Skip to content

Commit 354fb83

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.8 (#3731)
Co-authored-by: GitHub <[email protected]>
1 parent 637f05c commit 354fb83

File tree

2 files changed

+56
-52
lines changed

2 files changed

+56
-52
lines changed

‎sbom/cve-bin-tool-py3.8.json

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:09b79a4d-7203-4677-92ec-142dbfff998a",
5+
"serialNumber": "urn:uuid:b9c99b89-e092-4115-bf81-5f009ee8d462",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-01-09T17:42:00Z",
8+
"timestamp": "2024-01-15T00:29:28Z",
99
"tools": {
1010
"components": [
1111
{
@@ -1400,6 +1400,12 @@
14001400
},
14011401
"cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:41.0.7:*:*:*:*:*:*:*",
14021402
"description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.",
1403+
"hashes": [
1404+
{
1405+
"alg": "SHA-1",
1406+
"content": "4054596afc6f2b6cfcc54f56c35c34e0e429cb66"
1407+
}
1408+
],
14031409
"licenses": [
14041410
{
14051411
"expression": "Apache-2.0 OR BSD-3-Clause"
@@ -1628,7 +1634,7 @@
16281634
"type": "library",
16291635
"bom-ref": "36-google-auth",
16301636
"name": "google-auth",
1631-
"version": "2.26.1",
1637+
"version": "2.26.2",
16321638
"supplier": {
16331639
"name": "Google Cloud Platform",
16341640
"contact": [
@@ -1637,7 +1643,7 @@
16371643
}
16381644
]
16391645
},
1640-
"cpe": "cpe:2.3:a:google_cloud_platform:google-auth:2.26.1:*:*:*:*:*:*:*",
1646+
"cpe": "cpe:2.3:a:google_cloud_platform:google-auth:2.26.2:*:*:*:*:*:*:*",
16411647
"description": "Google Authentication Library",
16421648
"licenses": [
16431649
{
@@ -1649,12 +1655,12 @@
16491655
],
16501656
"externalReferences": [
16511657
{
1652-
"url": "https://pypi.org/project/google-auth/2.26.1",
1658+
"url": "https://pypi.org/project/google-auth/2.26.2",
16531659
"type": "distribution",
16541660
"comment": "Download location for component"
16551661
}
16561662
],
1657-
"purl": "pkg:pypi/[email protected].1",
1663+
"purl": "pkg:pypi/[email protected].2",
16581664
"properties": [
16591665
{
16601666
"name": "language",
@@ -1888,23 +1894,8 @@
18881894
"type": "library",
18891895
"bom-ref": "42-jinja2",
18901896
"name": "jinja2",
1891-
"version": "3.1.2",
1892-
"supplier": {
1893-
"name": "Armin Ronacher",
1894-
"contact": [
1895-
{
1896-
"email": "[email protected]"
1897-
}
1898-
]
1899-
},
1900-
"cpe": "cpe:2.3:a:armin_ronacher:jinja2:3.1.2:*:*:*:*:*:*:*",
1897+
"version": "3.1.3",
19011898
"description": "A very fast and expressive template engine.",
1902-
"hashes": [
1903-
{
1904-
"alg": "SHA-1",
1905-
"content": "b08cd4bc64bb980df86ed2876978ae5735572280"
1906-
}
1907-
],
19081899
"licenses": [
19091900
{
19101901
"license": {
@@ -1915,12 +1906,12 @@
19151906
],
19161907
"externalReferences": [
19171908
{
1918-
"url": "https://pypi.org/project/Jinja2/3.1.2",
1909+
"url": "https://pypi.org/project/Jinja2/3.1.3",
19191910
"type": "distribution",
19201911
"comment": "Download location for component"
19211912
}
19221913
],
1923-
"purl": "pkg:pypi/[email protected].2",
1914+
"purl": "pkg:pypi/[email protected].3",
19241915
"properties": [
19251916
{
19261917
"name": "language",
@@ -2098,11 +2089,11 @@
20982089
"type": "library",
20992090
"bom-ref": "47-rpds-py",
21002091
"name": "rpds-py",
2101-
"version": "0.16.2",
2092+
"version": "0.17.1",
21022093
"supplier": {
21032094
"name": "Julian Berman"
21042095
},
2105-
"cpe": "cpe:2.3:a:julian_berman:rpds-py:0.16.2:*:*:*:*:*:*:*",
2096+
"cpe": "cpe:2.3:a:julian_berman:rpds-py:0.17.1:*:*:*:*:*:*:*",
21062097
"description": "Python bindings to Rust's persistent data structures (rpds)",
21072098
"licenses": [
21082099
{
@@ -2114,12 +2105,12 @@
21142105
],
21152106
"externalReferences": [
21162107
{
2117-
"url": "https://pypi.org/project/rpds-py/0.16.2",
2108+
"url": "https://pypi.org/project/rpds-py/0.17.1",
21182109
"type": "distribution",
21192110
"comment": "Download location for component"
21202111
}
21212112
],
2122-
"purl": "pkg:pypi/rpds-py@0.16.2",
2113+
"purl": "pkg:pypi/rpds-py@0.17.1",
21232114
"properties": [
21242115
{
21252116
"name": "language",
@@ -2317,6 +2308,12 @@
23172308
},
23182309
"cpe": "cpe:2.3:a:the_purl_authors:packageurl-python:0.13.4:*:*:*:*:*:*:*",
23192310
"description": "A purl aka. Package URL parser and builder",
2311+
"hashes": [
2312+
{
2313+
"alg": "SHA-1",
2314+
"content": "f7f41b89a941278e8f76c0aad3a9409c6583eda8"
2315+
}
2316+
],
23202317
"licenses": [
23212318
{
23222319
"license": {
@@ -2849,6 +2846,12 @@
28492846
},
28502847
"cpe": "cpe:2.3:a:georg_brandl:pygments:2.17.2:*:*:*:*:*:*:*",
28512848
"description": "Pygments is a syntax highlighting package written in Python.",
2849+
"hashes": [
2850+
{
2851+
"alg": "SHA-1",
2852+
"content": "ee30ce132ae252bd72f3a74c86d9314a2214d0b4"
2853+
}
2854+
],
28522855
"licenses": [
28532856
{
28542857
"license": {
@@ -3004,7 +3007,7 @@
30043007
"type": "library",
30053008
"bom-ref": "68-xmlschema",
30063009
"name": "xmlschema",
3007-
"version": "3.0.0",
3010+
"version": "3.0.1",
30083011
"supplier": {
30093012
"name": "Davide Brunato",
30103013
"contact": [
@@ -3013,7 +3016,7 @@
30133016
}
30143017
]
30153018
},
3016-
"cpe": "cpe:2.3:a:davide_brunato:xmlschema:3.0.0:*:*:*:*:*:*:*",
3019+
"cpe": "cpe:2.3:a:davide_brunato:xmlschema:3.0.1:*:*:*:*:*:*:*",
30173020
"description": "An XML Schema validator and decoder",
30183021
"licenses": [
30193022
{
@@ -3025,12 +3028,12 @@
30253028
],
30263029
"externalReferences": [
30273030
{
3028-
"url": "https://pypi.org/project/xmlschema/3.0.0",
3031+
"url": "https://pypi.org/project/xmlschema/3.0.1",
30293032
"type": "distribution",
30303033
"comment": "Download location for component"
30313034
}
30323035
],
3033-
"purl": "pkg:pypi/[email protected].0",
3036+
"purl": "pkg:pypi/[email protected].1",
30343037
"properties": [
30353038
{
30363039
"name": "language",

‎sbom/cve-bin-tool-py3.8.spdx

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-f326f51e-d6ad-4030-aabb-dabbcdd90a97
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-0940156b-7eca-4b05-a51f-026b0642bdb0
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.3
8-
Created: 2024-01-09T17:39:54Z
8+
Created: 2024-01-15T00:27:36Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -497,6 +497,7 @@ PrimaryPackagePurpose: LIBRARY
497497
PackageSupplier: Organization: The Python Cryptographic Authority and individual contributors ([email protected])
498498
PackageDownloadLocation: https://pypi.org/project/cryptography/41.0.7
499499
FilesAnalyzed: false
500+
PackageChecksum: SHA1: 4054596afc6f2b6cfcc54f56c35c34e0e429cb66
500501
PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause
501502
PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause
502503
PackageCopyrightText: NOASSERTION
@@ -573,18 +574,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:craig_citro:google-apitools:0.5.32:*:*
573574

574575
PackageName: google-auth
575576
SPDXID: SPDXRef-Package-36-google-auth
576-
PackageVersion: 2.26.1
577+
PackageVersion: 2.26.2
577578
PrimaryPackagePurpose: LIBRARY
578579
PackageSupplier: Organization: Google Cloud Platform ([email protected])
579-
PackageDownloadLocation: https://pypi.org/project/google-auth/2.26.1
580+
PackageDownloadLocation: https://pypi.org/project/google-auth/2.26.2
580581
FilesAnalyzed: false
581582
PackageLicenseDeclared: NOASSERTION
582583
PackageLicenseConcluded: Apache-2.0
583584
PackageLicenseComments: <text>google-auth declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
584585
PackageCopyrightText: NOASSERTION
585586
PackageSummary: <text>Google Authentication Library</text>
586-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
587-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_cloud_platform:google-auth:2.26.1:*:*:*:*:*:*:*
587+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
588+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_cloud_platform:google-auth:2.26.2:*:*:*:*:*:*:*
588589
#####
589590

590591
PackageName: cachetools
@@ -669,18 +670,16 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:barry_warsaw:importlib-resources:6.1.1
669670

670671
PackageName: jinja2
671672
SPDXID: SPDXRef-Package-42-jinja2
672-
PackageVersion: 3.1.2
673+
PackageVersion: 3.1.3
673674
PrimaryPackagePurpose: LIBRARY
674-
PackageSupplier: Person: Armin Ronacher ([email protected])
675-
PackageDownloadLocation: https://pypi.org/project/Jinja2/3.1.2
675+
PackageSupplier: NOASSERTION
676+
PackageDownloadLocation: https://pypi.org/project/Jinja2/3.1.3
676677
FilesAnalyzed: false
677-
PackageChecksum: SHA1: b08cd4bc64bb980df86ed2876978ae5735572280
678678
PackageLicenseDeclared: BSD-3-Clause
679679
PackageLicenseConcluded: BSD-3-Clause
680680
PackageCopyrightText: NOASSERTION
681681
PackageSummary: <text>A very fast and expressive template engine.</text>
682-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected]
683-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:armin_ronacher:jinja2:3.1.2:*:*:*:*:*:*:*
682+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected]
684683
#####
685684

686685
PackageName: markupsafe
@@ -747,17 +746,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.32.1:*:*:*
747746

748747
PackageName: rpds-py
749748
SPDXID: SPDXRef-Package-47-rpds-py
750-
PackageVersion: 0.16.2
749+
PackageVersion: 0.17.1
751750
PrimaryPackagePurpose: LIBRARY
752751
PackageSupplier: Person: Julian Berman
753-
PackageDownloadLocation: https://pypi.org/project/rpds-py/0.16.2
752+
PackageDownloadLocation: https://pypi.org/project/rpds-py/0.17.1
754753
FilesAnalyzed: false
755754
PackageLicenseDeclared: MIT
756755
PackageLicenseConcluded: MIT
757756
PackageCopyrightText: NOASSERTION
758757
PackageSummary: <text>Python bindings to Rust's persistent data structures (rpds)</text>
759-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/rpds-py@0.16.2
760-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.16.2:*:*:*:*:*:*:*
758+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/rpds-py@0.17.1
759+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.17.1:*:*:*:*:*:*:*
761760
#####
762761

763762
PackageName: pkgutil-resolve-name
@@ -830,6 +829,7 @@ PrimaryPackagePurpose: LIBRARY
830829
PackageSupplier: Person: the purl authors
831830
PackageDownloadLocation: https://pypi.org/project/packageurl-python/0.13.4
832831
FilesAnalyzed: false
832+
PackageChecksum: SHA1: f7f41b89a941278e8f76c0aad3a9409c6583eda8
833833
PackageLicenseDeclared: MIT
834834
PackageLicenseConcluded: MIT
835835
PackageCopyrightText: NOASSERTION
@@ -1021,6 +1021,7 @@ PrimaryPackagePurpose: LIBRARY
10211021
PackageSupplier: Person: Georg Brandl ([email protected])
10221022
PackageDownloadLocation: https://pypi.org/project/Pygments/2.17.2
10231023
FilesAnalyzed: false
1024+
PackageChecksum: SHA1: ee30ce132ae252bd72f3a74c86d9314a2214d0b4
10241025
PackageLicenseDeclared: BSD-2-Clause
10251026
PackageLicenseConcluded: BSD-2-Clause
10261027
PackageCopyrightText: NOASSERTION
@@ -1077,17 +1078,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:william_pearson:toml:0.10.2:*:*:*:*:*:
10771078

10781079
PackageName: xmlschema
10791080
SPDXID: SPDXRef-Package-68-xmlschema
1080-
PackageVersion: 3.0.0
1081+
PackageVersion: 3.0.1
10811082
PrimaryPackagePurpose: LIBRARY
10821083
PackageSupplier: Person: Davide Brunato ([email protected])
1083-
PackageDownloadLocation: https://pypi.org/project/xmlschema/3.0.0
1084+
PackageDownloadLocation: https://pypi.org/project/xmlschema/3.0.1
10841085
FilesAnalyzed: false
10851086
PackageLicenseDeclared: MIT
10861087
PackageLicenseConcluded: MIT
10871088
PackageCopyrightText: NOASSERTION
10881089
PackageSummary: <text>An XML Schema validator and decoder</text>
1089-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].0
1090-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.0.0:*:*:*:*:*:*:*
1090+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
1091+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.0.1:*:*:*:*:*:*:*
10911092
#####
10921093

10931094
PackageName: elementpath

0 commit comments

Comments
 (0)