scanoss 1.19.6__py3-none-any.whl → 1.20.1__py3-none-any.whl

scanoss/components.py

@@ -1,30 +1,31 @@
 """
- SPDX-License-Identifier: MIT
-
-   Copyright (c) 2023, SCANOSS
-
-   Permission is hereby granted, free of charge, to any person obtaining a copy
-   of this software and associated documentation files (the "Software"), to deal
-   in the Software without restriction, including without limitation the rights
-   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-   copies of the Software, and to permit persons to whom the Software is
-   furnished to do so, subject to the following conditions:
-
-   The above copyright notice and this permission notice shall be included in
-   all copies or substantial portions of the Software.
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-   THE SOFTWARE.
+SPDX-License-Identifier: MIT
+
+  Copyright (c) 2023, SCANOSS
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+  THE SOFTWARE.
 """
+
 import json
 import os
 import sys
-from typing import TextIO
+from typing import TextIO, Optional, List
 
 from pypac.parser import PACFile
 
@@ -38,10 +39,19 @@ class Components(ScanossBase):
     Class for Component functionality
     """
 
-    def __init__(self, debug: bool = False, trace: bool = False, quiet: bool = False,
-                 grpc_url: str = None, api_key: str = None, timeout: int = 600,
-                 proxy: str = None, grpc_proxy: str = None, ca_cert: str = None, pac: PACFile = None
-                 ):
+    def __init__(
+        self,
+        debug: bool = False,
+        trace: bool = False,
+        quiet: bool = False,
+        grpc_url: str = None,
+        api_key: str = None,
+        timeout: int = 600,
+        proxy: str = None,
+        grpc_proxy: str = None,
+        ca_cert: str = None,
+        pac: PACFile = None,
+    ):
         """
         Handle all component style requests
 
@@ -58,17 +68,27 @@ class Components(ScanossBase):
         """
         super().__init__(debug, trace, quiet)
         ver_details = Scanner.version_details()
-        self.grpc_api = ScanossGrpc(url=grpc_url, debug=debug, quiet=quiet, trace=trace, api_key=api_key,
-                                    ver_details=ver_details, ca_cert=ca_cert, proxy=proxy, pac=pac,
-                                    grpc_proxy=grpc_proxy, timeout=timeout)
+        self.grpc_api = ScanossGrpc(
+            url=grpc_url,
+            debug=debug,
+            quiet=quiet,
+            trace=trace,
+            api_key=api_key,
+            ver_details=ver_details,
+            ca_cert=ca_cert,
+            proxy=proxy,
+            pac=pac,
+            grpc_proxy=grpc_proxy,
+            timeout=timeout,
+        )
 
-    def load_purls(self, json_file: str = None, purls: [] = None) -> dict:
+    def load_purls(self, json_file: Optional[str] = None, purls: Optional[List[str]] = None) -> Optional[dict]:
         """
         Load the specified purls and return a dictionary
 
         :param json_file: JSON PURL file (optional)
         :param purls: list of PURLs (optional)
-        :return: PURL Request dictionary
+        :return: PURL Request dictionary or None
         """
         if json_file:
             if not os.path.isfile(json_file) or not os.access(json_file, os.R_OK):
@@ -81,6 +101,9 @@ class Components(ScanossBase):
                     self.print_stderr(f'ERROR: Problem parsing input JSON: {e}')
                     return None
         elif purls:
+            if not all(isinstance(purl, str) for purl in purls):
+                self.print_stderr('ERROR: PURLs must be a list of strings.')
+                return None
             parsed_purls = []
             for p in purls:
                 parsed_purls.append({'purl': p})
@@ -219,9 +242,17 @@ class Components(ScanossBase):
         self._close_file(output_file, file)
         return success
 
-    def search_components(self, output_file: str = None, json_file: str = None,
-                          search: str = None, vendor: str = None, comp: str = None, package: str = None,
-                          limit: int = None, offset: int = None) -> bool:
+    def search_components(
+        self,
+        output_file: str = None,
+        json_file: str = None,
+        search: str = None,
+        vendor: str = None,
+        comp: str = None,
+        package: str = None,
+        limit: int = None,
+        offset: int = None,
+    ) -> bool:
         """
         Search for a component based on the given search criteria
 
@@ -242,16 +273,11 @@ class Components(ScanossBase):
             if request is None:
                 return False
         else:  # Construct a query dictionary from parameters
-            request = {
-                "search": search,
-                "vendor": vendor,
-                "component": comp,
-                "package": package
-            }
+            request = {'search': search, 'vendor': vendor, 'component': comp, 'package': package}
             if limit is not None and limit > 0:
-                request["limit"] = limit
+                request['limit'] = limit
             if offset is not None and offset > 0:
-                request["offset"] = offset
+                request['offset'] = offset
 
         file = self._open_file_or_sdtout(output_file)
         if file is None:
@@ -266,8 +292,9 @@ class Components(ScanossBase):
         self._close_file(output_file, file)
         return success
 
-    def get_component_versions(self, output_file: str = None, json_file: str = None,
-                               purl: str = None, limit: int = None) -> bool:
+    def get_component_versions(
+        self, output_file: str = None, json_file: str = None, purl: str = None, limit: int = None
+    ) -> bool:
         """
         Search for a component versions based on the given search criteria
 
@@ -284,11 +311,9 @@ class Components(ScanossBase):
             if request is None:
                 return False
         else:  # Construct a query dictionary from parameters
-            request = {
-                "purl": purl
-            }
+            request = {'purl': purl}
             if limit is not None and limit > 0:
-                request["limit"] = limit
+                request['limit'] = limit
 
         file = self._open_file_or_sdtout(output_file)
         if file is None:
@@ -302,3 +327,29 @@ class Components(ScanossBase):
                 self.print_msg(f'Results written to: {output_file}')
         self._close_file(output_file, file)
         return success
+
+    def get_provenance_details(self, json_file: str = None, purls: [] = None, output_file: str = None) -> bool:
+        """
+        Retrieve the semgrep details for the supplied PURLs
+
+        :param json_file: PURL JSON request file (optional)
+        :param purls: PURL request array (optional)
+        :param output_file: output filename (optional). Default: STDOUT
+        :return: True on success, False otherwise
+        """
+        success = False
+        purls_request = self.load_purls(json_file, purls)
+        if purls_request is None or len(purls_request) == 0:
+            return False
+        file = self._open_file_or_sdtout(output_file)
+        if file is None:
+            return False
+        self.print_msg('Sending PURLs to Provenance API for decoration...')
+        response = self.grpc_api.get_provenance_json(purls_request)
+        if response:
+            print(json.dumps(response, indent=2, sort_keys=True), file=file)
+            success = True
+            if output_file:
+                self.print_msg(f'Results written to: {output_file}')
+        self._close_file(output_file, file)
+        return success

scanoss/csvoutput.py

@@ -1,26 +1,27 @@
 """
- SPDX-License-Identifier: MIT
-
-   Copyright (c) 2022, SCANOSS
-
-   Permission is hereby granted, free of charge, to any person obtaining a copy
-   of this software and associated documentation files (the "Software"), to deal
-   in the Software without restriction, including without limitation the rights
-   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-   copies of the Software, and to permit persons to whom the Software is
-   furnished to do so, subject to the following conditions:
-
-   The above copyright notice and this permission notice shall be included in
-   all copies or substantial portions of the Software.
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-   THE SOFTWARE.
+SPDX-License-Identifier: MIT
+
+  Copyright (c) 2022, SCANOSS
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+  THE SOFTWARE.
 """
+
 import json
 import os.path
 import sys
@@ -59,21 +60,21 @@ class CsvOutput(ScanossBase):
             file_details = data.get(f)
             # print(f'File: {f}: {file_details}')
             for d in file_details:
-                id_details = d.get("id")
+                id_details = d.get('id')
                 if not id_details or id_details == 'none':
                     continue
-                matched = d.get("matched", '')
-                lines = d.get("lines", '').replace(',', ';')  # swap comma with semicolon to help basic parsers
-                oss_lines = d.get("oss_lines", '').replace(',', ';')
+                matched = d.get('matched', '')
+                lines = d.get('lines', '').replace(',', ';')  # swap comma with semicolon to help basic parsers
+                oss_lines = d.get('oss_lines', '').replace(',', ';')
                 detected = {}
                 if id_details == 'dependency':
-                    dependencies = d.get("dependencies")
+                    dependencies = d.get('dependencies')
                     if not dependencies:
                         self.print_stderr(f'Warning: No Dependencies found for {f}: {file_details}')
                         continue
                     for deps in dependencies:
                         detected = {}
-                        purl = deps.get("purl")
+                        purl = deps.get('purl')
                         if not purl:
                             self.print_stderr(f'Warning: No PURL found for {f}: {deps}')
                             continue
@@ -84,7 +85,7 @@ class CsvOutput(ScanossBase):
                         dc = []
                         if licenses:
                             for lic in licenses:
-                                name = lic.get("name")
+                                name = lic.get('name')
                                 if name and name not in dc:  # Only save the license name once
                                     dc.append(name)
                         if not dc or len(dc) == 0:
@@ -92,17 +93,23 @@ class CsvOutput(ScanossBase):
                         else:
                             detected['licenses'] = ';'.join(dc)
                         # inventory_id,path,usage,detected_component,detected_license,detected_version,detected_latest,purl
-                        csv_dict.append({'inventory_id': row_id, 'path': f, 'detected_usage': id_details,
-                                         'detected_component': detected.get('component'),
-                                         'detected_license': detected.get('licenses'),
-                                         'detected_version': detected.get('version'),
-                                         'detected_latest': detected.get('latest'),
-                                         'detected_purls': detected.get('purls'),
-                                         'detected_url': detected.get('url'),
-                                         'detected_path': detected.get('file', ''),
-                                         'detected_match': matched, 'detected_lines': lines,
-                                         'detected_oss_lines': oss_lines
-                                         })
+                        csv_dict.append(
+                            {
+                                'inventory_id': row_id,
+                                'path': f,
+                                'detected_usage': id_details,
+                                'detected_component': detected.get('component'),
+                                'detected_license': detected.get('licenses'),
+                                'detected_version': detected.get('version'),
+                                'detected_latest': detected.get('latest'),
+                                'detected_purls': detected.get('purls'),
+                                'detected_url': detected.get('url'),
+                                'detected_path': detected.get('file', ''),
+                                'detected_match': matched,
+                                'detected_lines': lines,
+                                'detected_oss_lines': oss_lines,
+                            }
+                        )
                         row_id = row_id + 1
                 else:
                     purls = d.get('purl')
@@ -123,25 +130,31 @@ class CsvOutput(ScanossBase):
                     dc = []
                     if licenses:
                         for lic in licenses:
-                            name = lic.get("name")
+                            name = lic.get('name')
                             if name and name not in dc:  # Only save the license name once
-                                dc.append(lic.get("name"))
+                                dc.append(lic.get('name'))
                     if not dc or len(dc) == 0:
                         detected['licenses'] = ''
                     else:
                         detected['licenses'] = ';'.join(dc)
                     # inventory_id,path,usage,detected_component,detected_license,detected_version,detected_latest,purl
-                    csv_dict.append({'inventory_id': row_id, 'path': f, 'detected_usage': id_details,
-                                     'detected_component': detected.get('component'),
-                                     'detected_license': detected.get('licenses'),
-                                     'detected_version': detected.get('version'),
-                                     'detected_latest': detected.get('latest'),
-                                     'detected_purls': detected.get('purls'),
-                                     'detected_url': detected.get('url'),
-                                     'detected_path': detected.get('file', ''),
-                                     'detected_match': matched, 'detected_lines': lines,
-                                     'detected_oss_lines': oss_lines
-                                     })
+                    csv_dict.append(
+                        {
+                            'inventory_id': row_id,
+                            'path': f,
+                            'detected_usage': id_details,
+                            'detected_component': detected.get('component'),
+                            'detected_license': detected.get('licenses'),
+                            'detected_version': detected.get('version'),
+                            'detected_latest': detected.get('latest'),
+                            'detected_purls': detected.get('purls'),
+                            'detected_url': detected.get('url'),
+                            'detected_path': detected.get('file', ''),
+                            'detected_match': matched,
+                            'detected_lines': lines,
+                            'detected_oss_lines': oss_lines,
+                        }
+                    )
                     row_id = row_id + 1
         return csv_dict
 
@@ -174,16 +187,28 @@ class CsvOutput(ScanossBase):
             self.print_stderr('ERROR: No CSV data returned for the JSON string provided.')
             return False
         # Header row/column details
-        fields = ['inventory_id', 'path', 'detected_usage', 'detected_component', 'detected_license',
-                  'detected_version', 'detected_latest', 'detected_purls', 'detected_url', 'detected_match',
-                  'detected_lines', 'detected_oss_lines', 'detected_path']
+        fields = [
+            'inventory_id',
+            'path',
+            'detected_usage',
+            'detected_component',
+            'detected_license',
+            'detected_version',
+            'detected_latest',
+            'detected_purls',
+            'detected_url',
+            'detected_match',
+            'detected_lines',
+            'detected_oss_lines',
+            'detected_path',
+        ]
         file = sys.stdout
         if not output_file and self.output_file:
             output_file = self.output_file
         if output_file:
             file = open(output_file, 'w')
         writer = csv.DictWriter(file, fieldnames=fields)
-        writer.writeheader()        # writing headers (field names)
+        writer.writeheader()  # writing headers (field names)
         writer.writerows(csv_data)  # writing data rows
         if output_file:
             file.close()
@@ -206,6 +231,8 @@ class CsvOutput(ScanossBase):
             self.print_stderr(f'ERROR: Problem parsing input JSON: {e}')
             return False
         return self.produce_from_json(data, output_file)
+
+
 #
 # End of CsvOutput Class
 #

scanoss/cyclonedx.py

@@ -1,26 +1,27 @@
 """
- SPDX-License-Identifier: MIT
+SPDX-License-Identifier: MIT
 
-   Copyright (c) 2021, SCANOSS
+  Copyright (c) 2021, SCANOSS
 
-   Permission is hereby granted, free of charge, to any person obtaining a copy
-   of this software and associated documentation files (the "Software"), to deal
-   in the Software without restriction, including without limitation the rights
-   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-   copies of the Software, and to permit persons to whom the Software is
-   furnished to do so, subject to the following conditions:
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
 
-   The above copyright notice and this permission notice shall be included in
-   all copies or substantial portions of the Software.
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
 
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-   THE SOFTWARE.
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+  THE SOFTWARE.
 """
+
 import json
 import os.path
 import sys
@@ -64,17 +65,17 @@ class CycloneDx(ScanossBase):
             file_details = data.get(f)
             # print(f'File: {f}: {file_details}')
             for d in file_details:
-                id_details = d.get("id")
+                id_details = d.get('id')
                 if not id_details or id_details == 'none':
                     continue
                 purl = None
                 if id_details == 'dependency':
-                    dependencies = d.get("dependencies")
+                    dependencies = d.get('dependencies')
                     if not dependencies:
                         self.print_stderr(f'Warning: No Dependencies found for {f}: {file_details}')
                         continue
                     for deps in dependencies:
-                        purl = deps.get("purl")
+                        purl = deps.get('purl')
                         if not purl:
                             self.print_stderr(f'Warning: No PURL found for {f}: {deps}')
                             continue
@@ -89,7 +90,7 @@ class CycloneDx(ScanossBase):
                         if licenses:
                             dc = []
                             for lic in licenses:
-                                name = lic.get("name")
+                                name = lic.get('name')
                                 if name not in dc:  # Only save the license name once
                                     fdl.append({'id': name})
                                     dc.append(name)
@@ -108,30 +109,33 @@ class CycloneDx(ScanossBase):
                         self.print_stderr(f'Warning: No PURL found for {f}: {file_details}')
                         continue
                     fd = {}
-                    vulnerabilities = d.get("vulnerabilities")
+                    vulnerabilities = d.get('vulnerabilities')
                     if vulnerabilities:
                         for vuln in vulnerabilities:
-                            vuln_id = vuln.get("ID")
+                            vuln_id = vuln.get('ID')
                             if vuln_id == '':
-                                vuln_id = vuln.get("id")
+                                vuln_id = vuln.get('id')
                             if not vuln_id or vuln_id == '':  # Skip empty ids
                                 continue
-                            vuln_cve = vuln.get("CVE", '')
+                            vuln_cve = vuln.get('CVE', '')
                             if vuln_cve == '':
-                                vuln_cve = vuln.get("cve", '')
-                            if vuln_id.upper().startswith("CPE:"):
-                                fd['cpe'] = vuln_id                 # Save the component CPE if we have one
+                                vuln_cve = vuln.get('cve', '')
+                            if vuln_id.upper().startswith('CPE:'):
+                                fd['cpe'] = vuln_id  # Save the component CPE if we have one
                                 if vuln_cve != '':
                                     vuln_id = vuln_cve
                             vd = vdx.get(vuln_id)  # Check if we've already encountered this vulnerability
                             if not vd:
                                 vuln_source = vuln.get('source', '').lower()
-                                vd = {'cve': vuln_cve,
-                                      'source': 'NVD' if vuln_source == 'nvd' else 'GitHub Advisories',
-                                      'url': f'https://nvd.nist.gov/vuln/detail/{vuln_cve}' if vuln_source == 'nvd' else f'https://github.com/advisories/{vuln_id}',
-                                      'severity': self._sev_lookup(vuln.get('severity', 'unknown').lower()),
-                                      'affects': set()
-                                      }
+                                vd = {
+                                    'cve': vuln_cve,
+                                    'source': 'NVD' if vuln_source == 'nvd' else 'GitHub Advisories',
+                                    'url': f'https://nvd.nist.gov/vuln/detail/{vuln_cve}'
+                                    if vuln_source == 'nvd'
+                                    else f'https://github.com/advisories/{vuln_id}',
+                                    'severity': self._sev_lookup(vuln.get('severity', 'unknown').lower()),
+                                    'affects': set(),
+                                }
                             vd.get('affects').add(purl)
                             vdx[vuln_id] = vd
                     if cdx.get(purl):
@@ -143,7 +147,7 @@ class CycloneDx(ScanossBase):
                     fdl = []
                     if licenses:
                         for lic in licenses:
-                            fdl.append({'id': lic.get("name")})
+                            fdl.append({'id': lic.get('name')})
                     fd['licenses'] = fdl
                     cdx[purl] = fd
         # self.print_stderr(f'VD: {vdx}')
@@ -190,7 +194,7 @@ class CycloneDx(ScanossBase):
             'serialNumber': f'urn:uuid:{uuid.uuid4()}',
             'version': 1,
             'metadata': {
-                'timestamp': datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+                'timestamp': datetime.datetime.now(datetime.timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'),
                 'tools': [
                     {
                         'vendor': 'SCANOSS',
@@ -198,14 +202,10 @@ class CycloneDx(ScanossBase):
                         'version': __version__,
                     }
                 ],
-                'component': {
-                    'type': 'application',
-                    'name': 'NOASSERTION',
-                    'version': 'NOASSERTION'
-                }
+                'component': {'type': 'application', 'name': 'NOASSERTION', 'version': 'NOASSERTION'},
             },
             'components': [],
-            'vulnerabilities': []
+            'vulnerabilities': [],
         }
         for purl in cdx:
             comp = cdx.get(purl)
@@ -230,7 +230,7 @@ class CycloneDx(ScanossBase):
                 'version': comp.get('version'),
                 'purl': purl,
                 'bom-ref': purl,
-                'licenses': lic_text
+                'licenses': lic_text,
             }
             cpe = comp.get('cpe', '')
             if cpe and cpe != '':
@@ -250,7 +250,7 @@ class CycloneDx(ScanossBase):
                     'id': vuln_id,
                     'source': {'name': v_source, 'url': vulns.get('url')},
                     'ratings': [{'severity': vulns.get('severity', 'unknown')}],
-                    'affects': affects
+                    'affects': affects,
                 }
                 data['vulnerabilities'].append(vd)
             # End for loop
@@ -298,8 +298,10 @@ class CycloneDx(ScanossBase):
             'low': 'low',
             'info': 'info',
             'none': 'none',
-            'unknown': 'unknown'
-            }.get(value, 'unknown')
+            'unknown': 'unknown',
+        }.get(value, 'unknown')
+
+
 #
 # End of CycloneDX Class
 #

scanoss/data/build_date.txt

@@ -1 +1 @@
-date: 20250130190618, utime: 1738263978
+date: 20250219134430, utime: 1739972670