kislyuk:argcomplete:3.2.3:*:*:*:*:*:*:*
278+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/argcomplete@3.3.0
279+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_kislyuk:argcomplete:3.3.0:*:*:*:*:*:*:*
281280
#####
282281

283282
PackageName: crcmod

0 commit comments

Comments
 (0)