continuous-delivery-scripts 4.4.0__tar.gz → 4.4.2__tar.gz

{continuous_delivery_scripts-4.4.0/continuous_delivery_scripts.egg-info → continuous_delivery_scripts-4.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: continuous-delivery-scripts
-Version: 4.4.0
+Version: 4.4.2
 Summary: Git-based CI/CD tools for releases, changelogs, SPDX SBOMs and licence reporting
 Home-page: https://github.com/ARMmbed/continuous-delivery-scripts
 Author: Arm
@@ -27,7 +27,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: setuptools
 Requires-Dist: gitpython
-Requires-Dist: towncrier==22.12.0
+Requires-Dist: towncrier==26.9.0
 Requires-Dist: pyautoversion~=1.2.0
 Requires-Dist: pdoc3==0.11.6
 Requires-Dist: toml

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/_version.py

@@ -11,8 +11,8 @@ References
 This file is autogenerated, do not modify by hand.
 """
 
-__version__ = "4.4.0"
-COMMIT = "b480ded441705a4dda9e7d2d3e7a3e1b45729688"
+__version__ = "4.4.2"
+COMMIT = "2c6e20cf305e75f9cce5b43a3b64f76416e14db7"
 MAJOR = 4
 MINOR = 4
-PATCH = 0
+PATCH = 2

continuous_delivery_scripts-4.4.2/continuous_delivery_scripts/check_licence_compliance.py

@@ -0,0 +1,124 @@
+#
+# Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+"""Check project and dependency licences without generating SPDX documents."""
+
+import argparse
+import logging
+import sys
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from continuous_delivery_scripts.language_specifics import get_language_specifics
+from continuous_delivery_scripts.spdx_report.licence_assessment import LicenceAssessment
+from continuous_delivery_scripts.spdx_report.spdx_summary import _configured_licence_policy
+from continuous_delivery_scripts.utils.configuration import configuration, ConfigurationVariable
+from continuous_delivery_scripts.utils.logging import log_exception, set_log_level
+
+if TYPE_CHECKING:
+    from continuous_delivery_scripts.spdx_report.spdx_project import SpdxProject
+
+logger = logging.getLogger(__name__)
+
+
+def _log_assessment_details(project: "SpdxProject") -> None:
+    """Log per-dependency assessment details for statuses that need attention."""
+    if not logger.isEnabledFor(logging.WARNING):
+        return
+    attention = [
+        (name, result)
+        for name, result in sorted(project.licence_assessments.items())
+        if result.status in (LicenceAssessment.REVIEW, LicenceAssessment.UNKNOWN, LicenceAssessment.DENY)
+    ]
+    if not attention:
+        return
+    logger.warning("Dependencies needing attention:")
+    for name, result in attention:
+        discovered = result.discovered_licence or result.dependency_licence
+        details = [
+            f"status={result.status.value}",
+            f"discovered_licence={discovered}",
+            f"assessed_licence={result.dependency_licence}",
+            f"rule={result.rule}",
+            f"reason={result.reason}",
+        ]
+        if result.selected_licence:
+            details.append(f"selected_licence={result.selected_licence}")
+        logger.warning("- %s: %s", name, "; ".join(details))
+
+
+def _print_policy_summary(project: "SpdxProject") -> None:
+    """Print a human-readable summary of the configured licence policy and outcome."""
+    counts = {
+        status.value: sum(result.status is status for result in project.licence_assessments.values())
+        for status in LicenceAssessment
+    }
+    accepted = _configured_licence_policy()
+    fail_on = sorted(status.value for status in project.licence_assessor.policy.fail_on)
+    fail_on_incomplete = bool(configuration.get_value(ConfigurationVariable.FAIL_ON_INCOMPLETE_LICENCE_AUDIT))
+    dependency_count = len(project.dependency_documents)
+    policy_result = "PASS"
+    policy_error = None
+    try:
+        project.check_licence_compliance()
+    except Exception as error:
+        policy_result = "FAIL"
+        policy_error = error
+
+    print(f"Dependencies screened: {dependency_count}")
+    print("Accepted third-party licences: " + (", ".join(accepted) if accepted else "<none configured>"))
+    print("Assessment fail-on statuses: " + (", ".join(fail_on) if fail_on else "<disabled>"))
+    print(f"Fail on incomplete licence audit: {'enabled' if fail_on_incomplete else 'disabled'}")
+    print("Dependency licence assessment: " + ", ".join(f"{name}: {count}" for name, count in counts.items()))
+    print(f"Compliance with configured licence policy: {policy_result}")
+    if policy_error:
+        raise policy_error
+
+
+def main() -> int:
+    """Check licence compliance and optionally write third-party IP summaries."""
+    parser = argparse.ArgumentParser(description="Check project and dependency licence compliance.")
+    parser.add_argument(
+        "-o",
+        "--output-dir",
+        type=Path,
+        help="Write third-party IP summaries to this existing directory (no SPDX documents).",
+    )
+    parser.add_argument(
+        "--lookup-scancode",
+        action="store_true",
+        help="Consult ScanCode LicenseDB for unclassified licences or missing assessment rules.",
+    )
+    parser.add_argument("-v", "--verbose", action="count", default=0, help="Increase logging verbosity.")
+    args = parser.parse_args()
+    set_log_level(args.verbose)
+
+    try:
+        plugin = get_language_specifics()
+        if not plugin.can_get_project_metadata():
+            raise ValueError("The selected language plugin cannot provide metadata for licence compliance checks.")
+        project = plugin.get_current_spdx_project()
+        if project is None:
+            raise ValueError("The selected language plugin did not return a project for licence compliance checks.")
+        if args.lookup_scancode:
+            project.enable_scancode_lookup()
+        if args.output_dir is not None:
+            project.generate_licensing_summary(args.output_dir)
+        _print_policy_summary(project)
+        _log_assessment_details(project)
+        if args.lookup_scancode:
+            for name, result in project.licence_assessments.items():
+                for info in result.scancode_licences:
+                    print(f"{name}: ScanCode LicenseDB: {info.identifier} ({info.category}): {info.url}")
+        if args.lookup_scancode:
+            for warning in project.scancode_follow_up_warnings():
+                print(f"WARNING: {warning}", file=sys.stderr)
+        return 0
+    except Exception as error:
+        log_exception(logger, error)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/generate_news.py

@@ -50,7 +50,7 @@ def _generate_changelog(version: Optional[str], use_news_files: bool) -> None:
         logger.info(":: Generating a new changelog")
         project_config_path = configuration.get_value(ConfigurationVariable.PROJECT_CONFIG)
         with cd(os.path.dirname(project_config_path)):
-            subprocess.check_call(["towncrier", "build", "--yes", '--name=""', f'--version="{version}"'])
+            subprocess.check_call(["towncrier", "build", "--yes", "--name", "", "--version", str(version)])
 
 
 def main() -> None:

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/plugins/golang.py

@@ -10,10 +10,11 @@ import json
 import logging
 import os
 import shutil
+from contextlib import contextmanager
 from pathlib import Path
-from subprocess import check_call, check_output
+from subprocess import check_call, check_output, run, CalledProcessError
 from tempfile import TemporaryDirectory
-from typing import Optional, List, Dict, MutableMapping
+from typing import Optional, List, Dict, MutableMapping, Iterator
 
 from continuous_delivery_scripts.spdx_report.spdx_project import SpdxProject
 from continuous_delivery_scripts.utils.configuration import (
@@ -47,6 +48,7 @@ GO_MOD_ON_VALUE = "on"
 # go-licenses report --template receives Name, Version, LicenseURL and LicenseName for each library.
 # https://github.com/google/go-licenses/blob/master/README.md#reports-with-custom-templates
 GO_LICENSES_TEMPLATE = "{{range .}}{{.Name}}\t{{.Version}}\t{{.LicenseURL}}\t{{.LicenseName}}\n{{end}}"
+LICENCE_FILE_PREFIXES = ("LICENSE", "LICENCE", "COPYING")
 
 
 def _generate_doc2go_command_list(output_directory: Path, module: str) -> List[str]:
@@ -156,6 +158,71 @@ def _parse_go_licences(output: str) -> List[PackageMetadata]:
     return packages
 
 
+def _log_go_licenses_stderr(module_dir: Path, stderr_output: str) -> None:
+    """Report go-licenses diagnostics through CDS logging instead of leaking raw stderr."""
+    diagnostics = stderr_output.strip()
+    if not diagnostics:
+        return
+    logger.warning(
+        "go-licenses emitted diagnostics while scanning [%s]. Re-run with -vv for the captured stderr.",
+        module_dir,
+    )
+    logger.info("go-licenses stderr for [%s]:\n%s", module_dir, diagnostics)
+
+
+def _run_go_licenses_report(
+    executable: str, module_dir: Path, template_path: Path, env: MutableMapping[str, str]
+) -> str:
+    """Run go-licenses with captured stderr so CDS controls when diagnostics are shown."""
+    result = run(
+        [executable, "report", "./...", "--template", str(template_path)],
+        cwd=module_dir,
+        env=env,
+        encoding="utf8",
+        capture_output=True,
+        check=False,
+    )
+    _log_go_licenses_stderr(module_dir, result.stderr)
+    if result.returncode != 0:
+        error_message = result.stderr.strip() or result.stdout.strip() or f"exit code {result.returncode}"
+        raise CalledProcessError(result.returncode, result.args, output=result.stdout, stderr=error_message)
+    return result.stdout
+
+
+def _find_licence_file(directory: Path) -> Optional[Path]:
+    """Return the first recognised licence file in a directory."""
+    for path in sorted(directory.iterdir()):
+        if path.is_file() and path.name.upper().startswith(LICENCE_FILE_PREFIXES):
+            return path
+    return None
+
+
+@contextmanager
+def _stage_root_licence_files_for_modules(module_directories: List[Path]) -> Iterator[None]:
+    """Temporarily copy the root licence into module directories that do not already have one."""
+    root_licence_file = _find_licence_file(ROOT_DIR)
+    if not root_licence_file:
+        yield
+        return
+
+    staged_files: List[Path] = []
+    try:
+        for module_directory in module_directories:
+            if module_directory == ROOT_DIR or _find_licence_file(module_directory):
+                continue
+            # go-licenses only searches for licence files up to the module root, so
+            # nested modules cannot see a repository-level LICENSE on their own.
+            destination = module_directory / root_licence_file.name
+            shutil.copy2(root_licence_file, destination)
+            staged_files.append(destination)
+        yield
+    finally:
+        # Remove only the temporary copies we created so existing module-specific
+        # licence files remain untouched and the worktree stays clean.
+        for staged_file in staged_files:
+            staged_file.unlink(missing_ok=True)
+
+
 class GoProjectMetadataFetcher(ProjectMetadataFetcher):
     """Retrieve Go dependency licences for the shared SPDX and compliance report."""
 
@@ -185,29 +252,25 @@ class GoProjectMetadataFetcher(ProjectMetadataFetcher):
         with TemporaryDirectory() as temporary_dir:
             template_path = Path(temporary_dir) / "go-licenses.tpl"
             template_path.write_text(GO_LICENSES_TEMPLATE, encoding="utf8")
-            for module_dir, _ in modules:
-                output = check_output(
-                    [executable, "report", "./...", "--template", str(template_path)],
-                    cwd=module_dir,
-                    env=env,
-                    encoding="utf8",
-                )
-                for package in _parse_go_licences(output):
-                    if any(package.name == name or package.name.startswith(f"{name}/") for _, name in modules):
-                        continue
-                    existing = dependencies.get(package.name)
-                    if existing and (existing.version, existing.licence) != (package.version, package.licence):
-                        candidates = existing.licence_candidates or [existing.licence]
-                        dependencies[package.name] = PackageMetadata.from_fields(
-                            name=package.name,
-                            version=UNKNOWN if existing.version != package.version else package.version,
-                            licence=UNKNOWN,
-                            licence_source=LicenceSource.UNKNOWN,
-                            licence_candidates=sorted(set(candidates + [package.licence])),
-                            licence_evidence=existing.licence_evidence + package.licence_evidence,
-                        )
-                    elif existing is None:
-                        dependencies[package.name] = package
+            with _stage_root_licence_files_for_modules(module_directories):
+                for module_dir, _ in modules:
+                    output = _run_go_licenses_report(executable, module_dir, template_path, env)
+                    for package in _parse_go_licences(output):
+                        if any(package.name == name or package.name.startswith(f"{name}/") for _, name in modules):
+                            continue
+                        existing = dependencies.get(package.name)
+                        if existing and (existing.version, existing.licence) != (package.version, package.licence):
+                            candidates = existing.licence_candidates or [existing.licence]
+                            dependencies[package.name] = PackageMetadata.from_fields(
+                                name=package.name,
+                                version=UNKNOWN if existing.version != package.version else package.version,
+                                licence=UNKNOWN,
+                                licence_source=LicenceSource.UNKNOWN,
+                                licence_candidates=sorted(set(candidates + [package.licence])),
+                                licence_evidence=existing.licence_evidence + package.licence_evidence,
+                            )
+                        elif existing is None:
+                            dependencies[package.name] = package
         for dependency in dependencies.values():
             project.add_dependency_metadata(dependency)
         return project

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/spdx_report/data/licence_assessment.toml

@@ -8,8 +8,8 @@
 schema_version = 1
 
 [settings]
-# Keep existing compliance exit codes unchanged unless a project opts in.
-fail_on = []
+# By default, only explicit DENY assessments fail. Projects may override this.
+fail_on = ["DENY"]
 
 [classifications]
 MIT = "PERMISSIVE"

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/spdx_report/licence_assessment.py

@@ -357,7 +357,19 @@ class LicenceAssessmentPolicy:
         override_path = configuration.get_value_or_default(ConfigurationVariable.LICENCE_ASSESSMENT_RULES_PATH, None)
         override = toml.load(Path(override_path)) if override_path else None
         inline_override = configuration.get_value_or_default(ConfigurationVariable.LICENCE_ASSESSMENT_RULES, None)
-        return cls(default, override, inline_override)
+        policy = cls(default, override, inline_override)
+        fail_on = configuration.get_value_or_default(ConfigurationVariable.LICENCE_ASSESSMENT_FAIL_ON, None)
+        if fail_on is not None:
+            policy._set_fail_on(fail_on, "ProjectConfig.LICENCE_ASSESSMENT_FAIL_ON")
+        return policy
+
+    def _set_fail_on(self, values: Any, source: str) -> None:
+        """Validate the same status list for inline, file and top-level settings."""
+        if not isinstance(values, list) or any(not isinstance(value, str) for value in values):
+            raise ValueError(f"{source}: fail_on must be a list of assessment statuses")
+        self.fail_on = tuple(_require_status(value, f"{source} fail_on") for value in values)
+        if LicenceAssessment.ALLOW in self.fail_on:
+            raise ValueError(f"{source}: ALLOW cannot be a failing assessment status")
 
     def _apply(self, data: dict, source: str) -> None:
         if not isinstance(data, dict) or set(data) - {
@@ -375,12 +387,7 @@ class LicenceAssessmentPolicy:
         if not isinstance(settings, dict) or set(settings) - {"fail_on"}:
             raise ValueError(f"{source}: unknown licence assessment settings")
         if "fail_on" in settings:
-            values = settings["fail_on"]
-            if not isinstance(values, list) or any(not isinstance(value, str) for value in values):
-                raise ValueError(f"{source}: fail_on must be a list of assessment statuses")
-            self.fail_on = tuple(_require_status(value, f"{source} fail_on") for value in values)
-            if LicenceAssessment.ALLOW in self.fail_on:
-                raise ValueError(f"{source}: ALLOW cannot be a failing assessment status")
+            self._set_fail_on(settings["fail_on"], source)
         classifications = data.get("classifications", {})
         if not isinstance(classifications, dict):
             raise ValueError(f"{source}: classifications must be a table")

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/spdx_report/spdx_helpers.py

@@ -95,6 +95,14 @@ def determine_file_licence(path: Path) -> Optional[str]:
             return None
         licence = match.group(1).strip()
         return str(simplify_licence_expression(licence))
+    except UnicodeDecodeError as e:
+        logger.warning(
+            "Could not screen file [%s] for an embedded SPDX licence identifier because it appears to be binary. "
+            "Binary files cannot be screened for inline licence metadata.",
+            path,
+        )
+        logger.info("Binary screening failure for [%s]: %s", path, e)
+        return None
     except Exception as e:
         logger.error(f"Could not determine the licence of file [{path}] from identifier '{licence}'. Reason: {e}.")
         return None

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/spdx_report/spdx_project.py

@@ -83,6 +83,10 @@ class SpdxProject:
             self._licence_assessor = LicenceAssessor(LicenceAssessmentPolicy.from_config(), self._lookup_scancode)
         return self._licence_assessor
 
+    def has_assessment_gate(self) -> bool:
+        """Whether an older rules-file or inline setting opts into gating."""
+        return bool(self.licence_assessor.policy.fail_on)
+
     @property
     def licence_assessments(self) -> Dict[str, LicenceAssessmentResult]:
         """Assess already-discovered dependency licences against the project licence."""

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/tag_and_release.py

@@ -98,12 +98,16 @@ def _update_licensing_summary() -> Optional["SpdxProject"]:
     if not get_language_specifics().can_get_project_metadata():
         return None
 
-    project = get_language_specifics().get_current_spdx_project()
+    project: Optional["SpdxProject"] = get_language_specifics().get_current_spdx_project()
     if project:
         project.generate_licensing_summary(
             Path(configuration.get_value(ConfigurationVariable.DOCUMENTATION_PRODUCTION_OUTPUT_PATH))
         )
-        if configuration.get_value(ConfigurationVariable.FAIL_ON_INCOMPLETE_LICENCE_AUDIT):
+        if (
+            configuration.get_value(ConfigurationVariable.FAIL_ON_INCOMPLETE_LICENCE_AUDIT)
+            or configuration.get_value(ConfigurationVariable.LICENCE_ASSESSMENT_FAIL_ON)
+            or project.has_assessment_gate()
+        ):
             project.check_licence_compliance()
     return project
 

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts/utils/configuration.py

@@ -107,6 +107,8 @@ class ConfigurationVariable(enum.Enum):
     """Optional inline licence assessment rules in the project's pyproject.toml."""
     REVIEWED_LICENCE_ASSESSMENTS = 44
     """Project-specific records explaining manual reviews of REVIEW assessments."""
+    LICENCE_ASSESSMENT_FAIL_ON = 45
+    """Optional top-level list of assessment statuses that fail compliance checks."""
 
     @staticmethod
     def choices() -> List[str]:
@@ -214,6 +216,8 @@ class StaticConfig(GenericConfig):
     TAG_VERSION_SHORTCUTS = False
     SECRETS_BASELINE_FILENAME = ".secrets.baseline"
     FAIL_ON_INCOMPLETE_LICENCE_AUDIT = False
+    LICENCE_ASSESSMENT_FAIL_ON = None
+    """When unset, use fail_on from the embedded or project licence assessment rules."""
     GENERATE_LICENSING_SUMMARY_ON_RELEASE = False
     DEPENDENCY_UPDATE_NEWS_MESSAGE = "Dependency upgrade: {message}"
     DEPENDENCY_UPDATE_NEWS_TYPE = NewsType.bugfix

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2/continuous_delivery_scripts.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: continuous-delivery-scripts
-Version: 4.4.0
+Version: 4.4.2
 Summary: Git-based CI/CD tools for releases, changelogs, SPDX SBOMs and licence reporting
 Home-page: https://github.com/ARMmbed/continuous-delivery-scripts
 Author: Arm
@@ -27,7 +27,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: setuptools
 Requires-Dist: gitpython
-Requires-Dist: towncrier==22.12.0
+Requires-Dist: towncrier==26.9.0
 Requires-Dist: pyautoversion~=1.2.0
 Requires-Dist: pdoc3==0.11.6
 Requires-Dist: toml

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts.egg-info/SOURCES.txt

@@ -73,7 +73,6 @@ continuous_delivery_scripts/utils/python/__init__.py
 continuous_delivery_scripts/utils/python/package_helpers.py
 continuous_delivery_scripts/utils/python/python_helpers.py
 spdx-tmp/GitPython.spdx
-spdx-tmp/Incremental.spdx
 spdx-tmp/Jinja2.spdx
 spdx-tmp/Mako.spdx
 spdx-tmp/Markdown.spdx
@@ -88,7 +87,6 @@ spdx-tmp/bracex.spdx
 spdx-tmp/certifi.spdx
 spdx-tmp/cffi.spdx
 spdx-tmp/charset-normalizer.spdx
-spdx-tmp/click-default-group.spdx
 spdx-tmp/click.spdx
 spdx-tmp/continuous-delivery-scripts.spdx
 spdx-tmp/cryptography.spdx

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/continuous_delivery_scripts.egg-info/requires.txt

@@ -1,6 +1,6 @@
 setuptools
 gitpython
-towncrier==22.12.0
+towncrier==26.9.0
 pyautoversion~=1.2.0
 pdoc3==0.11.6
 toml

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/pyproject.toml

@@ -22,6 +22,7 @@ VERSION_FILE_PATH = "continuous_delivery_scripts/_version.py"
 CHANGELOG_FILE_PATH = "CHANGELOG.md"
 PROGRAMMING_LANGUAGE = "Python"
 GENERATE_LICENSING_SUMMARY_ON_RELEASE = true
+LICENCE_ASSESSMENT_FAIL_ON = ["DENY"]
 TAG_VERSION_SHORTCUTS = true
 TAG_LATEST = true
 
@@ -72,10 +73,8 @@ reason = "Used separately to generate docs; not bundled or modified."
 
 [ProjectConfig.REVIEWED_LICENCE_ASSESSMENTS.certifi]
 licence = "MPL-2.0"
-version = "2025.10.5"
 reason = "Used indirectly for HTTPS; retain its MPL licence and notices."
 
-
 [AutoVersionConfig]
 CONFIG_NAME = "DEFAULT"
 PRERELEASE_TOKEN = "beta"

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/setup.py

@@ -74,7 +74,7 @@ setup(
     install_requires=[
         "setuptools",
         "gitpython",
-        "towncrier==22.12.0",
+        "towncrier==26.9.0",
         "pyautoversion~=1.2.0",
         # FIXME change when https://github.com/pdoc3/pdoc/issues/299 is fixed
         "pdoc3==0.11.6",

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/GitPython.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Sebastian Thiel <byronimo@gmail.com>, Michael Trier <mtrier@gmail.com>)
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/Jinja2.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (unknown)
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/Mako.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Mike Bayer <mike@zzzcomputing.com>)
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/Markdown.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Manfred Stienstra, Yuri Takhteyev (Waylan limberg <python.markdown@gmail.com>)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/MarkupSafe.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (unknown)
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/PyYAML.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Kirill Simonov (xi@resolvent.net)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/Pygments.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Georg Brandl <georg@python.org>)
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/SecretStorage.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Dmitry Shachnev <mitya57@gmail.com>)
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/boolean.py.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Sebastian Kraemer (basti.kr@gmail.com)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/boto3.spdx

@@ -2,9 +2,9 @@
 
 SPDXVersion: SPDX-1.2
 DataLicense: CC0-1.0
-DocumentName: boto3-1.43.106
+DocumentName: boto3-1.43.107
 SPDXID: SPDXRef-DOCUMENT
-DocumentNamespace: http://spdx.org/spdxdocs/boto3-1.43.106-5312fb83-fdd6-b8dc-38af-244f66958ad3
+DocumentNamespace: http://spdx.org/spdxdocs/boto3-1.43.107-dcf81462-50d3-c383-4ac2-18223e312508
 DocumentComment: <text>This document was created automatically using available project and dependency information.</text>
 
 
@@ -12,14 +12,14 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Amazon Web Services (unknown)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package
 
 PackageName: boto3
 SPDXID: SPDXRef-boto3
-PackageVersion: 1.43.106
+PackageVersion: 1.43.107
 PackageDownloadLocation: NONE
 PackageSummary: <text>The AWS SDK for Python (Boto3)</text>
 PackageFileName: boto3

{continuous_delivery_scripts-4.4.0 → continuous_delivery_scripts-4.4.2}/spdx-tmp/botocore.spdx

@@ -2,9 +2,9 @@
 
 SPDXVersion: SPDX-1.2
 DataLicense: CC0-1.0
-DocumentName: botocore-1.43.106
+DocumentName: botocore-1.43.107
 SPDXID: SPDXRef-DOCUMENT
-DocumentNamespace: http://spdx.org/spdxdocs/botocore-1.43.106-10e147fd-3ba0-1292-77d7-1e630c192997
+DocumentNamespace: http://spdx.org/spdxdocs/botocore-1.43.107-2c8cb107-9ef7-266b-af71-33942212a107
 DocumentComment: <text>This document was created automatically using available project and dependency information.</text>
 
 
@@ -12,14 +12,14 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Amazon Web Services (unknown)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-10-01T15:10:20Z
+Created: 2026-10-02T12:56:08Z
 
 
 # Package
 
 PackageName: botocore
 SPDXID: SPDXRef-botocore
-PackageVersion: 1.43.106
+PackageVersion: 1.43.107
 PackageDownloadLocation: NONE
 PackageSummary: <text>Low-level, data-driven core of boto 3.</text>
 PackageFileName: botocore