chore: update SBOM for Python 3.10 (#4171)

Co-authored-by: GitHub <[email protected]>
intel · Jun 10, 2024 · eca5463 · eca5463
1 parent d4ffbe2
commit eca5463
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 20 deletions.
diff --git a/sbom/cve-bin-tool-py3.10.json b/sbom/cve-bin-tool-py3.10.json
@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:81884484-1ead-4509-abb2-b308f15797f1",
+  "serialNumber": "urn:uuid:f7394b06-7d8b-435f-9694-4f1acb91ab48",
   "version": 1,
   "metadata": {
-    "timestamp": "2024-06-03T00:29:06Z",
+    "timestamp": "2024-06-10T00:30:04Z",
     "tools": {
       "components": [
         {
@@ -1520,7 +1520,7 @@
       "type": "library",
       "bom-ref": "35-cryptography",
       "name": "cryptography",
-      "version": "42.0.7",
+      "version": "42.0.8",
       "supplier": {
         "name": "The Python Cryptographic Authority and individual contributors",
         "contact": [
@@ -1529,7 +1529,7 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.7:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.8:*:*:*:*:*:*:*",
       "description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.",
       "licenses": [
         {
@@ -1538,12 +1538,12 @@
       ],
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/cryptography/42.0.7",
+          "url": "https://pypi.org/project/cryptography/42.0.8",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/[email protected].7",
+      "purl": "pkg:pypi/[email protected].8",
       "properties": [
         {
           "name": "language",
@@ -2196,7 +2196,7 @@
       "type": "library",
       "bom-ref": "51-packaging",
       "name": "packaging",
-      "version": "24.0",
+      "version": "24.1",
       "supplier": {
         "name": "Donald Stufft",
         "contact": [
@@ -2205,16 +2205,16 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:donald_stufft:packaging:24.0:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:donald_stufft:packaging:24.1:*:*:*:*:*:*:*",
       "description": "Core utilities for Python packages",
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/packaging/24.0",
+          "url": "https://pypi.org/project/packaging/24.1",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/packaging@24.0",
+      "purl": "pkg:pypi/packaging@24.1",
       "properties": [
         {
           "name": "language",
@@ -2661,6 +2661,12 @@
       },
       "cpe": "cpe:2.3:a:georg_brandl:pygments:2.18.0:*:*:*:*:*:*:*",
       "description": "Pygments is a syntax highlighting package written in Python.",
+      "hashes": [
+        {
+          "alg": "SHA-1",
+          "content": "d7d11f6e6d3aa97805215c1cc833ea5f0ef1fcbb"
+        }
+      ],
       "licenses": [
         {
           "license": {

diff --git a/sbom/cve-bin-tool-py3.10.spdx b/sbom/cve-bin-tool-py3.10.spdx
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: Python-cve-bin-tool
-DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-b364b017-d6d6-4fea-9a10-487368aa77e7
+DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-43b79e1e-3a1a-4886-b749-46269912b34f
 LicenseListVersion: 3.22
 Creator: Tool: sbom4python-0.10.4
-Created: 2024-06-03T00:27:40Z
+Created: 2024-06-10T00:28:28Z
 CreatorComment: <text>This document has been automatically generated.</text>
 ##### 
 
@@ -558,17 +558,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_pyopenssl_developers:pyopenssl:24.
 
 PackageName: cryptography
 SPDXID: SPDXRef-Package-35-cryptography
-PackageVersion: 42.0.7
+PackageVersion: 42.0.8
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Organization: The Python Cryptographic Authority and individual contributors ([email protected])
-PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.7
+PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.8
 FilesAnalyzed: false
 PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause
 PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>cryptography is a package which provides cryptographic recipes and primitives to Python developers.</text>
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].7
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.7:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].8
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.8:*:*:*:*:*:*:*
 ##### 
 
 PackageName: cffi
@@ -810,17 +810,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_purl_authors:packageurl-python:0.1
 
 PackageName: packaging
 SPDXID: SPDXRef-Package-51-packaging
-PackageVersion: 24.0
+PackageVersion: 24.1
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Donald Stufft ([email protected])
-PackageDownloadLocation: https://pypi.org/project/packaging/24.0
+PackageDownloadLocation: https://pypi.org/project/packaging/24.1
 FilesAnalyzed: false
 PackageLicenseDeclared: NOASSERTION
 PackageLicenseConcluded: NOASSERTION
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>Core utilities for Python packages</text>
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/packaging@24.0
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:donald_stufft:packaging:24.0:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/packaging@24.1
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:donald_stufft:packaging:24.1:*:*:*:*:*:*:*
 ##### 
 
 PackageName: plotly
@@ -986,6 +986,7 @@ PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Georg Brandl ([email protected])
 PackageDownloadLocation: https://pypi.org/project/Pygments/2.18.0
 FilesAnalyzed: false
+PackageChecksum: SHA1: d7d11f6e6d3aa97805215c1cc833ea5f0ef1fcbb
 PackageLicenseDeclared: BSD-2-Clause
 PackageLicenseConcluded: BSD-2-Clause
 PackageCopyrightText: NOASSERTION