alitheg commented on code in PR #430:
URL:
https://github.com/apache/tooling-trusted-releases/pull/430#discussion_r2635460160
##########
atr/tasks/sbom.py:
##########
@@ -221,20 +218,22 @@ async def score_tool(args: FileArgs) -> results.Results |
None:
if not (full_path.endswith(".cdx.json") and os.path.isfile(full_path)):
raise SBOMScoringError("SBOM file does not exist", {"file_path":
args.file_path})
bundle = sbom.utilities.path_to_bundle(pathlib.Path(full_path))
- properties = sbom.utilities.get_atr_props_from_bundle(bundle)
+ version, properties = sbom.utilities.get_props_from_bundle(bundle)
warnings, errors = sbom.conformance.ntia_2021_issues(bundle.bom)
- outdated = sbom.maven.plugin_outdated_version(bundle.bom)
+ # TODO: Could update the ATR version with a constant showing last change
to the augment/scan tools
+ outdated = sbom.tool.plugin_outdated_version(bundle.bom)
vulnerabilities = sbom.osv.vulns_from_bundle(bundle)
cli_errors = sbom.cyclonedx.validate_cli(bundle)
return results.SBOMToolScore(
kind="sbom_tool_score",
project_name=args.project_name,
version_name=args.version_name,
revision_number=args.revision_number,
+ bom_version=version,
file_path=args.file_path,
warnings=[w.model_dump_json() for w in warnings],
errors=[e.model_dump_json() for e in errors],
- outdated=outdated.model_dump_json() if outdated else None,
+ outdated=[o.model_dump_json() for o in outdated] if outdated else None,
Review Comment:
Yes this is due to the version change of the pydantic model. warnings and
errors were there already so don't need it. We can:
- Leave it like this for now
- Accept that as we're pre-beta we don't care about old scan results and
remove the `None` guards - accepting that some old scans will cause errors
- Look to bring in something else to handle it as we discussed briefly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
