Skip to content

Commit 8fb1b14

Browse files
madpahjkowalleckhakandilek
authored
feat: Release 4.0.0 #341)
Highlights of this release include: * Support for De-serialization from JSON and XML to this Pythonic Model * Deprecation of Python 3.6 support * Support for Python 3.11 * Support for `BomLink` * Support VEX without needing `Component` in the same `Bom` * Support for `services` having `dependencies` BREAKING CHANGE: Large portions of this library have been re-written for this release and many methods and contracts have changed. Signed-off-by: Paul Horton <paul.horton@owasp.org> * feat: support VEX without Components in the same BOM BREAKING CHANGE: Model classes changed to relocated Vulnerability at Bom, not at Component Signed-off-by: Paul Horton <paul.horton@owasp.org> * feat: support VEX without Components in the same BOM BREAKING CHANGE: Model classes changed to relocated Vulnerability at Bom, not at Component Signed-off-by: Paul Horton <paul.horton@owasp.org> feat: allow `version` of BOM to be defined feat: allow `serial_number` of BOM to be prescribed feat: add helper method to get URN for a BOM according to https://www.iana.org/assignments/urn-formal/cdx Signed-off-by: Paul Horton <paul.horton@owasp.org> * chore: fix release workflow * chore: editorconfig Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * feat: support for deserialization from JSON and XML (#290) BREAKING CHANGE: * feat: drop Python 3.6 support Signed-off-by: Hakan Dilek <hakandilek@gmail.com> Signed-off-by: Paul Horton <paul.horton@owasp.org> Co-authored-by: Hakan Dilek <hakandilek@gmail.com> Co-authored-by: Hakan Dilek <hakandilek@users.noreply.github.com> * fix: update `serializable` to include XML safety changes Signed-off-by: Paul Horton <paul.horton@owasp.org> * feat: Support for Python 3.11 (#349) * feat: officially test and support Python 3.11 Signed-off-by: Paul Horton <paul.horton@owasp.org> * removed unused imports Signed-off-by: Paul Horton <paul.horton@owasp.org> * bump `poetry` to `1.1.12` in CI Signed-off-by: Paul Horton <paul.horton@owasp.org> * fix: remove `toml` as dependency as not used and seems to be breaking Python 3.11 CI Signed-off-by: Paul Horton <paul.horton@owasp.org> * fix: removed `types-toml` from dependencies - not used Signed-off-by: Paul Horton <paul.horton@owasp.org> --------- Signed-off-by: Paul Horton <paul.horton@owasp.org> * fix: removed `autopep8` in favour of `flake8` as both have conflicting dependencies now Signed-off-by: Paul Horton <paul.horton@owasp.org> * chore: bump dev dependencies fix: removed `setuptools` as dependency Signed-off-by: Paul Horton <paul.horton@owasp.org> * tests: compoennt versions optional (#350) * chore: exclude `venv*` from QA; add typing to QA Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * tests: component versions are optional Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> --------- Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * doc: doc updates for new deserialization feature Signed-off-by: Paul Horton <paul.horton@owasp.org> * doc: doc updates for contribution Signed-off-by: Paul Horton <paul.horton@owasp.org> --------- Signed-off-by: Paul Horton <paul.horton@owasp.org> Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> Signed-off-by: Hakan Dilek <hakandilek@gmail.com> Co-authored-by: Jan Kowalleck <jan.kowalleck@gmail.com> Co-authored-by: Hakan Dilek <hakandilek@gmail.com> Co-authored-by: Hakan Dilek <hakandilek@users.noreply.github.com>
1 parent a011d89 commit 8fb1b14

File tree

151 files changed

+5346
-3085
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

151 files changed

+5346
-3085
lines changed

‎.github/workflows/deploy.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ on:
44
push:
55
branches: [ 'main' ]
66
workflow_dispatch:
7-
7+
88
env:
9-
PYTHON_VERSION_DEFAULT: "3.10"
9+
PYTHON_VERSION_DEFAULT: "3.11"
1010
POETRY_VERSION: "1.1.12"
1111

1212
jobs:
@@ -22,14 +22,14 @@ jobs:
2222
uses: actions/checkout@v3
2323
with:
2424
fetch-depth: 0
25-
25+
2626
- name: Setup python
2727
# see https://github.com/actions/setup-python
2828
uses: actions/setup-python@v4
2929
with:
3030
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
3131
architecture: 'x64'
32-
32+
3333
- name: Install and configure Poetry
3434
# See https://github.com/marketplace/actions/install-poetry-action
3535
uses: snok/install-poetry@v1
@@ -38,17 +38,17 @@ jobs:
3838
virtualenvs-create: true
3939
virtualenvs-in-project: true
4040
installer-parallel: true
41-
41+
4242
- name: Install dependencies
4343
run: poetry install --no-root
4444

4545
- name: View poetry version
4646
run: poetry --version
47-
47+
4848
- name: Python Semantic Release
4949
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html
5050
# see https://github.com/relekang/python-semantic-release
51-
uses: relekang/python-semantic-release@v7.33.1
51+
uses: relekang/python-semantic-release@v7.33.2
5252
with:
5353
github_token: ${{ secrets.GITHUB_TOKEN }}
5454
repository_username: __token__

‎.github/workflows/manual-release-candidate.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
python -m pip install poetry --upgrade pip
2626
poetry config virtualenvs.create false
2727
poetry install
28-
python -m pip install python-semantic-release
28+
python -m pip install python-semantic-release==7.28.1
2929
- name: Apply Pre Release Version
3030
run: |
3131
RC_VERSION="$(semantic-release --noop --major print-version)-${{ github.event.inputs.release_candidate_suffix }}"

‎.github/workflows/poetry.yml

Lines changed: 31 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ name: Python CI
44

55
on:
66
push:
7-
branches: ["master", "main"]
7+
branches: ["main"]
88
pull_request:
99
branches-ignore: ['dependabot/**']
1010
workflow_dispatch:
@@ -15,8 +15,8 @@ on:
1515

1616
env:
1717
REPORTS_DIR: CI_reports
18-
PYTHON_VERISON_DEFAULT: "3.10"
19-
POETRY_VERSION: "1.1.11"
18+
PYTHON_VERSION_DEFAULT: "3.11"
19+
POETRY_VERSION: "1.1.12"
2020

2121
jobs:
2222
coding-standards:
@@ -27,19 +27,23 @@ jobs:
2727
- name: Checkout
2828
# see https://github.com/actions/checkout
2929
uses: actions/checkout@v3
30+
3031
- name: Setup Python Environment
3132
# see https://github.com/actions/setup-python
3233
uses: actions/setup-python@v4
3334
with:
34-
python-version: ${{ env.PYTHON_VERISON_DEFAULT }}
35+
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
3536
architecture: 'x64'
37+
3638
- name: Install poetry
3739
# see https://github.com/marketplace/actions/setup-poetry
3840
uses: Gr1N/setup-poetry@v8
3941
with:
4042
poetry-version: ${{ env.POETRY_VERSION }}
43+
4144
- name: Install dependencies
4245
run: poetry install --no-root
46+
4347
- name: Run tox
4448
run: poetry run tox -e flake8 -s false
4549

@@ -53,96 +57,102 @@ jobs:
5357
include:
5458
- # test with the locked dependencies
5559
os: ubuntu-latest
56-
python-version: '3.10'
60+
python-version: '3.11'
5761
toxenv-factor: 'locked'
5862
- # test with the lowest dependencies
59-
os: ubuntu-20.04
60-
python-version: '3.6'
63+
os: ubuntu-latest
64+
python-version: '3.7'
6165
toxenv-factor: 'lowest'
6266
steps:
6367
- name: Checkout
6468
# see https://github.com/actions/checkout
6569
uses: actions/checkout@v3
70+
6671
- name: Setup Python Environment
6772
# see https://github.com/actions/setup-python
6873
uses: actions/setup-python@v4
6974
with:
7075
python-version: ${{ matrix.python-version }}
7176
architecture: 'x64'
77+
7278
- name: Install poetry
7379
# see https://github.com/marketplace/actions/setup-poetry
7480
uses: Gr1N/setup-poetry@v8
7581
with:
7682
poetry-version: ${{ env.POETRY_VERSION }}
83+
7784
- name: Install dependencies
7885
run: poetry install --no-root
86+
7987
- name: Run tox
8088
run: poetry run tox -e mypy-${{ matrix.toxenv-factor }} -s false
8189

8290
build-and-test:
8391
name: Test (${{ matrix.os }} py${{ matrix.python-version }} ${{ matrix.toxenv-factor }})
8492
runs-on: ${{ matrix.os }}
85-
timeout-minutes: 10
93+
timeout-minutes: 15
8694
env:
8795
REPORTS_ARTIFACT: tests-reports
8896
strategy:
8997
fail-fast: false
9098
matrix:
9199
os: ['ubuntu-latest', 'windows-latest', 'macos-latest']
92100
python-version:
93-
- "3.10" # highest supported
101+
- "3.11" # highest supported
102+
- "3.10"
94103
- "3.9"
95104
- "3.8"
96-
- "3.7"
97-
- "3.6" # lowest supported
105+
- "3.7" # lowest supported
98106
toxenv-factor: ['locked']
99107
include:
100-
- # test with py36 ubuntu20
101-
os: ubuntu-20.04
102-
python-version: '3.6'
103-
toxenv-factor: 'locked'
104108
- # test with the lowest dependencies
105-
os: ubuntu-20.04
106-
python-version: '3.6'
107-
toxenv-factor: 'lowest'
108-
exclude:
109-
- # no py36 with latest ubuntu - see https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json
110109
os: ubuntu-latest
111-
python-version: '3.6'
110+
python-version: '3.7'
111+
toxenv-factor: 'lowest'
112112
steps:
113113
- name: Disabled Git auto EOL CRLF transforms
114114
run: |
115115
git config --global core.autocrlf false
116116
git config --global core.eol lf
117+
117118
- name: Checkout
118119
# see https://github.com/actions/checkout
119120
uses: actions/checkout@v3
121+
120122
- name: Create reports directory
121123
run: mkdir ${{ env.REPORTS_DIR }}
124+
122125
- name: Setup Python Environment
123126
# see https://github.com/actions/setup-python
124127
uses: actions/setup-python@v4
125128
with:
126129
python-version: ${{ matrix.python-version }}
127130
architecture: 'x64'
131+
128132
- name: Validate Python Environment
129133
run: echo "import sys; print('Python %s on %s in %s' % (sys.version, sys.platform, sys.getdefaultencoding()))" | python
134+
130135
- name: Install poetry
131136
# see https://github.com/marketplace/actions/setup-poetry
132137
uses: Gr1N/setup-poetry@v8
133138
with:
134139
poetry-version: ${{ env.POETRY_VERSION }}
140+
135141
- name: Install dependencies
136142
run: poetry install --no-root
143+
137144
- name: Ensure build successful
138145
run: poetry build
146+
139147
- name: Run tox
140148
run: poetry run tox -e py-${{ matrix.toxenv-factor }} -s false
149+
141150
- name: Generate coverage reports
142151
run: >
143152
poetry run coverage report &&
144153
poetry run coverage xml -o ${{ env.REPORTS_DIR }}/coverage-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.toxenv-factor }}.xml &&
145154
poetry run coverage html -d ${{ env.REPORTS_DIR }}
155+
146156
- name: Artifact reports
147157
if: ${{ ! cancelled() }}
148158
# see https://github.com/actions/upload-artifact

‎.isort.cfg

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ skip_gitignore = false
66
skip_glob =
77
build/*,dist/*,__pycache__,.eggs,*.egg-info*,
88
*_cache,*.cache,
9-
.git/*,.tox/*,.venv/*,venv/*
9+
.git/*,.tox/*,.venv/*,venv/*,.venv*/*,venv*/*,
1010
_OLD/*,_TEST/*,
1111
docs/*
1212
combine_as_imports = true
@@ -18,3 +18,4 @@ multi_line_output = 3
1818
src_paths =
1919
cyclonedx
2020
tests
21+
typings

‎.pre-commit-config.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ repos:
44
hooks:
55
- id: system
66
name: mypy
7-
entry: poetry run tox -e mypy
7+
entry: poetry run tox -e mypy-locked
88
pass_filenames: false
99
language: system
1010
- repo: local
@@ -17,7 +17,7 @@ repos:
1717
- repo: local
1818
hooks:
1919
- id: system
20-
name: autopep8
21-
entry: poetry run autopep8 --in-place -r cyclonedx tests
20+
name: flake8
21+
entry: poetry run flake8 cyclonedx/ tests/
2222
pass_filenames: false
2323
language: system

‎CONTRIBUTING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Get it all applied via:
2323

2424
```shell
2525
poetry run isort .
26-
poetry run autopep8 --in-place -r cyclonedx tests
26+
poetry run flake8 cyclonedx/ tests/ typings/
2727
```
2828

2929
## Documentation

‎README.md

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,21 @@
1313
----
1414

1515
This CycloneDX module for Python can generate valid CycloneDX bill-of-material document containing an aggregate of all
16-
project dependencies.
16+
project dependencies. CycloneDX is a lightweight BOM specification that is easily created, human-readable, and simple
17+
to parse.
1718

18-
This module is not designed for standalone use.
19+
**This module is not designed for standalone use.**
1920

20-
If you're looking for a CycloneDX tool to run to generate (SBOM) software bill-of-materials documents, why not checkout: [CycloneDX Python][cyclonedx-python]
21+
As of version `3.0.0`, the internal data model was adjusted to allow CycloneDX VEX documents to be produced as per
22+
[official examples](https://cyclonedx.org/capabilities/bomlink/#linking-external-vex-to-bom-inventory) linking a VEX
23+
documents to a separate BOM document.
2124

22-
Additionally, the following tool can be used as well (and this library was written to help improve it) [Jake][jake].
25+
If you're looking for a CycloneDX tool to run to generate (SBOM) software bill-of-materials documents, why not checkout
26+
[CycloneDX Python][cyclonedx-python] or [Jake][jake].
2327

24-
Additionally, you can use this module yourself in your application to programmatically generate SBOMs.
28+
Alternatively, you can use this module yourself in your application to programmatically generate CycloneDX BOMs.
2529

26-
CycloneDX is a lightweight BOM specification that is easily created, human-readable, and simple to parse.
27-
28-
View our documentation [here](https://cyclonedx-python-library.readthedocs.io/).
30+
View the documentation [here](https://cyclonedx-python-library.readthedocs.io/).
2931

3032
## Python Support
3133

‎cyclonedx/exception/__init__.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,7 @@
2121

2222

2323
class CycloneDxException(Exception):
24+
"""
25+
Root exception thrown by this library.
26+
"""
2427
pass

‎cyclonedx/exception/factory.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,16 +30,28 @@ class CycloneDxFactoryException(CycloneDxException):
3030

3131

3232
class LicenseChoiceFactoryException(CycloneDxFactoryException):
33+
"""
34+
Base exception that covers all LicenseChoiceFactory exceptions.
35+
"""
3336
pass
3437

3538

3639
class InvalidSpdxLicenseException(LicenseChoiceFactoryException):
40+
"""
41+
Thrown when an invalid SPDX License is provided.
42+
"""
3743
pass
3844

3945

4046
class LicenseFactoryException(CycloneDxFactoryException):
47+
"""
48+
Base exception that covers all LicenseFactory exceptions.
49+
"""
4150
pass
4251

4352

4453
class InvalidLicenseExpressionException(LicenseFactoryException):
54+
"""
55+
Thrown when an invalid License expressions is provided.
56+
"""
4557
pass

‎cyclonedx/exception/output.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@
2222
from . import CycloneDxException
2323

2424

25+
class BomGenerationErrorException(CycloneDxException):
26+
"""
27+
Raised if there is an unknown error.
28+
"""
29+
pass
30+
31+
2532
class FormatNotSupportedException(CycloneDxException):
2633
"""
2734
Exception raised when attempting to output a BOM to a format not supported in the requested version.

0 commit comments

Comments
 (0)