https://github.com/python/cpython/commit/1195c164daab873ebf87ba8efe44fffdf47307ef
commit: 1195c164daab873ebf87ba8efe44fffdf47307ef
branch: main
author: Seth Michael Larson <[email protected]>
committer: hugovk <[email protected]>
date: 2024-05-20T13:27:09-04:00
summary:
gh-112844: Update CPE references for external dependencies (#118521)
files:
M Tools/build/generate_sbom.py
diff --git a/Tools/build/generate_sbom.py b/Tools/build/generate_sbom.py
index 258b58c03c6800..c08568f2e00326 100644
--- a/Tools/build/generate_sbom.py
+++ b/Tools/build/generate_sbom.py
@@ -305,7 +305,21 @@ def create_externals_sbom() -> None:
# Set the versionInfo and downloadLocation fields for all packages.
for package in sbom_data["packages"]:
- package["versionInfo"] = externals_name_to_version[package["name"]]
+ package_version = externals_name_to_version[package["name"]]
+
+ # Update the version information in all the locations.
+ package["versionInfo"] = package_version
+ for external_ref in package["externalRefs"]:
+ if external_ref["referenceType"] != "cpe23Type":
+ continue
+ # Version is the fifth field of a CPE.
+ cpe23ref = external_ref["referenceLocator"]
+ external_ref["referenceLocator"] = re.sub(
+ r"\A(cpe(?::[^:]+){4}):[^:]+:",
+ fr"\1:{package_version}:",
+ cpe23ref
+ )
+
download_location = (
f"https://github.com/python/cpython-source-deps/archive/refs/tags/{externals_name_to_git_tag[package['name']]}.tar.gz"
)
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
