Python 3.8 is end-of-life.
Signed-off-by: Simoh23999 [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Co-authored-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Indivar Mishra [email protected]
- Fix:
model.vulnerability.VulnerabilityReference's properties are all mandatory (#790 via #792) * Refactor: Renamespdx.is_compund_expression->spdx.is_expression(#779) * Behavior:BomRefaffects comparison/hashing (#754 & #780) This is only a breaking change if you relied on ordering of elements. * Behavior: streamline comparison/hashing functions (#755) This is only a breaking change if you relied on ordering of elements. * Dependency: bump dependencypy-serializable >=2 <3, was>=1.1.1 <2(#775) This is only a breaking change if you have other packages depend on that specific version.
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: wkoot [email protected]
Signed-off-by: semantic-release [email protected]
Co-authored-by: wkoot [email protected]
Co-authored-by: semantic-release [email protected]
supersedes https://github.com/CycloneDX/cyclonedx-python-lib/pull/773/files#r1954324461
Signed-off-by: Jan Kowalleck [email protected]
the following classes' init no longer raise NoPropertiesProvidedException: *
cyclonedx.model.IdentifiableAction * cyclonedx.model.component.Commit *
cyclonedx.model.component.ComponentEvidence * cyclonedx.model.component.Diff *
cyclonedx.model.component.Pedigree * cyclonedx.model.issue.IssueTypeSource *
cyclonedx.model.vulnerability.VulnerabilityAnalysis *
cyclonedx.model.vulnerability.VulnerabilityCredits *
cyclonedx.model.vulnerability.VulnerabilityRating *
cyclonedx.model.vulnerability.VulnerabilitySource
Signed-off-by: Indivar Mishra [email protected]
Signed-off-by: Indivar Mishra [email protected]
fixes #771
Signed-off-by: Johannes Feichtner [email protected]
Signed-off-by: Johannes Feichtner [email protected]
fixes #764
Signed-off-by: Johannes Feichtner [email protected]
Signed-off-by: Hakan Dilek [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Co-authored-by: Jan Kowalleck [email protected]
-
Fix typos in in conda-forge.md and remove unused reference in README (#762,
66ece7a) -
Fix few typos in conda-forge.md - Removed unused PEP-508 ref in README.md
Signed-off-by: Arthit Suriyawongkul [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Deprecates .serialization.BomRefHelper and .serialization.LicenseRepositoryHelper
fixes #756
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: weichslgartner [email protected]
Signed-off-by: Saquib Saifee [email protected]
Co-authored-by: Saquib Saifee [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Hakan Dilek [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: gruebel [email protected]
Signed-off-by: Hakan Dilek [email protected]
Signed-off-by: Johannes Feichtner [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Johannes Feichtner [email protected]
Co-authored-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
- Removed
cyclonedx.mode.ThisTool, utilizecyclonedx.builder.this.this_tool()instead. * Movedcyclonedx.model.Tooltocyclonedx.model.tool.Tool. * Propertycyclonedx.mode.bom.BomMetaData.toolsis of typecyclonedx.model.tool.ToolRepositorynow, wasSortedSet[cyclonedx.model.Tool]. The getter will act accordingly; the setter might act in a backwards-compatible way. * Propertycyclonedx.mode.vulnerability.Vulnerability.toolsis of typecyclonedx.model.tool.ToolRepositorynow, wasSortedSet[cyclonedx.model.Tool]. The getter will act accordingly; the setter might act in a backwards-compatible way. * Constructorcyclonedx.model.license.LicenseExpression()accepts optional argumentacknowledgementonly as key-word argument, no longer as positional argument.
- Constructor of
cyclonedx.model.bom.BomMetaDataalso accepts an instance ofcyclonedx.model.tool.ToolRepositoryfor argumenttools. * Constructor ofcyclonedx.model.bom.BomMetaDatano longer adds this very library as a tool. Downstream users SHOULD add it manually, likemy-bom.metadata.tools.components.add(cyclonedx.builder.this.this_component()).
- Deserialization of CycloneDX that do not include tools in the metadata are no longer unexpectedly modified/altered.
Enabled Metadata Tools representation and serialization in accordance with CycloneDX 1.5
- New class
cyclonedx.model.tool.ToolRepository. * New functioncyclonedx.builder.this.this_component()-- representation of this very python library as aComponent. * New functioncyclonedx.builder.this.this_tool()-- representation of this very python library as aTool. * New functioncyclonedx.model.tool.Tool.from_component().
- Raised runtime dependency
py-serializable>=1.1.1,<2, was>=1.1.0,<2.
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Joshua Kugler [email protected]
Signed-off-by: semantic-release [email protected]
Co-authored-by: Joshua Kugler [email protected]
Co-authored-by: semantic-release [email protected]
fixes #690
Signed-off-by: Jan Kowalleck [email protected]
- Fix some doc strings
(
4fa8fc1)
Signed-off-by: Jan Kowalleck [email protected]
utilizes flake8 plugin https://pypi.org/project/flake8-copyright-validator/ to assert the correct headers
Signed-off-by: Jan Kowalleck [email protected]
The code mistreated hashes for Blake2b and SHA3. Code for explicitly handling SHA1 & BLAKE3 was added, as those have no variants defined in the CycloneDX specification.
fixes #652
Signed-off-by: Michael Schlenker [email protected]
Co-authored-by: Michael Schlenker [email protected]
Co-authored-by: Jan Kowalleck [email protected]
fixes #638
Signed-off-by: Jan Kowalleck [email protected]
Property workaround was missing from the vulnerability model. It was added in spec v1.5 and was
marked as TODO before.
This is my first contribution on this project so if I done something wrong, just say me 😃
Signed-off-by: Louis Maillard [email protected]
Signed-off-by: Louis Maillard [email protected]
Co-authored-by: Louis Maillard [email protected]
cyclonedx.model.Property.value value is optional, in accordance with the spec.
fixes #630
Signed-off-by: Michael Schlenker [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Co-authored-by: Michael Schlenker [email protected]
Co-authored-by: Jan Kowalleck [email protected]
fixes #616
Signed-off-by: Jan Kowalleck [email protected]
- Ossp best practice percentage
(
75f58dc)
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
fixes #600
Signed-off-by: Jan Kowalleck [email protected]
fixes #612
Signed-off-by: Jan Kowalleck [email protected]
reverts #587 - as this one introduced errors fixes #598 fixes #586
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Paul Horton [email protected]
Co-authored-by: Paul Horton [email protected]
Fixes #586.
Signed-off-by: Paul Horton [email protected]
add a parameter to LicenseFactory.make_*() methods, to set the LicenseAcknowledgement.
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Paul Horton [email protected]
Signed-off-by: Paul Horton [email protected]
- Support for CycloneDX v1.6
(
8bbdf46)
- added draft v1.6 schemas and boilerplate for v1.6
Signed-off-by: Paul Horton [email protected]
-
re-generated test snapshots for v1.6
-
note
bom.metadata.manufactureas deprecated -
work on
bom.metadatafor v1.6 -
Deprecated
.component.author. Added.component.authorsand.component.manufacturer -
work to add
.component.omniborid- but tests deserialisation tests fail due to schema differences (.component.authornot in 1.6) -
work to get deserialization tests passing
Signed-off-by: Christoph Reiter [email protected]
Fixes #556
Signed-off-by: rcross-lc [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Co-authored-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
fixes #539
Signed-off-by: Jan Kowalleck [email protected]
- Refactor example
(
c1776b7)
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
- Add
Documentationurl to project meta (1080b73)
Signed-off-by: Jan Kowalleck [email protected]
- Add
Documentationurl to project meta (c4288b3)
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
- Allow additional major-version RC branch patterns
(
f8af156)
Signed-off-by: Jan Kowalleck [email protected]
- Buld docs on ubuntu22.04 python311
(
b3e9ab7)
Signed-off-by: Jan Kowalleck [email protected]
- Fix typo
(
2563996)
Signed-off-by: Jan Kowalleck [email protected]
- Update intro and description
(
f0bd05d)
Signed-off-by: Jan Kowalleck [email protected]
Updates the requirements on lxml to permit the latest version. - Release notes - Changelog - Commits
--- updated-dependencies: - dependency-name: lxml dependency-type: direct:production ...
Signed-off-by: dependabot[bot] [email protected]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
new API: model.HashType.from_hashlib_alg()
Signed-off-by: Jan Kowalleck [email protected]
- Removed symbols that were already marked as deprecated (via [#493]) * Removed symbols in
parser.*([#489] via [#495]) * Removedoutput.LATEST_SUPPORTED_SCHEMA_VERSION([#491] via [#494]) * Serialization of unsupported enum values might downgrade/migrate/omit them ([#490] via [#496]) Handling might raise warnings if a data loss occurred due to omitting. The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered. * Serialization of anymodel.component.Componentwith unsupportedtyperaisesexception.serialization.SerializationOfUnsupportedComponentTypeException([#490] via [#496]) * Objectmodel.bom_ref.BomRef's propertyvaluedefaults toNull, was arbitraryUUID([#504] via [#505]) This change does not affect serialization. Allbom-refs are guaranteed to have unique values on rendering. * Removed helpers from public API ([#503] via [#506])
- Basic support for CycloneDX 1.5 ([#404] via [#488]) * No data models were enhanced nor added, yet. Pull requests to add functionality are welcome. * Existing enumerable got new cases, to reflect features of CycloneDX 1.5 ([#404] via [#488]) * Outputters were enabled to render CycloneDX 1.5 ([#404] via [#488])
- Created (regression/unit/integration/functional) tests for CycloneDX 1.5 ([#404] via [#488]) * Created (regression/functional) tests for Enums' handling and completeness ([#490] via [#496])
- Bumped dependency
py-serializable@^0.16, was@^0.15(via [#496])
- Added new sub-package
exception.serialization(via [#496]) * Removed classmodels.ComparableTuple([#503] via [#506]) * Enummodel.ExternalReferenceTypegot new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488]) * Removed functionmodels.get_now_utc([#503] via [#506]) * Removed functionmodels.sha1sum([#503] via [#506]) * Enummodel.component.ComponentTypegot new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488]) * Removedmodel.component.Component.__init__()'s deprecated optional kwargnamespace(via [#493]) Use kwarggroupinstead. * Removedmodel.component.Component.__init__()'s deprecated optional kwarglicense_str(via [#493]) Use kwarglicensesinstead. * Removed deprecated methodmodel.component.Component.get_namespace()(via [#493]) * Removed classmodels.dependency.DependencyDependencies([#503] via [#506]) * Removedmodel.vulnerability.Vulnerability.__init__()'s deprecated optional kwargsource_name(via [#493]) Use kwargsourceinstead. * Removedmodel.vulnerability.Vulnerability.__init__()'s deprecated optional kwargsource_url(via [#493]) Use kwargsourceinstead. * Removedmodel.vulnerability.Vulnerability.__init__()'s deprecated optional kwargrecommendations(via [#493]) Use kwargrecommendationinstead. * Removedmodel.vulnerability.VulnerabilityRating.__init__()'s deprecated optional kwargscore_base(via [#493]) Use kwargscoreinstead. * Enummodel.vulnerability.VulnerabilityScoreSourcegot new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488]) * Removedoutput.LATEST_SUPPORTED_SCHEMA_VERSION([#491] via [#494]) * Removed deprecated functionoutput.get_instance()(via [#493]) Use functionoutput.make_outputter()instead. * Added new classoutput.json.JsonV1Dot5, to reflect CycloneDX 1.5 ([#404] via [#488]) * Added new item to dictoutput.json.BY_SCHEMA_VERSION, to reflect CycloneDX 1.5 ([#404] via [#488]) * Added new classoutput.xml.XmlV1Dot5, to reflect CycloneDX 1.5 ([#404] via [#488]) * Added new item to dictoutput.xml.BY_SCHEMA_VERSION, to reflect CycloneDX 1.5 ([#404] via [#488]) * Removed classparser.ParserWarning([#489] via [#495]) * Removed classparser.BaseParser([#489] via [#495])- Enum
schema.SchemaVersiongot new caseV1_5, to reflect CycloneDX 1.5 ([#404] via [#488])
- Enum
[#404]: #404 [#488]: #488 [#489]: #489 [#490]: #490 [#491]: #491 [#493]: #493 [#494]: #494 [#495]: #495 [#496]: #496 [#503]: #503 [#504]: #504 [#505]: #505 [#506]: #506
Signed-off-by: Johannes Feichtner [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: semantic-release
Co-authored-by: Johannes Feichtner [email protected]
Co-authored-by: semantic-release
Signed-off-by: Jan Kowalleck [email protected]
fixes #497
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
- Advance license docs
(
f61a730)
Signed-off-by: Jan Kowalleck [email protected]
Incorporate output.BomRefDiscriminator on serialization
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
BREAKING CHANGES ---------------- * Dropped support for python<3.8 ([#436] via [#441]; enable
[#433]) * Reworked license related models, collections, and factories ([#365] via [#466]) *
Behavior * Method model.bom.Bom.validate() will throw
exception.LicenseExpressionAlongWithOthersException, if detecting invalid license constellation
([#453] via [#452]) * Fixed tuple comparison when unequal lengths (via [#461]) * API * Enum
schema.SchemaVersion is no longer string-like ([#442] via [#447]) * Enum schema.OutputVersion
is no longer string-like ([#442] via [#447]) * Abstract class output.BaseOutput requires
implementation of new method output_format ([#446] via [#447]) * Abstract method
output.BaseOutput.output_as_string() got new optional parameter indent ([#437] via [#458]) *
Abstract method output.BaseOutput.output_as_string() accepts arbitrary kwargs (via [#458],
[#462]) * Removed class factory.license.LicenseChoiceFactory (via [#466]) The old functionality
was integrated into factory.license.LicenseFactory. * Method
factory.license.LicenseFactory.make_from_string()'s parameter name_or_spdx was renamed to
value (via [#466]) * Method factory.license.LicenseFactory.make_from_string()'s return value
can also be a LicenseExpression ([#365] via [#466]) The behavior imitates the old
factory.license.LicenseChoiceFactory.make_from_string() * Renamed class module.License to
module.license.DisjunctliveLicense ([#365] via [#466]) * Removed class module.LicenseChoice
([#365] via [#466]) Use dedicated classes module.license.DisjunctliveLicense and
module.license.LicenseExpression instead * All occurrences of models.LicenseChoice were
replaced by models.licenses.License ([#365] via [#466]) * All occurrences of
SortedSet[LicenseChoice] were specialized to models.license.LicenseRepository ([#365] via
[#466])
Fixed ---------------- * Serialization of multy-licenses ([#365] via [#466]) * Detect unused
"dependent" components in model.bom.validate() (via [#464])
Changed ---------------- * Updated latest supported list of supported SPDX license identifiers (via [#433]) * Shipped schema files are moved to a protected space (via [#433]) These files were never intended for public use. * XML output uses a default namespace, which makes results smaller. ([#438] via [#458])
Added ---------------- * Support for Python 3.12 (via [#460]) * JSON- & XML-Validators ([#432],
[#446] via [#433], [#448]) The functionality might require additional dependencies, that can be
installed with the extra "validation". See the docs in section "Installation" for details. * JSON
& XML can be generated in a more human-friendly form ([#437], [#438] via [#458]) * Type hints,
typings & overloads for better integration downstream (via [#463]) * API * New function
output.make_outputter() (via [#469]) This replaces the deprecated function
output.get_instance(). * New sub-package validation ([#432], [#446] via [#433], [#448],
[#469], [#468], [#469]) * New class exception.MissingOptionalDependencyException ([#432] via
[#433]) * New class exception.LicenseExpressionAlongWithOthersException ([#453] via [#452]) *
New dictionaries output.{json,xml}.BY_SCHEMA_VERSION ([#446] via [#447]) * Existing
implementations of class output.BaseOutput now have a new method output_format ([#446] via
[#447]) * Existing implementations of method output.BaseOutput.output_as_string() got new
optional parameter indent ([#437] via [#458]) * Existing implementations of method
output.BaseOutput.output_to_file() got new optional parameter indent ([#437] via [#458]) * New
method factory.license.LicenseFactory.make_with_expression() (via [#466]) * New class
model.license.DisjunctiveLicense ([#365] via [#466]) * New class
model.license.LicenseExpression ([#365] via [#466]) * New class
model.license.LicenseRepository ([#365] via [#466]) * New class
serialization.LicenseRepositoryHelper ([#365] via [#466])
Deprecated ---------------- * Function output.get_instance() might be removed, use
output.make_outputter() instead (via [#469])
Tests ---------------- * Added validation tests with official CycloneDX schema test data ([#432] via [#433]) * Use proper snapshots, instead of pseudo comparison ([#437] via [#464]) * Added regression test for bug [#365] (via [#466], [#467])
Misc ---------------- * Dependencies: bumped py-serializable@^0.15.0, was @^0.11.1 (via [#458],
[#463], [#464], [#466]) * Style: streamlined quotes and strings (via [#472]) * Chore: bumped
internal dev- and QA-tools ([#436] via [#441], [#472]) * Chore: added more QA tools to prevent
common security issues (via [#473])
[#432]: #432 [#433]: #433 [#436]: #436 [#437]: #437 [#365]: #365 [#438]: #438 [#440]: #440 [#441]: #441 [#442]: #442 [#446]: #446 [#447]: #447 [#448]: #448 [#452]: #452 [#453]: #453 [#458]: #458 [#460]: #460 [#461]: #461 [#462]: #462 [#463]: #463 [#464]: #464 [#466]: #466 [#467]: #467 [#468]: #468 [#469]: #469 [#472]: #472 [#473]: #473
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: semantic-release
Co-authored-by: semantic-release
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
- Fix shield in README
(
6a941b1)
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
adds cyclonedx.__version__
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
- Remove
tomlas dependency as not used and seems to be breaking Python 3.11 CI (8fb1b14)
Signed-off-by: Paul Horton [email protected]
- Removed
autopep8in favour offlake8as both have conflicting dependencies now (8fb1b14)
Signed-off-by: Paul Horton [email protected]
-
Removed
setuptoolsas dependency (8fb1b14) -
Removed
types-tomlfrom dependencies - not used (8fb1b14)
Signed-off-by: Paul Horton [email protected]
- Update
serializableto include XML safety changes (8fb1b14)
Signed-off-by: Paul Horton [email protected]
-
Add helper method to get URN for a BOM according to https://www.iana.org/assignments/urn-formal/cdx (
8fb1b14) -
Allow
serial_numberof BOM to be prescribed (8fb1b14) -
Allow
versionof BOM to be defined (8fb1b14) -
Drop Python 3.6 support (
8fb1b14)
Signed-off-by: Hakan Dilek [email protected]
Signed-off-by: Paul Horton [email protected]
Co-authored-by: Hakan Dilek [email protected]
Co-authored-by: Hakan Dilek [email protected]
- Officially test and support Python 3.11
(
8fb1b14)
Signed-off-by: Paul Horton [email protected]
-
removed unused imports
-
bump
poetryto1.1.12in CI
- Release 4.0.0 #341)
(
8fb1b14)
Highlights of this release include: * Support for De-serialization from JSON and XML to this
Pythonic Model * Deprecation of Python 3.6 support * Support for Python 3.11 * Support for
BomLink * Support VEX without needing Component in the same Bom * Support for services
having dependencies
BREAKING CHANGE: Large portions of this library have been re-written for this release and many methods and contracts have changed.
Signed-off-by: Paul Horton [email protected]
BREAKING CHANGE:
BREAKING CHANGE: Model classes changed to relocated Vulnerability at Bom, not at Component
Signed-off-by: Paul Horton [email protected]
- Large portions of this library have been re-written for this release and many methods and contracts have changed.
Signed-off-by: Jan Kowalleck [email protected]
- tests: regression tests for issue #328 fix: for issue #328
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Jan Kowalleck [email protected]
caused by badges/shields#8671
Signed-off-by: Jan Kowalleck [email protected]
Signed-off-by: Roland Weber [email protected]
- Typo
(
539b57a)
Signed-off-by: Jan Kowalleck [email protected]
- Type hint for
get_component_by_purlis incorrect (3f20bf0)
- License factories
(
033bad2)
Signed-off-by: Jan Kowalleck [email protected]
- Out-factor SPDX compund detection
(
fd4d537)
Signed-off-by: Jan Kowalleck [email protected]
- Out-factor SPDX compund detection
(
2b69925)
Signed-off-by: Jan Kowalleck [email protected]
- Pinned
mypy <= 0.961due to #278 (d6955cb)
Signed-off-by: Paul Horton [email protected]
- Properly support nested
componentsandservices#275 (6597db7)
Signed-off-by: Paul Horton [email protected]
- Added updated CycloneDX 1.4.2 schemas
(
7fb27ae)
Signed-off-by: Paul Horton [email protected]
- Support for CycloneDX schema version
1.4.2(db7445c)
Signed-off-by: Jan Kowalleck [email protected]
- Add expected lower-than comparators for
OrganizationalEntityandVulnerabilityCredits(#248,0046ee1)
Signed-off-by: Jan Kowalleck [email protected]
Partial fix for #245.
Signed-off-by: Rodney Richardson [email protected]
- Move typing to dev-dependencies
(
0e2376b)
Move types-setuptools and types-toml to dev-dependencies (#226)
Signed-off-by: Adam Johnson [email protected]
- Fix typo "This is out" -> "This is our"
(
ef0278a)
Fix typo in comments: "This is out" -> "This is our" (#233)
Signed-off-by: Rodney Richardson [email protected]
- Use
SortedSetin model to improve reproducibility - this will provide predictable ordering of various items in generated CycloneDX documents - thanks to @RodneyRichardson (8a1c404)
Signed-off-by: Paul Horton [email protected]
- deps: Remove unused
typing-extensionsconstraints (2ce358a)
PullRequest and details via #224
Signed-off-by: gruebel [email protected]
- Add support for Dependency Graph in Model and output serialisation
(
ea34513)
Signed-off-by: Paul Horton [email protected]
-
Bump JSON schemas to latest fix verison for 1.2 and 1.3 - see: (
bd6a088) -
Bump XML schemas to latest fix version for 1.2-1.4 - see: (
bd2e756)
versionbeing optional in JSON output can raise error (ba0c82f)
Signed-off-by: Paul Horton [email protected]
- Prevent error if
versionnot set (b9a84b5)
Signed-off-by: Paul Horton [email protected]
- Output errors are verbose
(
bfe8fb1)
Signed-off-by: Jan Kowalleck [email protected]
component.bom_refis not Optional in our model implementation (in the schema it is) - we generate a UUID ifbom_refis not supplied explicitly (5c954d1)
Signed-off-by: Paul Horton [email protected]
expressionnot supported in Component Licsnes for version 1.0 (15b081b)
Signed-off-by: Paul Horton [email protected]
Signed-off-by: Paul Horton [email protected]
- Components with no version (optional since 1.4) produce invalid BOM output in XML #150
(
70d25c8)
Signed-off-by: Paul Horton [email protected]
- Further fix for #150
(
1f55f3e)
Signed-off-by: Paul Horton [email protected]
Signed-off-by: Paul Horton [email protected]
- Regression introduced by first fix for #150
(
c09e396)
Signed-off-by: Paul Horton [email protected]
-
Temporary fix for
__hash__of Component withproperties#153 (a51766d)
Signed-off-by: Paul Horton [email protected]
-
bom-reffor Component and Vulnerability default to a UUID (#142,b45ff18) -
bom-reffor Component and Vulnerability default to a UUID if not supplied ensuring they have a unique value #141 (b45ff18)
Signed-off-by: Paul Horton [email protected]
-
doc: updated documentation to reflect change
-
patched other tests to support UUID for bom-ref
-
better syntax
-
1.3.0
Automatically generated by python-semantic-release
- WIP but a lil hand up for @madpah
Signed-off-by: Jeffry Hesse [email protected]
- Bump dependencies
(
da3f0ca)
BREAKING CHANGE: Adopt PEP-3102
BREAKING CHANGE: Optional Lists are now non-optional Sets
BREAKING CHANGE: Remove concept of DEFAULT schema version - replaced with LATEST schema version
BREAKING CHANGE: Added BomRef data type
Signed-off-by: Paul Horton [email protected]
-
Support for
bom.externalReferencesin JSON and XML #124 (1b733d7)
Signed-off-by: Paul Horton [email protected]
- Support services in XML BOMs
(
9edf6c9)
-
Adopt PEP-3102
-
Optional Lists are now non-optional Sets
-
Remove concept of DEFAULT schema version - replaced with LATEST schema version
-
Added
BomRefdata type
-
bom-reffor Component and Vulnerability default to a UUID (#142,3953bb6) -
bom-reffor Component and Vulnerability default to a UUID if not supplied ensuring they have a unique value #141 (#142,3953bb6)
Signed-off-by: Paul Horton [email protected]
-
doc: updated documentation to reflect change
-
patched other tests to support UUID for bom-ref
-
better syntax
- Added CPE to component
Setting CPE was missing for component, now it is possible to set CPE and output CPE for a component.
Signed-off-by: Jens Lucius [email protected]
- Fixing problems with CPE addition
- Fixed styling errors - Added reference to CPE Spec - Adding CPE parameter as last parameter to not break arguments
- Again fixes for Style and CPE reference
Missing in the last commit
-
Added CPE as argument before deprecated arguments
-
Added testing for CPE addition and error fixing
- Added output tests for CPE in XML and JSON - Fixes style error in components - Fixes order for CPE output in XML (CPE has to come before PURL)
- Fixed output tests
CPE was still in the wrong position in one of the tests - fixed
- Fixed minor test fixtures issues
- cpe was still in wrong position in 1.2 JSON - Indentation fixed in 1.4 JSON
- Fixed missing comma in JSON 1.2 test file
Signed-off-by: Paul Horton [email protected]
- Add support for metadata component
Part of #6
Signed-off-by: Artem Smotrakov [email protected]
- Better docs and simpler ifs
- Removed requirements-parser as dependency (temp) as not available for Python 3 as Wheel
(#98,
3677d9f)
Signed-off-by: Paul Horton [email protected]
fixes #94
Signed-off-by: Jan Kowalleck [email protected]
- Further loosened dependency definitions
(
8bef6ec)
see #44
updated some locked dependencies to latest versions
Signed-off-by: Jan Kowalleck [email protected]
- Typing definitions to be PY 3.6 compatible
(
07ebedc)
Signed-off-by: Paul Horton [email protected]
- Typing definitions to be PY 3.6 compatible
(
07ebedc)
Signed-off-by: Paul Horton [email protected]
- straigtened up
sys.version_infoconstraints/code-branches
Signed-off-by: Jan Kowalleck [email protected]
-
removed unused type ignores
-
try to fix type variants
-
typing for py3.6
-
fixed invalid unittest
-
mypy silence
warn_unused_ignores -
mypy in tox for lowest version is pinned
Co-authored-by: Paul Horton [email protected]
Signed-off-by: Paul Horton [email protected]
- updated some typings
-
Loosed dependency versions to make this library more consumable (
55f10fb) -
Lowering minimum dependency versions (
55f10fb)
Signed-off-by: Paul Horton [email protected]
- Lowering minimum dependency versions - importlib-metadata raising minimum to ensure we get a typed
library
(
55f10fb)
Signed-off-by: Paul Horton [email protected]
- Lowering minimum version for importlib-metadata to 3.4.0 with modified import statement
(
55f10fb)
Signed-off-by: Paul Horton [email protected]
- Constructor for
Vulnerabilityto correctly defineratingsas optional (395a0ec)
Signed-off-by: William Woodruff [email protected]
Signed-off-by: Paul Horton [email protected]
- added trove classifier for Python 3.10
- Upgrade Poetry version to workaround issue between Poetry and Python 3.10 (see:
python-poetry/poetry#4210)
(#64,
385b835)
Signed-off-by: Paul Horton [email protected]
- Typing & PEP 561
(
9144765)
- adde file for type checkers according to PEP 561
Signed-off-by: Jan Kowalleck [email protected]
-
added static code analysis as a dev-test
-
added the "typed" trove
-
added
flake8-annotationsto the tests -
added type hints
-
further typing updates
Signed-off-by: Paul Horton [email protected]
-
further typing additions and test updates
-
further typing
-
further typing - added type stubs for toml and setuptools
-
typing work
-
coding standards
-
fixed tox and mypy running in correct python version
-
supressed mypy for
cyclonedx.utils.conda.parse_conda_json_to_conda_package -
fixed type hints
-
fixed some typing related flaws
-
added flake8-bugbear for code analysis
Co-authored-by: Paul Horton [email protected]
- Correct way to write utf-8 encoded files
(
49f9369)
Signed-off-by: Paul Horton [email protected]
- Ensure output to file is UTF-8
(
a10da20)
Signed-off-by: Paul Horton [email protected]
- Ensure output to file is UTF-8
(
193bf64)
Signed-off-by: Paul Horton [email protected]
- Add support for Conda
(
bd29c78)
Signed-off-by: Paul Horton [email protected]
- Missing check for Classifiers in Environment Parser
(
b7fa38e)
Signed-off-by: Paul Horton [email protected]
- Add support for parsing package licenses when using the
EnvironmentParsers (c414eaf)
Signed-off-by: Paul Horton [email protected]
- Coding standards violations
(
00cd1ca)
Signed-off-by: Paul Horton [email protected]
- Handle
Pipfile.lockdependencies without anindexspecified (26c62fb)
- Add namespace and subpath support to Component to complete PackageURL Spec support
(
780adeb)
Signed-off-by: Paul Horton [email protected]
- Multiple hashes being created for an externalRefernce which is not as required
(
970d192)
Signed-off-by: Paul Horton [email protected]
- Add support for
externalRefernecesforComponentsand associated enhancements to parsers to obtain information where possible/known (a152852)
Signed-off-by: Paul Horton [email protected]
- Support for pipenv.lock file parsing
(
68a2dff)
Signed-off-by: Paul Horton [email protected]
- Added ability to add tools in addition to this library when generating CycloneDX + plus fixes
relating to multiple BOM instances
(
e03a25c)
Signed-off-by: Paul Horton [email protected]
- Better methods for checking if a Component is already represented in the BOM, and the ability to
get the existing instance
(
5fee85f)
Signed-off-by: Paul Horton [email protected]
- Helper method for representing a File as a Component taking into account versioning for files as
per https://github.com/CycloneDX/cyclonedx.org/issues/34
(
7e0fb3c)
Signed-off-by: Paul Horton [email protected]
- Support for non-PyPi Components - PackageURL type is now definable when creating a Component
(
fde79e0)
Signed-off-by: Paul Horton [email protected]
- Bumped a dependency version
(
efc1053)
Signed-off-by: Paul Horton [email protected]
- Updated dependencies, moved pdoc3 to a dev dependency
(
6a9947d)
Signed-off-by: Paul Horton [email protected]
- Add support for tool(s) that generated the SBOM
(
7d1e6ef)
Signed-off-by: Paul Horton [email protected]
- Improved handling for
requirements.txtcontent without pinned or declared versions (7f318cb)
Signed-off-by: Paul Horton [email protected]
- Dependencies updated
(
0411826)
Signed-off-by: Paul Horton [email protected]
- Relaxed typing of parameter to be compatible with Python < 3.9
(
f9c7990)
Signed-off-by: Paul Horton [email protected]
- Remove unused commented out code
(
ba4f285)
Signed-off-by: Paul Horton [email protected]
- Removed print call
(
8806553)
Signed-off-by: Paul Horton [email protected]
- Removed print call
(
d272d2e)
Signed-off-by: Paul Horton [email protected]
- Helper methods for deriving Severity and SourceType
(
6a86ec2)
Signed-off-by: Paul Horton [email protected]
- Support for localising vectors (i.e. stripping out any scheme prefix)
(
b9e9e17)
Signed-off-by: Paul Horton [email protected]
- Adding support for extension schema that descriptions vulnerability disclosures
(
d496695)
Signed-off-by: Paul Horton [email protected]
- Whitespace on empty line removed
(
cfc952e)
Signed-off-by: Paul Horton [email protected]
- Add poetry support
(
f3ac42f)
Signed-off-by: Paul Horton [email protected]
- Added helper method to return a PackageURL object representing a Component
(
367bef1)
Signed-off-by: Paul Horton [email protected]
- build: Removed artefacts associtated with non-poetry build
(
f9119d4)
Tidied up project to remove items associated with non-Poetry build process. Also aligned a few references in README to new home of this project under CycloneDX.
Signed-off-by: Paul Horton [email protected]
- build: Test failure and dependency missing
(
9a2cfe9)
Fixed failing tests due to dependency on now removed VERSION file Added flake8 officially as a DEV dependency to poetry
Signed-off-by: Paul Horton [email protected]
- test: Test was not updated for revised author statement
(
d1c9d37)
Signed-off-by: Paul Horton [email protected]
- Add in pypi badge
(
6098c36)
- Additional info to poetry, remove circleci
(
2fcfa5a)
-
Initial release to pypi, tell poetry to include cyclonedx package (
a030177) -
Release with full name (
4c620ed)
- Initial release to pypi
(
99687db)