diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2024-05-20 19:32:38 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-20 19:32:38 (GMT) |
| commit | d8c562af55a0b475693ac78b92c477b3416a5ed0 (patch) | |
| tree | fc628892b7e53743a87e5ce38e3095e9edc55fd7 | |
| parent | fda3291643827d2c89ee1d5cc9b9b65c3e83d1e8 (diff) | |
| download | cpython-d8c562af55a0b475693ac78b92c477b3416a5ed0.zip cpython-d8c562af55a0b475693ac78b92c477b3416a5ed0.tar.gz cpython-d8c562af55a0b475693ac78b92c477b3416a5ed0.tar.bz2 | |
[3.13] gh-112844: Update CPE references for external dependencies (GH-118521) (#119237)
Co-authored-by: Seth Michael Larson <seth@python.org>
| -rw-r--r-- | Tools/build/generate_sbom.py | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/Tools/build/generate_sbom.py b/Tools/build/generate_sbom.py index 258b58c..c08568f 100644 --- a/Tools/build/generate_sbom.py +++ b/Tools/build/generate_sbom.py @@ -305,7 +305,21 @@ def create_externals_sbom() -> None: # Set the versionInfo and downloadLocation fields for all packages. for package in sbom_data["packages"]: - package["versionInfo"] = externals_name_to_version[package["name"]] + package_version = externals_name_to_version[package["name"]] + + # Update the version information in all the locations. + package["versionInfo"] = package_version + for external_ref in package["externalRefs"]: + if external_ref["referenceType"] != "cpe23Type": + continue + # Version is the fifth field of a CPE. + cpe23ref = external_ref["referenceLocator"] + external_ref["referenceLocator"] = re.sub( + r"\A(cpe(?::[^:]+){4}):[^:]+:", + fr"\1:{package_version}:", + cpe23ref + ) + download_location = ( f"https://github.com/python/cpython-source-deps/archive/refs/tags/{externals_name_to_git_tag[package['name']]}.tar.gz" ) |