capycli 2.10.0.dev1__tar.gz → 2.10.1__tar.gz

{capycli-2.10.0.dev1 → capycli-2.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capycli
-Version: 2.10.0.dev1
+Version: 2.10.1
 Summary: CaPyCli - Clearing Automation Python Command Line Interface for SW360
 License-Expression: MIT
 License-File: License.md
@@ -38,17 +38,17 @@ Project-URL: issues, https://github.com/sw360/capycli/issues
 Description-Content-Type: text/markdown
 
 <!--
-# SPDX-FileCopyrightText: (c) 2018-2025 Siemens
+# SPDX-FileCopyrightText: (c) 2018-2026 Siemens
 # SPDX-License-Identifier: MIT
 -->
 
-![Header_Image](images/Github-social-capycli.png)
+![Header_Image](https://github.com/sw360/capycli/blob/0318f71ba1f9ba177432840717768fccfad1d6da/images/Github-social-capycli.png)
 
 # CaPyCli - Clearing Automation Python Command Line Tool for SW360
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/sw360/capycli/blob/main/License.md)
 [![PyPI](https://shields.io/pypi/v/capycli)](https://pypi.org/project/capycli/)
-[![Python Version](https://img.shields.io/badge/python-3.9%2C3.10%2C3.11-yellow?logo=python)](https://www.python.org/doc/versions/)
+[![Python Version](https://img.shields.io/badge/python-3.10%2C3.14-yellow?logo=python)](https://www.python.org/doc/versions/)
 [![Static Checks](https://github.com/sw360/capycli/actions/workflows/static-checks.yml/badge.svg)](https://github.com/sw360/capycli/actions/workflows/static-checks.yml)
 [![Unit Tests](https://github.com/sw360/capycli/actions/workflows/unit-tests.yml/badge.svg)](https://github.com/sw360/capycli/actions/workflows/unit-tests.yml)
 [![Coverage](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/tngraf/c8f15831ecdcf6e86ab2b69cbb2d4f89/raw/df1a91c074c5ee34dc1f0dcf82bc0e76e39b5b4e/capycli-cobertura-coverage.json&color=green)](https://github.com/sw360/capycli/actions/workflows/unit-tests.yml)
@@ -300,7 +300,7 @@ This is a Python project managed using ```Poetry```.
 
 ## Copyright & License
 
-Copyright 2018-2025 Siemens
+Copyright 2018-2026 Siemens
 
 This program and the accompanying materials are made
 available under the terms of the MIT License.  

{capycli-2.10.0.dev1 → capycli-2.10.1}/Readme.md

@@ -1,15 +1,15 @@
 <!--
-# SPDX-FileCopyrightText: (c) 2018-2025 Siemens
+# SPDX-FileCopyrightText: (c) 2018-2026 Siemens
 # SPDX-License-Identifier: MIT
 -->
 
-![Header_Image](images/Github-social-capycli.png)
+![Header_Image](https://github.com/sw360/capycli/blob/0318f71ba1f9ba177432840717768fccfad1d6da/images/Github-social-capycli.png)
 
 # CaPyCli - Clearing Automation Python Command Line Tool for SW360
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/sw360/capycli/blob/main/License.md)
 [![PyPI](https://shields.io/pypi/v/capycli)](https://pypi.org/project/capycli/)
-[![Python Version](https://img.shields.io/badge/python-3.9%2C3.10%2C3.11-yellow?logo=python)](https://www.python.org/doc/versions/)
+[![Python Version](https://img.shields.io/badge/python-3.10%2C3.14-yellow?logo=python)](https://www.python.org/doc/versions/)
 [![Static Checks](https://github.com/sw360/capycli/actions/workflows/static-checks.yml/badge.svg)](https://github.com/sw360/capycli/actions/workflows/static-checks.yml)
 [![Unit Tests](https://github.com/sw360/capycli/actions/workflows/unit-tests.yml/badge.svg)](https://github.com/sw360/capycli/actions/workflows/unit-tests.yml)
 [![Coverage](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/tngraf/c8f15831ecdcf6e86ab2b69cbb2d4f89/raw/df1a91c074c5ee34dc1f0dcf82bc0e76e39b5b4e/capycli-cobertura-coverage.json&color=green)](https://github.com/sw360/capycli/actions/workflows/unit-tests.yml)
@@ -261,7 +261,7 @@ This is a Python project managed using ```Poetry```.
 
 ## Copyright & License
 
-Copyright 2018-2025 Siemens
+Copyright 2018-2026 Siemens
 
 This program and the accompanying materials are made
 available under the terms of the MIT License.  

capycli-2.10.1/capycli/bom/bom_package.py

@@ -0,0 +1,215 @@
+# -------------------------------------------------------------------------------
+# Copyright (c) 2025 Siemens
+# All Rights Reserved.
+# Author: thomas.graf@siemens.com
+#
+# SPDX-License-Identifier: MIT
+# -------------------------------------------------------------------------------
+
+import logging
+import os
+import pathlib
+import posixpath
+import shutil
+import sys
+import tempfile
+from typing import Any
+
+from cyclonedx.model import ExternalReference, ExternalReferenceType, HashAlgorithm, HashType, XsUri
+from cyclonedx.model.bom import Bom
+
+import capycli.common.script_base
+from capycli.bom.download_sources import BomDownloadSources
+from capycli.common.capycli_bom_support import CaPyCliBom, CycloneDxSupport, SbomWriter
+from capycli.common.print import print_red, print_text, print_yellow
+from capycli.common.script_support import ScriptSupport
+from capycli.main.result_codes import ResultCode
+
+LOG = capycli.get_logger(__name__)
+
+
+class BomPackage(capycli.common.script_base.ScriptBase):
+    """
+    Create a single zip archive that contains the SBOM and all source and binary files.
+    The archive shoukd have the following structure:
+
+    sbom.cdx.json
+    +--- binaries
+    |    +--- 77100a62c2e6f04b53977b9f541044d7d722693d
+    |    |    `--- some-binary.jar
+    |    +--- 8031352b2bb0a49e67818bf04c027aa92e645d5c
+    |    |    `--- another-binary.jar
+    |    `--- (... more ...)
+    `--- sources
+        +--- 6bb10559db88828dac3627de26974035a5dd4ddb
+        |    `--- some-sources.jar
+        +--- 4d44e4edc4a7fb39f09b95b09f560a15976fa1ba
+        |    `--- another-sources.jar
+        `--- (... more ...)
+    """
+    def download_files(self, sbom: Bom, target_folder: str) -> None:
+        """Download source and binary files for all items of the SBOM.
+
+        @params:
+            bom           - Required : the bill of materials (BOM) (list)
+            target_folder - Required : folder to store the source files (string)
+        """
+
+        for component in sbom.components:
+            item_name = ScriptSupport.get_full_name_from_component(component)
+            print_text("  " + item_name)
+
+            # download source file
+            source_url = CycloneDxSupport.get_ext_ref_source_url(component)
+            if source_url:
+                result = BomDownloadSources.download_source_file(source_url._uri, target_folder)
+            else:
+                result = None
+                print_red("    No source URL specified!")
+
+            if result is not None:
+                (path, sha1) = result
+                # move file to appropriate location
+                filename = pathlib.Path(path).name
+                targetsha = os.path.join(target_folder, "sources", sha1)
+                os.makedirs(targetsha, exist_ok=True)
+                target = os.path.join(targetsha, filename)
+                shutil.move(path, target)
+
+                # update SBOM
+                new = False
+                ext_ref = CycloneDxSupport.get_ext_ref(
+                    component, ExternalReferenceType.DISTRIBUTION, CaPyCliBom.SOURCE_FILE_COMMENT)
+                file_uri = posixpath.join("sources", sha1, filename)
+                if not file_uri.startswith("file://"):
+                    file_uri = "file:///" + file_uri
+                if not ext_ref:
+                    ext_ref = ExternalReference(
+                        type=ExternalReferenceType.DISTRIBUTION,
+                        comment=CaPyCliBom.SOURCE_FILE_COMMENT,
+                        url=XsUri(file_uri))
+                    new = True
+                else:
+                    ext_ref.url = XsUri(file_uri)
+                ext_ref.hashes.add(HashType(
+                    alg=HashAlgorithm.SHA_1,
+                    content=sha1))
+                if new:
+                    component.external_references.add(ext_ref)
+
+            # download binary file
+            binary_url = CycloneDxSupport.get_ext_ref_binary_url(component)
+            if binary_url:
+                result = BomDownloadSources.download_source_file(binary_url._uri, target_folder, is_binary=True)
+            else:
+                result = None
+                print_yellow("    No binary URL specified!")
+
+            if result is not None:
+                (path, sha1) = result
+                # move file to appropriate location
+                filename = pathlib.Path(path).name
+                targetsha = os.path.join(target_folder, "binaries", sha1)
+                os.makedirs(targetsha, exist_ok=True)
+                target = os.path.join(targetsha, filename)
+                shutil.move(path, target)
+
+                # update SBOM
+                new = False
+                ext_ref = CycloneDxSupport.get_ext_ref(
+                    component, ExternalReferenceType.DISTRIBUTION, CaPyCliBom.BINARY_FILE_COMMENT)
+                file_uri = posixpath.join("binaries", sha1, filename)
+                if not file_uri.startswith("file://"):
+                    file_uri = "file:///" + file_uri
+                if not ext_ref:
+                    ext_ref = ExternalReference(
+                        type=ExternalReferenceType.DISTRIBUTION,
+                        comment=CaPyCliBom.BINARY_FILE_COMMENT,
+                        url=XsUri(file_uri))
+                    new = True
+                else:
+                    ext_ref.url = XsUri(file_uri)
+                ext_ref.hashes.add(HashType(
+                    alg=HashAlgorithm.SHA_1,
+                    content=sha1))
+                if new:
+                    component.external_references.add(ext_ref)
+
+    def run(self, args: Any) -> None:
+        """Main method
+
+        @params:
+            args - command line arguments
+        """
+        if args.debug:
+            global LOG
+            LOG = capycli.get_logger(__name__)
+        else:
+            # suppress (debug) log output from requests and urllib
+            logging.getLogger("requests").setLevel(logging.WARNING)
+            logging.getLogger("urllib3").setLevel(logging.WARNING)
+            logging.getLogger("urllib3.connectionpool").setLevel(logging.WARNING)
+
+        print_text(
+            "\n" + capycli.get_app_signature() +
+            " - create a single zip archive that contains the SBOM and all source and binary files\n")
+
+        if args.help:
+            print("usage: capycli bom bompackage -i bom.json")
+            print("")
+            print("optional arguments:")
+            print("    -h, --help            show this help message and exit")
+            print("    -i INPUTFILE,         input SBOM file to read from (JSON)")
+            print("    -o OUTPUT ARCHIVE,    path of the output zip archive")
+            print("    -v                    be verbose")
+            return
+
+        if not args.inputfile:
+            print_red("No input file specified!")
+            sys.exit(ResultCode.RESULT_COMMAND_ERROR)
+
+        if not os.path.isfile(args.inputfile):
+            print_red("Input file not found!")
+            sys.exit(ResultCode.RESULT_FILE_NOT_FOUND)
+
+        if not args.outputfile:
+            print_red("No output file specified!")
+            sys.exit(ResultCode.RESULT_COMMAND_ERROR)
+
+        print_text("Loading SBOM file " + args.inputfile)
+        try:
+            bom = CaPyCliBom.read_sbom(args.inputfile)
+        except Exception as ex:
+            print_red("Error reading input SBOM file: " + repr(ex))
+            sys.exit(ResultCode.RESULT_ERROR_READING_BOM)
+
+        if args.verbose:
+            print_text(" " + str(len(bom.components)) + "components read from SBOM file")
+
+        temp_dir = tempfile.TemporaryDirectory(prefix="capycli_bom_pkg_")
+        target_folder = temp_dir.name
+
+        pp = pathlib.Path(args.outputfile)
+        if pp.suffix.lower() != ".zip":
+            print_yellow("Warning: bom package file should have .zip extension")
+            args.bom_package = args.outputfile + ".zip"
+
+        print_text("\nDownloading files to folder " + target_folder + " ...")
+
+        self.download_files(bom, target_folder)
+
+        print_text("\nCreating BOM package " + args.outputfile)
+        try:
+            # add SBOM to temp folder
+            sbom_file = os.path.join(target_folder, "sbom.cdx.json")
+            SbomWriter.write_to_json(bom, sbom_file, True)
+            shutil.make_archive(
+                base_name=args.outputfile.rstrip(".zip"),
+                format="zip",
+                root_dir=target_folder)
+            temp_dir.cleanup()
+        except Exception as ex:
+            print_red("Error creating BOM package: " + repr(ex))
+            sys.exit(ResultCode.RESULT_ERROR_WRITING_BOM)
+
+        print("\n")

{capycli-2.10.0.dev1 → capycli-2.10.1}/capycli/bom/download_sources.py

@@ -11,9 +11,7 @@ import logging
 import os
 import pathlib
 import re
-import shutil
 import sys
-import tempfile
 from typing import Any, Optional, Tuple
 from urllib.parse import urlparse
 
@@ -36,7 +34,8 @@ class BomDownloadSources(capycli.common.script_base.ScriptBase):
     Download source files from the URL specified in the SBOM.
     """
 
-    def get_filename_from_cd(self, cd: str) -> str:
+    @staticmethod
+    def get_filename_from_cd(cd: str) -> str:
         """
         Get filename from content-disposition.
         """
@@ -57,18 +56,20 @@ class BomDownloadSources(capycli.common.script_base.ScriptBase):
         _, extension = os.path.splitext(filename)
         return extension in good_extensions
 
-    def download_source_file(self, url: str, source_folder: str) -> Optional[Tuple[str, str]]:
+    @staticmethod
+    def download_source_file(url: str, source_folder: str, is_binary: bool = False) -> Optional[Tuple[str, str]]:
         """Download a file from a URL.
 
         @params:
             url           - Required : url of the file to get uploaded (string)
             source_folder - Required : folder to store the source files (string)
+            is_binary     - Optional : whether the file is a binary file (boolean, default: False)
         """
         print_text("    URL = " + url)
 
         try:
             response = requests.get(url, allow_redirects=True)
-            filename = self.get_filename_from_cd(response.headers.get("content-disposition", ""))
+            filename = BomDownloadSources.get_filename_from_cd(response.headers.get("content-disposition", ""))
             if not filename:
                 filename_ps = urlparse(url)
                 if filename_ps:
@@ -82,7 +83,7 @@ class BomDownloadSources(capycli.common.script_base.ScriptBase):
             path = os.path.join(source_folder, filename)
             if (response.status_code == requests.codes["ok"]):
                 open(path, "wb").write(response.content)
-                if not BomDownloadSources.is_good_source_file(path):
+                if not is_binary and not BomDownloadSources.is_good_source_file(path):
                     print_yellow("    Downloaded file seems not to be a valid source file!")
                 sha1 = hashlib.sha1(response.content).hexdigest()
                 return (path, sha1)
@@ -187,7 +188,6 @@ class BomDownloadSources(capycli.common.script_base.ScriptBase):
             print("    -source SOURCE        source folder or additional source file")
             print("    -o OUTPUTFILE         output file to write to")
             print("    -v                    be verbose")
-            print("    -bp, --bom-package    create a single zip archive that contains the SBOM and all source files")
             return
 
         if not args.inputfile:
@@ -209,23 +209,12 @@ class BomDownloadSources(capycli.common.script_base.ScriptBase):
             print_text(" " + str(len(bom.components)) + "components read from SBOM file")
 
         source_folder = "./"
-        cleanup_temp_dir = False
-        if args.bom_package and not args.source:
-            temp_dir = tempfile.TemporaryDirectory(prefix="capycli_bom_pkg_")
-            source_folder = temp_dir.name
-            cleanup_temp_dir = True
         if args.source:
             source_folder = args.source
         if (not source_folder) or (not os.path.isdir(source_folder)):
             print_red("Target source code folder does not exist!")
             sys.exit(ResultCode.RESULT_COMMAND_ERROR)
 
-        if args.bom_package:
-            pp = pathlib.Path(args.bom_package)
-            if pp.suffix.lower() != ".zip":
-                print_yellow("Warning: bom package file should have .zip extension")
-                args.bom_package = args.bom_package + ".zip"
-
         print_text("\nDownloading source files to folder " + source_folder + " ...")
 
         self.download_sources(bom, source_folder)
@@ -244,21 +233,4 @@ class BomDownloadSources(capycli.common.script_base.ScriptBase):
             if args.verbose:
                 print_text(" " + str(len(bom.components)) + " components written to SBOM file")
 
-        if args.bom_package:
-            print_text("\nCreating BOM package " + args.bom_package)
-            try:
-                # add SBOM to temp folder
-                sbom_file = os.path.join(source_folder, "sbom.cdx.json")
-                self.update_local_path(bom, sbom_file)
-                SbomWriter.write_to_json(bom, sbom_file, True)
-                shutil.make_archive(
-                    base_name=args.bom_package.rstrip(".zip"),
-                    format="zip",
-                    root_dir=source_folder)
-                if cleanup_temp_dir:
-                    temp_dir.cleanup()
-            except Exception as ex:
-                print_red("Error creating BOM package: " + repr(ex))
-                sys.exit(ResultCode.RESULT_ERROR_WRITING_BOM)
-
         print("\n")

{capycli-2.10.0.dev1 → capycli-2.10.1}/capycli/bom/handle_bom.py

@@ -1,5 +1,5 @@
 # -------------------------------------------------------------------------------
-# Copyright (c) 2019-24 Siemens
+# Copyright (c) 2019-2025 Siemens
 # All Rights Reserved.
 # Author: thomas.graf@siemens.com
 #
@@ -10,6 +10,7 @@ import sys
 from typing import Any
 
 import capycli.bom.bom_convert
+import capycli.bom.bom_package
 import capycli.bom.bom_validate
 import capycli.bom.check_bom
 import capycli.bom.check_bom_item_status
@@ -51,6 +52,7 @@ def run_bom_command(args: Any) -> None:
         print("    Merge             merge two bills of material")
         print("    Findsources       determine the source code for SBOM items")
         print("    Validate          validate an SBOM")
+        print("    BomPackage        create a single archive that contains the SBOM and all source and binary files")
         return
 
     subcommand = args.command[1].lower()
@@ -139,5 +141,11 @@ def run_bom_command(args: Any) -> None:
         app14.run(args)
         return
 
+    if subcommand == "bompackage":
+        """Validate an SBOM."""
+        app15 = capycli.bom.bom_package.BomPackage()
+        app15.run(args)
+        return
+
     print_red("Unknown sub-command: ")
     sys.exit(ResultCode.RESULT_COMMAND_ERROR)

{capycli-2.10.0.dev1 → capycli-2.10.1}/capycli/bom/show_bom.py

@@ -1,5 +1,5 @@
 # -------------------------------------------------------------------------------
-# Copyright (c) 2019-2024 Siemens
+# Copyright (c) 2019-2026 Siemens
 # All Rights Reserved.
 # Author: thomas.graf@siemens.com
 #
@@ -64,11 +64,14 @@ class ShowBom(capycli.common.script_base.ScriptBase):
             return
 
         for bomitem in bom.components:
+            name = bomitem.name
+            if bomitem.group:
+                name = bomitem.group + "/" + bomitem.name
             if not bomitem.version:
-                print_text("  " + bomitem.name)
+                print_text("  " + name)
                 print_yellow("  component version is missing!")
             else:
-                print_text("  " + bomitem.name + ", " + bomitem.version)
+                print_text("  " + name + ", " + bomitem.version)
 
             if self.verbose:
                 if bomitem.purl:

{capycli-2.10.0.dev1 → capycli-2.10.1}/capycli/dependencies/handle_dependencies.py

@@ -1,5 +1,5 @@
 # -------------------------------------------------------------------------------
-# Copyright (c) 2019-23 Siemens
+# Copyright (c) 2019-2025 Siemens
 # All Rights Reserved.
 # Author: thomas.graf@siemens.com
 #
@@ -14,6 +14,7 @@ import capycli.dependencies.maven_list
 import capycli.dependencies.maven_pom
 import capycli.dependencies.nuget
 import capycli.dependencies.python
+import capycli.dependencies.rust
 from capycli.common.print import print_red
 from capycli.main.result_codes import ResultCode
 
@@ -34,6 +35,7 @@ def run_dependency_command(args: Any) -> None:
         print("    Javascript        determine dependencies for a JavaScript project")
         print("    MavenPom          determine dependencies for a Java/Maven project using the pom.xml file")
         print("    MavenList         determine dependencies for a Java/Maven project using a Maven command")
+        print("    Rust              determine dependencies for a Rust project")
         return
 
     subcommand = args.command[1].lower()
@@ -67,5 +69,11 @@ def run_dependency_command(args: Any) -> None:
         app5.run(args)
         return
 
+    if subcommand == "rust":
+        """Determine Rust components/dependencies for a given project"""
+        app6 = capycli.dependencies.rust.GetRustDependencies()
+        app6.run(args)
+        return
+
     print_red("Unknown sub-command: " + subcommand)
     sys.exit(ResultCode.RESULT_COMMAND_ERROR)

{capycli-2.10.0.dev1 → capycli-2.10.1}/capycli/dependencies/javascript.py

@@ -105,8 +105,9 @@ class GetJavascriptDependencies(capycli.common.dependencies_base.DependenciesBas
                 if "dev" in dep:
                     isdev = dep["dev"]
 
+                version = dep.get("version", "")
                 if isdev:
-                    # LOG.debug("Ignoring dev dependency: " + key + "," + dep["version"])
+                    print_yellow("Ignoring dev dependency: " + key + "," + dep["version"])
                     continue
 
                 modified_key = ""
@@ -115,11 +116,14 @@ class GetJavascriptDependencies(capycli.common.dependencies_base.DependenciesBas
                 else:
                     modified_key = key
 
-                LOG.debug("Checking dependency: " + modified_key + "," + dep["version"])
-                purl = PackageURL("npm", "", modified_key, dep["version"], "", "")
+                if dep.get("link", ""):
+                    print_yellow("Ignoring linked dependency: " + modified_key + "," + version)
+                    continue
+                LOG.debug("Checking dependency: " + modified_key + "," + version)
+                purl = PackageURL("npm", "", modified_key, version, "", "")
                 cxcomp = Component(
                     name=modified_key.strip(),
-                    version=dep["version"].strip(),
+                    version=version.strip(),
                     purl=purl,
                     bom_ref=purl.to_string())
 

{capycli-2.10.0.dev1 → capycli-2.10.1}/capycli/dependencies/python.py

@@ -779,7 +779,8 @@ class GetPythonDependencies(capycli.common.script_base.ScriptBase):
 
         return sbom
 
-    def check_meta_data(self, sbom: Bom) -> bool:
+    @staticmethod
+    def check_meta_data(sbom: Bom, verbose: bool) -> bool:
         """
         Check whether all required meta-data is available.
 
@@ -790,37 +791,37 @@ class GetPythonDependencies(capycli.common.script_base.ScriptBase):
             bool: True if all required meta-data is available; otherwise False.
         """
 
-        if self.verbose:
+        if verbose:
             print_text("\nChecking meta-data:")
 
         result = True
         cxcomp: Component
         for cxcomp in sbom.components:
-            if self.verbose:
+            if verbose:
                 print_text(f"  {cxcomp.name}, {cxcomp.version}")
 
             if not cxcomp.purl:
                 result = False
-                if self.verbose:
+                if verbose:
                     print_yellow("    package-url missing")
 
             homepage = CycloneDxSupport.get_ext_ref_website(cxcomp)
             if not homepage:
                 result = False
-                if self.verbose:
+                if verbose:
                     print_yellow("    Homepage missing")
 
             if not cxcomp.licenses:
-                if self.verbose:
+                if verbose:
                     LOG.debug("    License missing")
             elif len(cxcomp.licenses) == 0:
-                if self.verbose:
+                if verbose:
                     LOG.debug("    License missing")
 
             src_url = CycloneDxSupport.get_ext_ref_source_url(cxcomp)
             if not src_url:
                 result = False
-                if self.verbose:
+                if verbose:
                     print_yellow("    Source code URL missing")
 
         return result
@@ -884,7 +885,7 @@ class GetPythonDependencies(capycli.common.script_base.ScriptBase):
             print_text("Formatting package list...")
             sbom = self.convert_package_list(package_list, args.search_meta_data, args.package_source)
 
-        self.check_meta_data(sbom)
+        GetPythonDependencies.check_meta_data(sbom, self.verbose)
 
         if self.verbose:
             print()