diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2024-05-20 19:32:51 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-20 19:32:51 (GMT) |
| commit | 386e49259c517205045b98459bf8fdd3ef098e17 (patch) | |
| tree | a56e12bd3198215cd86157d3e5b280d6e028fb01 /Tools | |
| parent | a50f0651eeba115f82455a9e48178764bace35eb (diff) | |
| download | cpython-386e49259c517205045b98459bf8fdd3ef098e17.zip cpython-386e49259c517205045b98459bf8fdd3ef098e17.tar.gz cpython-386e49259c517205045b98459bf8fdd3ef098e17.tar.bz2 | |
[3.12] gh-112844: Update CPE references for external dependencies (GH-118521) (#119238)
Co-authored-by: Seth Michael Larson <seth@python.org>
Diffstat (limited to 'Tools')
| -rw-r--r-- | Tools/build/generate_sbom.py | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/Tools/build/generate_sbom.py b/Tools/build/generate_sbom.py index 258b58c..c08568f 100644 --- a/Tools/build/generate_sbom.py +++ b/Tools/build/generate_sbom.py @@ -305,7 +305,21 @@ def create_externals_sbom() -> None: # Set the versionInfo and downloadLocation fields for all packages. for package in sbom_data["packages"]: - package["versionInfo"] = externals_name_to_version[package["name"]] + package_version = externals_name_to_version[package["name"]] + + # Update the version information in all the locations. + package["versionInfo"] = package_version + for external_ref in package["externalRefs"]: + if external_ref["referenceType"] != "cpe23Type": + continue + # Version is the fifth field of a CPE. + cpe23ref = external_ref["referenceLocator"] + external_ref["referenceLocator"] = re.sub( + r"\A(cpe(?::[^:]+){4}):[^:]+:", + fr"\1:{package_version}:", + cpe23ref + ) + download_location = ( f"https://github.com/python/cpython-source-deps/archive/refs/tags/{externals_name_to_git_tag[package['name']]}.tar.gz" ) |