sbp commented on code in PR #430:
URL:
https://github.com/apache/tooling-trusted-releases/pull/430#discussion_r2635603630
##########
atr/tasks/sbom.py:
##########
@@ -221,20 +218,22 @@ async def score_tool(args: FileArgs) -> results.Results |
None:
if not (full_path.endswith(".cdx.json") and os.path.isfile(full_path)):
raise SBOMScoringError("SBOM file does not exist", {"file_path":
args.file_path})
bundle = sbom.utilities.path_to_bundle(pathlib.Path(full_path))
- properties = sbom.utilities.get_atr_props_from_bundle(bundle)
+ version, properties = sbom.utilities.get_props_from_bundle(bundle)
warnings, errors = sbom.conformance.ntia_2021_issues(bundle.bom)
- outdated = sbom.maven.plugin_outdated_version(bundle.bom)
+ # TODO: Could update the ATR version with a constant showing last change
to the augment/scan tools
+ outdated = sbom.tool.plugin_outdated_version(bundle.bom)
vulnerabilities = sbom.osv.vulns_from_bundle(bundle)
cli_errors = sbom.cyclonedx.validate_cli(bundle)
return results.SBOMToolScore(
kind="sbom_tool_score",
project_name=args.project_name,
version_name=args.version_name,
revision_number=args.revision_number,
+ bom_version=version,
file_path=args.file_path,
warnings=[w.model_dump_json() for w in warnings],
errors=[e.model_dump_json() for e in errors],
- outdated=outdated.model_dump_json() if outdated else None,
+ outdated=[o.model_dump_json() for o in outdated] if outdated else None,
Review Comment:
Thanks. Fine to keep this, I think! No change to the PR needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
