Skip to content

Commit 876082b

Browse files
web-flowgithub-actions[bot]
web-flow
authored and
github-actions[bot]
committed
chore: update SBOM for Python 3.8
1 parent 2f393e9 commit 876082b

File tree

2 files changed

+86
-30
lines changed

2 files changed

+86
-30
lines changed

‎sbom/cve-bin-tool-py3.8.json

Lines changed: 64 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
33
"bomFormat": "CycloneDX",
4-
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:3011e948-50cd-43d1-a1c6-42af9dba80ba",
4+
"specVersion": "1.6",
5+
"serialNumber": "urn:uuid:f71e88da-e1db-49f6-acbf-30c67afd914a",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-04-22T00:28:09Z",
8+
"timestamp": "2024-04-29T00:27:35Z",
99
"tools": {
1010
"components": [
1111
{
@@ -361,6 +361,12 @@
361361
},
362362
"cpe": "cpe:2.3:a:kim_davies:idna:3.7:*:*:*:*:*:*:*",
363363
"description": "Internationalized Domain Names in Applications (IDNA)",
364+
"hashes": [
365+
{
366+
"alg": "SHA-1",
367+
"content": "1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"
368+
}
369+
],
364370
"externalReferences": [
365371
{
366372
"url": "https://pypi.org/project/idna/3.7",
@@ -699,6 +705,12 @@
699705
},
700706
"cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.3.0:*:*:*:*:*:*:*",
701707
"description": "Bash tab completion for argparse",
708+
"hashes": [
709+
{
710+
"alg": "SHA-1",
711+
"content": "c7cc834df1fddcf94bd35b740fef7c7ab8e9c350"
712+
}
713+
],
702714
"licenses": [
703715
{
704716
"license": {
@@ -1376,6 +1388,12 @@
13761388
},
13771389
"cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.5:*:*:*:*:*:*:*",
13781390
"description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.",
1391+
"hashes": [
1392+
{
1393+
"alg": "SHA-1",
1394+
"content": "33833f031d9d36234e11d9671be150d53b9e598d"
1395+
}
1396+
],
13791397
"licenses": [
13801398
{
13811399
"expression": "Apache-2.0 OR BSD-3-Clause"
@@ -1463,6 +1481,12 @@
14631481
},
14641482
"cpe": "cpe:2.3:a:eli_bendersky:pycparser:2.22:*:*:*:*:*:*:*",
14651483
"description": "C parser in Python",
1484+
"hashes": [
1485+
{
1486+
"alg": "SHA-1",
1487+
"content": "129d32ef805d715d90a3b2035b13168c17ca63d2"
1488+
}
1489+
],
14661490
"licenses": [
14671491
{
14681492
"license": {
@@ -1733,6 +1757,12 @@
17331757
},
17341758
"cpe": "cpe:2.3:a:jason_r._coombs:importlib-metadata:7.1.0:*:*:*:*:*:*:*",
17351759
"description": "Read metadata from Python packages",
1760+
"hashes": [
1761+
{
1762+
"alg": "SHA-1",
1763+
"content": "f5d6b5f3f3f6fffe01b340c5a19562433db148a9"
1764+
}
1765+
],
17361766
"externalReferences": [
17371767
{
17381768
"url": "https://pypi.org/project/importlib_metadata/7.1.0",
@@ -1767,6 +1797,12 @@
17671797
},
17681798
"cpe": "cpe:2.3:a:jason_r._coombs:zipp:3.18.1:*:*:*:*:*:*:*",
17691799
"description": "Backport of pathlib-compatible object wrapper for zip files",
1800+
"hashes": [
1801+
{
1802+
"alg": "SHA-1",
1803+
"content": "bfae83474a730e8cc9b8a71027fb859b46b3875c"
1804+
}
1805+
],
17701806
"externalReferences": [
17711807
{
17721808
"url": "https://pypi.org/project/zipp/3.18.1",
@@ -1801,6 +1837,12 @@
18011837
},
18021838
"cpe": "cpe:2.3:a:barry_warsaw:importlib-resources:6.4.0:*:*:*:*:*:*:*",
18031839
"description": "Read resources from Python packages",
1840+
"hashes": [
1841+
{
1842+
"alg": "SHA-1",
1843+
"content": "1f4d3f10a3ed5d65b3092a39369c08e71e30a97c"
1844+
}
1845+
],
18041846
"externalReferences": [
18051847
{
18061848
"url": "https://pypi.org/project/importlib_resources/6.4.0",
@@ -1982,20 +2024,20 @@
19822024
"type": "library",
19832025
"bom-ref": "47-referencing",
19842026
"name": "referencing",
1985-
"version": "0.34.0",
2027+
"version": "0.35.0",
19862028
"supplier": {
19872029
"name": "Julian Berman"
19882030
},
1989-
"cpe": "cpe:2.3:a:julian_berman:referencing:0.34.0:*:*:*:*:*:*:*",
2031+
"cpe": "cpe:2.3:a:julian_berman:referencing:0.35.0:*:*:*:*:*:*:*",
19902032
"description": "JSON Referencing + Python",
19912033
"externalReferences": [
19922034
{
1993-
"url": "https://pypi.org/project/referencing/0.34.0",
2035+
"url": "https://pypi.org/project/referencing/0.35.0",
19942036
"type": "distribution",
19952037
"comment": "Download location for component"
19962038
}
19972039
],
1998-
"purl": "pkg:pypi/referencing@0.34.0",
2040+
"purl": "pkg:pypi/referencing@0.35.0",
19992041
"properties": [
20002042
{
20012043
"name": "language",
@@ -2082,7 +2124,7 @@
20822124
"type": "library",
20832125
"bom-ref": "50-lib4sbom",
20842126
"name": "lib4sbom",
2085-
"version": "0.7.0",
2127+
"version": "0.7.1",
20862128
"supplier": {
20872129
"name": "Anthony Harrison",
20882130
"contact": [
@@ -2091,7 +2133,7 @@
20912133
}
20922134
]
20932135
},
2094-
"cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.7.0:*:*:*:*:*:*:*",
2136+
"cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.7.1:*:*:*:*:*:*:*",
20952137
"description": "Software Bill of Material (SBOM) generator and consumer library",
20962138
"licenses": [
20972139
{
@@ -2103,12 +2145,12 @@
21032145
],
21042146
"externalReferences": [
21052147
{
2106-
"url": "https://pypi.org/project/lib4sbom/0.7.0",
2148+
"url": "https://pypi.org/project/lib4sbom/0.7.1",
21072149
"type": "distribution",
21082150
"comment": "Download location for component"
21092151
}
21102152
],
2111-
"purl": "pkg:pypi/[email protected].0",
2153+
"purl": "pkg:pypi/[email protected].1",
21122154
"properties": [
21132155
{
21142156
"name": "language",
@@ -2788,6 +2830,12 @@
27882830
},
27892831
"cpe": "cpe:2.3:a:guido_van_jukka_ukasz_michael:typing-extensions:4.11.0:*:*:*:*:*:*:*",
27902832
"description": "Backported and Experimental Type Hints for Python 3.8+",
2833+
"hashes": [
2834+
{
2835+
"alg": "SHA-1",
2836+
"content": "d4d929d44bd984350e2d17726362295f588eaace"
2837+
}
2838+
],
27912839
"externalReferences": [
27922840
{
27932841
"url": "https://pypi.org/project/typing_extensions/4.11.0",
@@ -2901,7 +2949,7 @@
29012949
"type": "library",
29022950
"bom-ref": "69-xmlschema",
29032951
"name": "xmlschema",
2904-
"version": "3.3.0",
2952+
"version": "3.3.1",
29052953
"supplier": {
29062954
"name": "Davide Brunato",
29072955
"contact": [
@@ -2910,7 +2958,7 @@
29102958
}
29112959
]
29122960
},
2913-
"cpe": "cpe:2.3:a:davide_brunato:xmlschema:3.3.0:*:*:*:*:*:*:*",
2961+
"cpe": "cpe:2.3:a:davide_brunato:xmlschema:3.3.1:*:*:*:*:*:*:*",
29142962
"description": "An XML Schema validator and decoder",
29152963
"licenses": [
29162964
{
@@ -2922,12 +2970,12 @@
29222970
],
29232971
"externalReferences": [
29242972
{
2925-
"url": "https://pypi.org/project/xmlschema/3.3.0",
2973+
"url": "https://pypi.org/project/xmlschema/3.3.1",
29262974
"type": "distribution",
29272975
"comment": "Download location for component"
29282976
}
29292977
],
2930-
"purl": "pkg:pypi/[email protected].0",
2978+
"purl": "pkg:pypi/[email protected].1",
29312979
"properties": [
29322980
{
29332981
"name": "language",

‎sbom/cve-bin-tool-py3.8.spdx

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-a059f2f9-c142-41b3-b870-0e0c0f91d08b
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-3e09fd99-db2d-4685-ac0b-5dc0d4c7b348
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.4
8-
Created: 2024-04-22T00:26:48Z
8+
Created: 2024-04-29T00:26:10Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -141,6 +141,7 @@ PrimaryPackagePurpose: LIBRARY
141141
PackageSupplier: Person: Kim Davies ([email protected])
142142
PackageDownloadLocation: https://pypi.org/project/idna/3.7
143143
FilesAnalyzed: false
144+
PackageChecksum: SHA1: 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
144145
PackageLicenseDeclared: NOASSERTION
145146
PackageLicenseConcluded: NOASSERTION
146147
PackageCopyrightText: NOASSERTION
@@ -269,6 +270,7 @@ PrimaryPackagePurpose: LIBRARY
269270
PackageSupplier: Person: Andrey Kislyuk ([email protected])
270271
PackageDownloadLocation: https://pypi.org/project/argcomplete/3.3.0
271272
FilesAnalyzed: false
273+
PackageChecksum: SHA1: c7cc834df1fddcf94bd35b740fef7c7ab8e9c350
272274
PackageLicenseDeclared: NOASSERTION
273275
PackageLicenseConcluded: Apache-2.0
274276
PackageLicenseComments: <text>argcomplete declares Apache Software License which is not currently a valid SPDX License identifier or expression.</text>
@@ -512,6 +514,7 @@ PrimaryPackagePurpose: LIBRARY
512514
PackageSupplier: Organization: The Python Cryptographic Authority and individual contributors ([email protected])
513515
PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.5
514516
FilesAnalyzed: false
517+
PackageChecksum: SHA1: 33833f031d9d36234e11d9671be150d53b9e598d
515518
PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause
516519
PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause
517520
PackageCopyrightText: NOASSERTION
@@ -543,6 +546,7 @@ PrimaryPackagePurpose: LIBRARY
543546
PackageSupplier: Person: Eli Bendersky ([email protected])
544547
PackageDownloadLocation: https://pypi.org/project/pycparser/2.22
545548
FilesAnalyzed: false
549+
PackageChecksum: SHA1: 129d32ef805d715d90a3b2035b13168c17ca63d2
546550
PackageLicenseDeclared: BSD-3-Clause
547551
PackageLicenseConcluded: BSD-3-Clause
548552
PackageCopyrightText: NOASSERTION
@@ -639,6 +643,7 @@ PrimaryPackagePurpose: LIBRARY
639643
PackageSupplier: Organization: Jason R. Coombs ([email protected])
640644
PackageDownloadLocation: https://pypi.org/project/importlib_metadata/7.1.0
641645
FilesAnalyzed: false
646+
PackageChecksum: SHA1: f5d6b5f3f3f6fffe01b340c5a19562433db148a9
642647
PackageLicenseDeclared: NOASSERTION
643648
PackageLicenseConcluded: NOASSERTION
644649
PackageCopyrightText: NOASSERTION
@@ -654,6 +659,7 @@ PrimaryPackagePurpose: LIBRARY
654659
PackageSupplier: Organization: Jason R. Coombs ([email protected])
655660
PackageDownloadLocation: https://pypi.org/project/zipp/3.18.1
656661
FilesAnalyzed: false
662+
PackageChecksum: SHA1: bfae83474a730e8cc9b8a71027fb859b46b3875c
657663
PackageLicenseDeclared: NOASSERTION
658664
PackageLicenseConcluded: NOASSERTION
659665
PackageCopyrightText: NOASSERTION
@@ -669,6 +675,7 @@ PrimaryPackagePurpose: LIBRARY
669675
PackageSupplier: Person: Barry Warsaw ([email protected])
670676
PackageDownloadLocation: https://pypi.org/project/importlib_resources/6.4.0
671677
FilesAnalyzed: false
678+
PackageChecksum: SHA1: 1f4d3f10a3ed5d65b3092a39369c08e71e30a97c
672679
PackageLicenseDeclared: NOASSERTION
673680
PackageLicenseConcluded: NOASSERTION
674681
PackageCopyrightText: NOASSERTION
@@ -740,17 +747,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:jsonschema-specification
740747

741748
PackageName: referencing
742749
SPDXID: SPDXRef-Package-47-referencing
743-
PackageVersion: 0.34.0
750+
PackageVersion: 0.35.0
744751
PrimaryPackagePurpose: LIBRARY
745752
PackageSupplier: Person: Julian Berman
746-
PackageDownloadLocation: https://pypi.org/project/referencing/0.34.0
753+
PackageDownloadLocation: https://pypi.org/project/referencing/0.35.0
747754
FilesAnalyzed: false
748755
PackageLicenseDeclared: NOASSERTION
749756
PackageLicenseConcluded: NOASSERTION
750757
PackageCopyrightText: NOASSERTION
751758
PackageSummary: <text>JSON Referencing + Python</text>
752-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/referencing@0.34.0
753-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.34.0:*:*:*:*:*:*:*
759+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/referencing@0.35.0
760+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.35.0:*:*:*:*:*:*:*
754761
#####
755762

756763
PackageName: rpds-py
@@ -785,17 +792,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:vinay_sajip:pkgutil-resolve-name:1.3.1
785792

786793
PackageName: lib4sbom
787794
SPDXID: SPDXRef-Package-50-lib4sbom
788-
PackageVersion: 0.7.0
795+
PackageVersion: 0.7.1
789796
PrimaryPackagePurpose: LIBRARY
790797
PackageSupplier: Person: Anthony Harrison ([email protected])
791-
PackageDownloadLocation: https://pypi.org/project/lib4sbom/0.7.0
798+
PackageDownloadLocation: https://pypi.org/project/lib4sbom/0.7.1
792799
FilesAnalyzed: false
793800
PackageLicenseDeclared: Apache-2.0
794801
PackageLicenseConcluded: Apache-2.0
795802
PackageCopyrightText: NOASSERTION
796803
PackageSummary: <text>Software Bill of Material (SBOM) generator and consumer library</text>
797-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
798-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.7.0:*:*:*:*:*:*:*
804+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
805+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.7.1:*:*:*:*:*:*:*
799806
#####
800807

801808
PackageName: pyyaml
@@ -1044,6 +1051,7 @@ PrimaryPackagePurpose: LIBRARY
10441051
PackageSupplier: Organization: Guido van Jukka ukasz Michael ([email protected])
10451052
PackageDownloadLocation: https://pypi.org/project/typing_extensions/4.11.0
10461053
FilesAnalyzed: false
1054+
PackageChecksum: SHA1: d4d929d44bd984350e2d17726362295f588eaace
10471055
PackageLicenseDeclared: NOASSERTION
10481056
PackageLicenseConcluded: NOASSERTION
10491057
PackageCopyrightText: NOASSERTION
@@ -1085,17 +1093,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:william_pearson:toml:0.10.2:*:*:*:*:*:
10851093

10861094
PackageName: xmlschema
10871095
SPDXID: SPDXRef-Package-69-xmlschema
1088-
PackageVersion: 3.3.0
1096+
PackageVersion: 3.3.1
10891097
PrimaryPackagePurpose: LIBRARY
10901098
PackageSupplier: Person: Davide Brunato ([email protected])
1091-
PackageDownloadLocation: https://pypi.org/project/xmlschema/3.3.0
1099+
PackageDownloadLocation: https://pypi.org/project/xmlschema/3.3.1
10921100
FilesAnalyzed: false
10931101
PackageLicenseDeclared: MIT
10941102
PackageLicenseConcluded: MIT
10951103
PackageCopyrightText: NOASSERTION
10961104
PackageSummary: <text>An XML Schema validator and decoder</text>
1097-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
1098-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.3.0:*:*:*:*:*:*:*
1105+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
1106+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.3.1:*:*:*:*:*:*:*
10991107
#####
11001108

11011109
PackageName: elementpath

0 commit comments

Comments
 (0)