Skip to content

Commit 4eb0333

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.12 (#4094)
Co-authored-by: GitHub <[email protected]>
1 parent 9578524 commit 4eb0333

File tree

2 files changed

+58
-30
lines changed

2 files changed

+58
-30
lines changed

‎sbom/cve-bin-tool-py3.12.json

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
33
"bomFormat": "CycloneDX",
4-
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:0acfe7bf-745e-4b5d-b8fe-4730e94a4f6d",
4+
"specVersion": "1.6",
5+
"serialNumber": "urn:uuid:6cea83d8-e0e4-409a-9626-7141d6bb5e04",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-04-22T00:27:41Z",
8+
"timestamp": "2024-04-29T00:26:56Z",
99
"tools": {
1010
"components": [
1111
{
@@ -313,6 +313,12 @@
313313
},
314314
"cpe": "cpe:2.3:a:kim_davies:idna:3.7:*:*:*:*:*:*:*",
315315
"description": "Internationalized Domain Names in Applications (IDNA)",
316+
"hashes": [
317+
{
318+
"alg": "SHA-1",
319+
"content": "1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"
320+
}
321+
],
316322
"externalReferences": [
317323
{
318324
"url": "https://pypi.org/project/idna/3.7",
@@ -651,6 +657,12 @@
651657
},
652658
"cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.3.0:*:*:*:*:*:*:*",
653659
"description": "Bash tab completion for argparse",
660+
"hashes": [
661+
{
662+
"alg": "SHA-1",
663+
"content": "c7cc834df1fddcf94bd35b740fef7c7ab8e9c350"
664+
}
665+
],
654666
"licenses": [
655667
{
656668
"license": {
@@ -1328,6 +1340,12 @@
13281340
},
13291341
"cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.5:*:*:*:*:*:*:*",
13301342
"description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.",
1343+
"hashes": [
1344+
{
1345+
"alg": "SHA-1",
1346+
"content": "33833f031d9d36234e11d9671be150d53b9e598d"
1347+
}
1348+
],
13311349
"licenses": [
13321350
{
13331351
"expression": "Apache-2.0 OR BSD-3-Clause"
@@ -1415,6 +1433,12 @@
14151433
},
14161434
"cpe": "cpe:2.3:a:eli_bendersky:pycparser:2.22:*:*:*:*:*:*:*",
14171435
"description": "C parser in Python",
1436+
"hashes": [
1437+
{
1438+
"alg": "SHA-1",
1439+
"content": "129d32ef805d715d90a3b2035b13168c17ca63d2"
1440+
}
1441+
],
14181442
"licenses": [
14191443
{
14201444
"license": {
@@ -1832,20 +1856,20 @@
18321856
"type": "library",
18331857
"bom-ref": "43-referencing",
18341858
"name": "referencing",
1835-
"version": "0.34.0",
1859+
"version": "0.35.0",
18361860
"supplier": {
18371861
"name": "Julian Berman"
18381862
},
1839-
"cpe": "cpe:2.3:a:julian_berman:referencing:0.34.0:*:*:*:*:*:*:*",
1863+
"cpe": "cpe:2.3:a:julian_berman:referencing:0.35.0:*:*:*:*:*:*:*",
18401864
"description": "JSON Referencing + Python",
18411865
"externalReferences": [
18421866
{
1843-
"url": "https://pypi.org/project/referencing/0.34.0",
1867+
"url": "https://pypi.org/project/referencing/0.35.0",
18441868
"type": "distribution",
18451869
"comment": "Download location for component"
18461870
}
18471871
],
1848-
"purl": "pkg:pypi/referencing@0.34.0",
1872+
"purl": "pkg:pypi/referencing@0.35.0",
18491873
"properties": [
18501874
{
18511875
"name": "language",
@@ -1898,7 +1922,7 @@
18981922
"type": "library",
18991923
"bom-ref": "45-lib4sbom",
19001924
"name": "lib4sbom",
1901-
"version": "0.7.0",
1925+
"version": "0.7.1",
19021926
"supplier": {
19031927
"name": "Anthony Harrison",
19041928
"contact": [
@@ -1907,7 +1931,7 @@
19071931
}
19081932
]
19091933
},
1910-
"cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.7.0:*:*:*:*:*:*:*",
1934+
"cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.7.1:*:*:*:*:*:*:*",
19111935
"description": "Software Bill of Material (SBOM) generator and consumer library",
19121936
"licenses": [
19131937
{
@@ -1919,12 +1943,12 @@
19191943
],
19201944
"externalReferences": [
19211945
{
1922-
"url": "https://pypi.org/project/lib4sbom/0.7.0",
1946+
"url": "https://pypi.org/project/lib4sbom/0.7.1",
19231947
"type": "distribution",
19241948
"comment": "Download location for component"
19251949
}
19261950
],
1927-
"purl": "pkg:pypi/[email protected].0",
1951+
"purl": "pkg:pypi/[email protected].1",
19281952
"properties": [
19291953
{
19301954
"name": "language",
@@ -2635,7 +2659,7 @@
26352659
"type": "library",
26362660
"bom-ref": "62-xmlschema",
26372661
"name": "xmlschema",
2638-
"version": "3.3.0",
2662+
"version": "3.3.1",
26392663
"supplier": {
26402664
"name": "Davide Brunato",
26412665
"contact": [
@@ -2644,7 +2668,7 @@
26442668
}
26452669
]
26462670
},
2647-
"cpe": "cpe:2.3:a:davide_brunato:xmlschema:3.3.0:*:*:*:*:*:*:*",
2671+
"cpe": "cpe:2.3:a:davide_brunato:xmlschema:3.3.1:*:*:*:*:*:*:*",
26482672
"description": "An XML Schema validator and decoder",
26492673
"licenses": [
26502674
{
@@ -2656,12 +2680,12 @@
26562680
],
26572681
"externalReferences": [
26582682
{
2659-
"url": "https://pypi.org/project/xmlschema/3.3.0",
2683+
"url": "https://pypi.org/project/xmlschema/3.3.1",
26602684
"type": "distribution",
26612685
"comment": "Download location for component"
26622686
}
26632687
],
2664-
"purl": "pkg:pypi/[email protected].0",
2688+
"purl": "pkg:pypi/[email protected].1",
26652689
"properties": [
26662690
{
26672691
"name": "language",

‎sbom/cve-bin-tool-py3.12.spdx

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-aaa91dd7-47bb-4ce8-b80c-b04e18631b28
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-0f3c0601-aa4c-44f2-9ea1-8d4b70b94f9a
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.4
8-
Created: 2024-04-22T00:26:28Z
8+
Created: 2024-04-29T00:25:47Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -124,6 +124,7 @@ PrimaryPackagePurpose: LIBRARY
124124
PackageSupplier: Person: Kim Davies ([email protected])
125125
PackageDownloadLocation: https://pypi.org/project/idna/3.7
126126
FilesAnalyzed: false
127+
PackageChecksum: SHA1: 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
127128
PackageLicenseDeclared: NOASSERTION
128129
PackageLicenseConcluded: NOASSERTION
129130
PackageCopyrightText: NOASSERTION
@@ -252,6 +253,7 @@ PrimaryPackagePurpose: LIBRARY
252253
PackageSupplier: Person: Andrey Kislyuk ([email protected])
253254
PackageDownloadLocation: https://pypi.org/project/argcomplete/3.3.0
254255
FilesAnalyzed: false
256+
PackageChecksum: SHA1: c7cc834df1fddcf94bd35b740fef7c7ab8e9c350
255257
PackageLicenseDeclared: NOASSERTION
256258
PackageLicenseConcluded: Apache-2.0
257259
PackageLicenseComments: <text>argcomplete declares Apache Software License which is not currently a valid SPDX License identifier or expression.</text>
@@ -495,6 +497,7 @@ PrimaryPackagePurpose: LIBRARY
495497
PackageSupplier: Organization: The Python Cryptographic Authority and individual contributors ([email protected])
496498
PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.5
497499
FilesAnalyzed: false
500+
PackageChecksum: SHA1: 33833f031d9d36234e11d9671be150d53b9e598d
498501
PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause
499502
PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause
500503
PackageCopyrightText: NOASSERTION
@@ -526,6 +529,7 @@ PrimaryPackagePurpose: LIBRARY
526529
PackageSupplier: Person: Eli Bendersky ([email protected])
527530
PackageDownloadLocation: https://pypi.org/project/pycparser/2.22
528531
FilesAnalyzed: false
532+
PackageChecksum: SHA1: 129d32ef805d715d90a3b2035b13168c17ca63d2
529533
PackageLicenseDeclared: BSD-3-Clause
530534
PackageLicenseConcluded: BSD-3-Clause
531535
PackageCopyrightText: NOASSERTION
@@ -678,17 +682,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:jsonschema-specification
678682

679683
PackageName: referencing
680684
SPDXID: SPDXRef-Package-43-referencing
681-
PackageVersion: 0.34.0
685+
PackageVersion: 0.35.0
682686
PrimaryPackagePurpose: LIBRARY
683687
PackageSupplier: Person: Julian Berman
684-
PackageDownloadLocation: https://pypi.org/project/referencing/0.34.0
688+
PackageDownloadLocation: https://pypi.org/project/referencing/0.35.0
685689
FilesAnalyzed: false
686690
PackageLicenseDeclared: NOASSERTION
687691
PackageLicenseConcluded: NOASSERTION
688692
PackageCopyrightText: NOASSERTION
689693
PackageSummary: <text>JSON Referencing + Python</text>
690-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/referencing@0.34.0
691-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.34.0:*:*:*:*:*:*:*
694+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/referencing@0.35.0
695+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.35.0:*:*:*:*:*:*:*
692696
#####
693697

694698
PackageName: rpds-py
@@ -708,17 +712,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.18.0:*:*:*:*:*
708712

709713
PackageName: lib4sbom
710714
SPDXID: SPDXRef-Package-45-lib4sbom
711-
PackageVersion: 0.7.0
715+
PackageVersion: 0.7.1
712716
PrimaryPackagePurpose: LIBRARY
713717
PackageSupplier: Person: Anthony Harrison ([email protected])
714-
PackageDownloadLocation: https://pypi.org/project/lib4sbom/0.7.0
718+
PackageDownloadLocation: https://pypi.org/project/lib4sbom/0.7.1
715719
FilesAnalyzed: false
716720
PackageLicenseDeclared: Apache-2.0
717721
PackageLicenseConcluded: Apache-2.0
718722
PackageCopyrightText: NOASSERTION
719723
PackageSummary: <text>Software Bill of Material (SBOM) generator and consumer library</text>
720-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
721-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.7.0:*:*:*:*:*:*:*
724+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
725+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.7.1:*:*:*:*:*:*:*
722726
#####
723727

724728
PackageName: pyyaml
@@ -977,17 +981,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:sean_ross:rpmfile:2.0.0:*:*:*:*:*:*:*
977981

978982
PackageName: xmlschema
979983
SPDXID: SPDXRef-Package-62-xmlschema
980-
PackageVersion: 3.3.0
984+
PackageVersion: 3.3.1
981985
PrimaryPackagePurpose: LIBRARY
982986
PackageSupplier: Person: Davide Brunato ([email protected])
983-
PackageDownloadLocation: https://pypi.org/project/xmlschema/3.3.0
987+
PackageDownloadLocation: https://pypi.org/project/xmlschema/3.3.1
984988
FilesAnalyzed: false
985989
PackageLicenseDeclared: MIT
986990
PackageLicenseConcluded: MIT
987991
PackageCopyrightText: NOASSERTION
988992
PackageSummary: <text>An XML Schema validator and decoder</text>
989-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
990-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.3.0:*:*:*:*:*:*:*
993+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
994+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.3.1:*:*:*:*:*:*:*
991995
#####
992996

993997
PackageName: elementpath

0 commit comments

Comments
 (0)