csspin-python 6.0.0__py3-none-any.whl → 6.0.1__py3-none-any.whl

csspin_python/python_sbom.py

@@ -42,12 +42,14 @@ from csspin import (
 from csspin.tree import ConfigTree
 from packaging.requirements import Requirement
 from packaging.utils import canonicalize_name
+from packaging.version import Version
 from path import Path
 
 defaults = config(
-    cyclonedx_bom_version="7.3.0",
+    cyclonedx_bom_version="7.5.0",
     project_paths=["{spin.project_root}"],
     repository_url="{python.index_url}",
+    spec_version="1.7",
     requires=config(spin=["csspin_python.python"], python=["setuptools"]),
 )
 
@@ -90,6 +92,7 @@ def sbom(cfg: ConfigTree) -> None:
             cfg.python_sbom.repository_url,
             file_name,
         )
+        _mark_components_external(sbom_json)
         _write_sbom(cfg, sbom_json, project_name)
 
 
@@ -161,7 +164,19 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
     with TemporaryDirectory() as tmp_dir:
         venv = Path(tmp_dir) / "venv"
         interpreter = venv / binary_dir / "python" + cfg.platform.exe
-        sh(cfg.python.interpreter, "-m", "venv", venv, use_subprocess_environment=False)
+        # Run --upgrade-deps and set PIP_CONSTRAINT to force pip and setuptools
+        # to have the version from the constraint files, if they are present.
+        # Necessary as python3.11 still has setuptools in the env created by
+        # venv.
+        sh(
+            cfg.python.interpreter,
+            "-m",
+            "venv",
+            "--upgrade-deps",
+            venv,
+            use_subprocess_environment=False,
+            env={"PIP_CONSTRAINT": " ".join(cfg.python.constraints)},
+        )
         if third_party_deps:
             sh(
                 interpreter,
@@ -195,6 +210,8 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
             "-m",
             "cyclonedx_py",
             "environment",
+            "--spec-version",
+            cfg.python_sbom.spec_version,
             venv,
             use_subprocess_environment=False,
             stderr=stderr,
@@ -364,6 +381,16 @@ def _enrich_sbom(
     sbom_json["dependencies"] = dependencies
 
 
+def _mark_components_external(sbom_json: dict) -> None:
+    """
+    Flag the third-party components as external, for CycloneDX 1.7 and newer.
+    """
+    if Version(sbom_json["specVersion"]) < Version("1.7"):
+        return
+    for component in sbom_json.get("components", []):
+        component["isExternal"] = True
+
+
 def _collect_thirdparty_deps(requires_dist: list, python_version: str) -> set[str]:
     """Extract 'thirdparty' dependency specifiers from project metadata."""
 

csspin_python/python_sbom_schema.yaml

@@ -21,3 +21,6 @@ python_sbom:
             help: |
                 URL of the package index used for the primary component's
                 Package URL. Defaults to 'python.index_url'.
+        spec_version:
+            type: str
+            help: CycloneDX specification version of the generated SBOM.

{csspin_python-6.0.0.dist-info → csspin_python-6.0.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csspin-python
-Version: 6.0.0
+Version: 6.0.1
 Summary: Plugin-package for csspin providing Python related plugins
 Author-email: CONTACT Software GmbH <info@contact-software.com>
 Maintainer-email: Waleri Enns <waleri.enns@contact-software.com>, Benjamin Thomas Schwertfeger <benjaminthomas.schwertfeger@contact-software.com>, Fabian Hafer <fabian.hafer@contact-software.com>

{csspin_python-6.0.0.dist-info → csspin_python-6.0.1.dist-info}/RECORD

@@ -10,15 +10,15 @@ csspin_python/playwright_schema.yaml,sha256=TSeR16YHa7m7bfO59F2eMV-jXcglluTJdEpU
 csspin_python/pytest.py,sha256=vSLtmS-kNO0NPo_tszfEm5zGwJb6Yb5IGS-hA7CNguo,4544
 csspin_python/pytest_schema.yaml,sha256=tzXtdF6MvGC9v59EVRJFfLeMMHqPsXcFXy2zJtRECBI,1535
 csspin_python/python.py,sha256=uoWCm_X2_yGaOdnxAb_h2Mr8RjLd5MjuVL4cPF15E2E,41973
-csspin_python/python_sbom.py,sha256=AT_dFEKoghZTVkkTECz0cOo-w3AZAYAgROx4prhAHKw,13603
-csspin_python/python_sbom_schema.yaml,sha256=QysysjGJ6n1WEoLBqYHcdbojuEomUvL8QG4ZSWQW2_8,739
+csspin_python/python_sbom.py,sha256=l80mNwrIe3uK0F_3nnob_tY9EVunsWhrOlQHhYAMt3U,14523
+csspin_python/python_sbom_schema.yaml,sha256=kxz5TJdUmUkDwG6ZD9ORi7xj-yF_BjeMhjmsj6labgM,856
 csspin_python/python_schema.yaml,sha256=RwJgbyIRenj18-s60HmqkwWCGtd6G1acpJ9TDI9QjBQ,6448
 csspin_python/radon.py,sha256=uFqm6FEi5oWj-_XVaAm3s9cam0cUmr1_FwRf40K6xWs,1876
 csspin_python/radon_schema.yaml,sha256=rlRzXw5z4XbjOVznRiUxWGP4E9hx1Jm-gGw1iQiYzE0,548
 csspin_python/uv_provisioner.py,sha256=2M1I8PqWTCUxqaOeJI5rchmly6t-MnOPQfIx-kKzdQU,6757
 csspin_python/uv_provisioner_schema.yaml,sha256=Y8ZNC2OMnhR8Us3WUXAXK9hMjqGWAKFJB2puX4X5XNQ,727
-csspin_python-6.0.0.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
-csspin_python-6.0.0.dist-info/METADATA,sha256=a-NIDfoER1W6_3YNyaxS_RKPKLXmWp6tk-uApcS6Lr4,5254
-csspin_python-6.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-csspin_python-6.0.0.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
-csspin_python-6.0.0.dist-info/RECORD,,
+csspin_python-6.0.1.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
+csspin_python-6.0.1.dist-info/METADATA,sha256=AHEvlyahGD-q_aY2O8HE7A35QGVDtM8LOKrdfKyz1mk,5254
+csspin_python-6.0.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+csspin_python-6.0.1.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
+csspin_python-6.0.1.dist-info/RECORD,,