languages/cpython
languages/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2024-10-14 09:58:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

[3.12] gh-112844: Update CPE references for external dependencies (GH-118521) (#119238)

Browse source 
Co-authored-by: Seth Michael Larson <seth@python.org>
This commit is contained in:
Miss Islington (bot) 2024-05-20 21:32:51 +02:00 committed by GitHub
parent a50f0651ee
commit 386e49259c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
Tools/build/generate_sbom.py
View file

@ -305,7 +305,21 @@ def create_externals_sbom() -> None:
# Set the versionInfo and downloadLocation fields for all packages.
for package in sbom_data["packages"]:
package["versionInfo"] = externals_name_to_version[package["name"]]
package_version = externals_name_to_version[package["name"]]
# Update the version information in all the locations.
package["versionInfo"] = package_version
for external_ref in package["externalRefs"]:
if external_ref["referenceType"] != "cpe23Type":
continue
# Version is the fifth field of a CPE.
cpe23ref = external_ref["referenceLocator"]
external_ref["referenceLocator"] = re.sub(
r"\A(cpe(?::[^:]+){4}):[^:]+:",
fr"\1:{package_version}:",
cpe23ref
)
download_location = (
f"https://github.com/python/cpython-source-deps/archive/refs/tags/{externals_name_to_git_tag[package['name']]}.tar.gz"
)