Skip to content

Commit 002f966

Browse files
jkowalleckjkuglersemantic-release
authored
feat!: v8.0.0 (#665)
### BREAKING Changes * Removed `cyclonedx.mode.ThisTool`, utilize `cyclonedx.builder.this.this_tool()` instead. * Moved `cyclonedx.model.Tool` to `cyclonedx.model.tool.Tool`. * Property `cyclonedx.mode.bom.BomMetaData.tools` is of type `cyclonedx.model.tool.ToolRepository` now, was `SortedSet[cyclonedx.model.Tool]`. The getter will act accordingly; the setter might act in a backwards-compatible way. * Property `cyclonedx.mode.vulnerability.Vulnerability.tools` is of type `cyclonedx.model.tool.ToolRepository` now, was `SortedSet[cyclonedx.model.Tool]`. The getter will act accordingly; the setter might act in a backwards-compatible way. * Constructor `cyclonedx.model.license.LicenseExpression()` accepts optional argument `acknowledgement` only as key-word argument, no longer as positional argument. ### Changes * Constructor of `cyclonedx.model.bom.BomMetaData` also accepts an instance of `cyclonedx.model.tool.ToolRepository` for argument `tools`. * Constructor of `cyclonedx.model.bom.BomMetaData` no longer adds this very library as a tool. Downstream users SHOULD add it manually, like `my-bom.metadata.tools.components.add(cyclonedx.builder.this.this_component())`. ### Fixes * Deserialization of CycloneDX that do not include tools in the metadata are no longer unexpectedly modified/altered. ### Added Enabled Metadata Tools representation and serialization in accordance with CycloneDX 1.5 * New class `cyclonedx.model.tool.ToolRepository`. * New function `cyclonedx.builder.this.this_component()` -- representation of this very python library as a `Component`. * New function `cyclonedx.builder.this.this_tool()` -- representation of this very python library as a `Tool`. * New function `cyclonedx.model.tool.Tool.from_component()`. ### Dependencies * Raised runtime dependency `py-serializable>=1.1.1,<2`, was `>=1.1.0,<2`. --------- Signed-off-by: Jan Kowalleck <[email protected]> Signed-off-by: Joshua Kugler <[email protected]> Signed-off-by: semantic-release <[email protected]> Co-authored-by: Joshua Kugler <[email protected]> Co-authored-by: semantic-release <[email protected]>
1 parent a210809 commit 002f966

File tree

479 files changed

+4829
-10142
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

479 files changed

+4829
-10142
lines changed

‎CHANGELOG.md

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,29 @@
11
# CHANGELOG
22

33

4+
## Unreleased
5+
6+
### Documentation
7+
8+
* docs(chaneglog): omit chore/ci/refactor/style/test/build (#703)
9+
10+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`a210809`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/a210809efb34c2dc895fc0c6d96a3412a9097625))
11+
12+
* docs: rephrase migration paths
13+
14+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`b0260a7`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/b0260a7d45bc3e099b979001049a8c5a67b97634))
15+
16+
### Unknown
17+
18+
* Merge remote-tracking branch &#39;origin/main&#39; into 8.0.0-dev ([`b9a33e6`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/b9a33e614a84ba4a6546a1907b70a0cbfee8cd6f))
19+
20+
* rework tools xml deserializer (#700)
21+
22+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`1a24ee6`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/1a24ee6a0853e535465f85c6380971948281ad6e))
23+
24+
* Merge remote-tracking branch &#39;origin/main&#39; into 8.0.0-dev ([`4c57fa1`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/4c57fa156516de07cdd4acd3f3057c0b20d108d7))
25+
26+
427

528
## v7.6.2 (2024-10-07)
629

@@ -20,9 +43,126 @@ fixes #690
2043

2144
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`d8b20bd`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/d8b20bdc5224ea30cf767f6f3f1a6f8ff2754973))
2245

46+
### Unknown
47+
48+
* docs
49+
50+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`68c681d`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/68c681d46c85230a97c4058de97400f3d93119f5))
51+
52+
53+
## v8.0.0-rc.2 (2024-09-27)
54+
55+
### Fix
56+
57+
* fix: ToolRepository serialize migrated tools deduplicated (#686)
58+
59+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`35ccdd1`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/35ccdd1bfec9757457763308d16e1dbf5d9e28e9))
60+
61+
### Unknown
62+
63+
* docs
64+
65+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`2e16408`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/2e16408098a3c649b80fb407d4f43aaa34aee39f))
66+
67+
* rename `ToolsRepository` -&gt; `ToolRepository` (#687)
68+
69+
Item class of repository is to be called in singular(`Tool`).
70+
71+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`e00af17`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/e00af1739fa6d3933315e96266d96d9b290012ee))
72+
73+
74+
## v8.0.0-rc.1 (2024-09-25)
75+
76+
### Documentation
77+
78+
* docs: migrate to v8.0.0 (#684)
79+
80+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`0ac84d7`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/0ac84d76f2e526f329937ab004480405492e7417))
81+
82+
### Fix
83+
84+
* fix: assert copyright headers
85+
86+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`bef268b`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/bef268b7abe2c3f343274d7789906c99c80e9df9))
87+
88+
### Unknown
89+
90+
* Merge branch &#39;main&#39; into 8.0.0-dev
91+
92+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`39514b3`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/39514b331eef98fbf5208ead341060831f8acddf))
93+
94+
* Merge branch &#39;main&#39; into 8.0.0-dev ([`c123aff`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/c123aff4bd479ec0f5f1982725ffe8901afb87c9))
95+
2396

2497
## v7.6.1 (2024-09-18)
2598

99+
### Breaking
100+
101+
* feat!: this-builder (#649)
102+
103+
reworked `ThisTool` for #635
104+
105+
---------
106+
107+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`cf5d2c7`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/cf5d2c7e43883967c5d5837f465ecac5a8cc034e))
108+
109+
* refactor!: `LicenseExpression()` optional args are named args (#595)
110+
111+
fixes #594
112+
113+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`0172564`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/0172564d5f9529e7ce543da434969b552833de31))
114+
115+
* feat!: Add component and services for tools (#635)
116+
117+
CycloneDX spec 1.5 deprecated an array of tools in bom.metadata and
118+
instead prefers object with an array of components and an array of
119+
services.
120+
121+
This PR implements that.
122+
123+
This works de-serializing a Syft SBOM with a tool section like so:
124+
```
125+
&#34;metadata&#34;: {
126+
&#34;timestamp&#34;: &#34;2024-06-10T13:06:52-08:00&#34;,
127+
&#34;tools&#34;: {
128+
&#34;components&#34;: [
129+
{
130+
&#34;type&#34;: &#34;application&#34;,
131+
&#34;author&#34;: &#34;anchore&#34;,
132+
&#34;name&#34;: &#34;syft&#34;,
133+
&#34;version&#34;: &#34;1.4.1&#34;
134+
}
135+
]
136+
},
137+
&#34;component&#34;: {
138+
&#34;bom-ref&#34;: &#34;08329a07b4eb8eac&#34;,
139+
&#34;type&#34;: &#34;file&#34;,
140+
&#34;name&#34;: &#34;./&#34;
141+
}
142+
},
143+
```
144+
Next up: docs, XML (de)serialization code, and tests.
145+
146+
fixes #561
147+
148+
---------
149+
150+
Signed-off-by: Joshua Kugler &lt;[email protected]&gt;
151+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt;
152+
Co-authored-by: Jan Kowalleck &lt;[email protected]&gt; ([`1f5fd7a`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/1f5fd7a6be94d93d2260622d39ea01cd74614402))
153+
154+
* feat!: 8.0.0
155+
156+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`9ba4b8e`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/9ba4b8e5d255c8dba51df214786328bfa700291c))
157+
158+
### Feature
159+
160+
* feat: don&#39;t add self to `metafata.tools` (#674)
161+
162+
fixes #673
163+
164+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`e0a153f`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/e0a153fbd553dcf29343d72e361c1cc9122c63b4))
165+
26166
### Fix
27167

28168
* fix: file copyright headers (#676)
@@ -33,6 +173,16 @@ correct headers
33173

34174
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`35e00b4`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/35e00b4ee5a9306b9e97b011025409bcbfcef309))
35175

176+
### Unknown
177+
178+
* Merge branch &#39;main&#39; into 8.0.0-dev ([`3d1548a`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/3d1548abf5db45764a22fcca96493574f96ff693))
179+
180+
* Merge branch &#39;main&#39; into 8.0.0-dev
181+
182+
Signed-off-by: Jan Kowalleck &lt;[email protected]&gt; ([`735c800`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/735c8003ce88b0c6efa802ccd806f17d22b4df89))
183+
184+
* Merge branch &#39;main&#39; into 8.0.0-dev ([`0ec785d`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/0ec785d29abcc215a5a0f6feec9bf16b0994cc92))
185+
36186

37187
## v7.6.0 (2024-08-14)
38188

‎cyclonedx/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@
2222

2323
# !! version is managed by semantic_release
2424
# do not use typing here, or else `semantic_release` might have issues finding the variable
25-
__version__ = "7.6.2" # noqa:Q000
25+
__version__ = "8.0.0-rc.2" # noqa:Q000

‎cyclonedx/builder/__init__.py

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# This file is part of CycloneDX Python Library
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
18+
"""
19+
Builders used in this library.
20+
"""

‎cyclonedx/builder/this.py

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# This file is part of CycloneDX Python Library
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
18+
"""Representation of this very python library."""
19+
20+
__all__ = ['this_component', 'this_tool', ]
21+
22+
from .. import __version__ as __ThisVersion # noqa: N812
23+
from ..model import ExternalReference, ExternalReferenceType, XsUri
24+
from ..model.component import Component, ComponentType
25+
from ..model.license import DisjunctiveLicense, LicenseAcknowledgement
26+
from ..model.tool import Tool
27+
28+
# !!! keep this file in sync with `pyproject.toml`
29+
30+
31+
def this_component() -> Component:
32+
"""Representation of this very python library as a :class:`Component`."""
33+
return Component(
34+
type=ComponentType.LIBRARY,
35+
group='CycloneDX',
36+
name='cyclonedx-python-lib',
37+
version=__ThisVersion or 'UNKNOWN',
38+
description='Python library for CycloneDX',
39+
licenses=(DisjunctiveLicense(id='Apache-2.0',
40+
acknowledgement=LicenseAcknowledgement.DECLARED),),
41+
external_references=(
42+
# let's assume this is not a fork
43+
ExternalReference(
44+
type=ExternalReferenceType.WEBSITE,
45+
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/#readme')
46+
),
47+
ExternalReference(
48+
type=ExternalReferenceType.DOCUMENTATION,
49+
url=XsUri('https://cyclonedx-python-library.readthedocs.io/')
50+
),
51+
ExternalReference(
52+
type=ExternalReferenceType.VCS,
53+
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib')
54+
),
55+
ExternalReference(
56+
type=ExternalReferenceType.BUILD_SYSTEM,
57+
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/actions')
58+
),
59+
ExternalReference(
60+
type=ExternalReferenceType.ISSUE_TRACKER,
61+
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/issues')
62+
),
63+
ExternalReference(
64+
type=ExternalReferenceType.LICENSE,
65+
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE')
66+
),
67+
ExternalReference(
68+
type=ExternalReferenceType.RELEASE_NOTES,
69+
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md')
70+
),
71+
# we cannot assert where the lib was fetched from, but we can give a hint
72+
ExternalReference(
73+
type=ExternalReferenceType.DISTRIBUTION,
74+
url=XsUri('https://pypi.org/project/cyclonedx-python-lib/')
75+
),
76+
),
77+
# to be extended...
78+
)
79+
80+
81+
def this_tool() -> Tool:
82+
"""Representation of this very python library as a :class:`Tool`."""
83+
return Tool.from_component(this_component())

0 commit comments

Comments
 (0)