uv-sbom-bin 1.0.0__tar.gz → 1.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. uv_sbom_bin-1.1.0/PKG-INFO +194 -0
  2. uv_sbom_bin-1.1.0/README.md +168 -0
  3. {uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/pyproject.toml +1 -1
  4. {uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/uv_sbom_bin/install.py +1 -1
  5. uv_sbom_bin-1.0.0/PKG-INFO +0 -73
  6. uv_sbom_bin-1.0.0/README.md +0 -47
  7. {uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/.gitignore +0 -0
  8. {uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/uv_sbom_bin/__init__.py +0 -0
  9. {uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/uv_sbom_bin/__main__.py +0 -0
uv_sbom_bin-1.1.0/PKG-INFO ADDED
@@ -0,0 +1,194 @@
1
+ Metadata-Version: 2.4
2
+ Name: uv-sbom-bin
3
+ Version: 1.1.0
4
+ Summary: Python wrapper for uv-sbom - SBOM generation tool for uv projects
5
+ Project-URL: Homepage, https://github.com/Taketo-Yoda/uv-sbom
6
+ Project-URL: Repository, https://github.com/Taketo-Yoda/uv-sbom
7
+ Project-URL: Bug Tracker, https://github.com/Taketo-Yoda/uv-sbom/issues
8
+ Author-email: Taketo Yoda <exhaust7.drs@gmail.com>
9
+ License: MIT
10
+ Keywords: cyclonedx,python-wrapper,sbom,security,supply-chain,uv
11
+ Classifier: Development Status :: 5 - Production/Stable
12
+ Classifier: Intended Audience :: Developers
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Programming Language :: Python :: 3.8
17
+ Classifier: Programming Language :: Python :: 3.9
18
+ Classifier: Programming Language :: Python :: 3.10
19
+ Classifier: Programming Language :: Python :: 3.11
20
+ Classifier: Programming Language :: Python :: 3.12
21
+ Classifier: Topic :: Security
22
+ Classifier: Topic :: Software Development :: Build Tools
23
+ Classifier: Topic :: System :: Software Distribution
24
+ Requires-Python: >=3.8
25
+ Description-Content-Type: text/markdown
26
+
27
+ # uv-sbom-bin
28
+
29
+ [![PyPI - Version](https://img.shields.io/pypi/v/uv-sbom-bin?logo=python&logoColor=white)](https://pypi.org/project/uv-sbom-bin/)
30
+ [![PyPI - Downloads](https://img.shields.io/pypi/dm/uv-sbom-bin?logo=pypi&logoColor=white)](https://pypi.org/project/uv-sbom-bin/)
31
+ [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/Taketo-Yoda/uv-sbom/blob/main/LICENSE)
32
+ [![CI](https://github.com/Taketo-Yoda/uv-sbom/actions/workflows/ci.yml/badge.svg)](https://github.com/Taketo-Yoda/uv-sbom/actions/workflows/ci.yml)
33
+
34
+ Python wrapper for the `uv-sbom` CLI tool written in Rust.
35
+
36
+ Generate SBOMs (Software Bill of Materials) for Python projects managed by [uv](https://github.com/astral-sh/uv).
37
+
38
+ ## Features
39
+
40
+ - **Fast and standalone** - Written in Rust, no Python dependencies required at runtime
41
+ - **Multiple output formats** - CycloneDX 1.6 JSON (standard) and Markdown (human-readable)
42
+ - **Vulnerability scanning** - Check for known CVEs using OSV API with `--check-cve`
43
+ - **Configurable thresholds** - Filter vulnerabilities by severity or CVSS score
44
+ - **Package exclusion** - Exclude internal packages with `--exclude` patterns
45
+ - **Configuration file support** - Define defaults in `uv-sbom.config.yml`
46
+ - **CI/CD ready** - Exit codes for easy integration into pipelines
47
+ - **License detection** - Automatically fetches license info from PyPI
48
+
49
+ ## Why uv-sbom?
50
+
51
+ Unlike other SBOM tools that scan the entire virtual environment, `uv-sbom` focuses on **production runtime dependencies** from `uv.lock`:
52
+
53
+ | Aspect | uv-sbom | CycloneDX Official Tools |
54
+ |--------|---------|--------------------------|
55
+ | **Data Source** | `uv.lock` file | `.venv` virtual environment |
56
+ | **Scope** | Production dependencies only | Entire supply chain |
57
+ | **Package Count** | Fewer (e.g., 16 packages) | More (e.g., 38+ packages) |
58
+ | **Use Case** | Production security scanning | Comprehensive audit |
59
+
60
+ This focused approach reduces noise in security scanning by excluding build-time dependencies that don't ship with your application.
61
+
62
+ ## Installation
63
+
64
+ ### Via uv (Recommended)
65
+
66
+ ```bash
67
+ uv tool install uv-sbom-bin
68
+ ```
69
+
70
+ ### Via pip
71
+
72
+ ```bash
73
+ pip install uv-sbom-bin
74
+ ```
75
+
76
+ After installation, the `uv-sbom` command will be available in your PATH.
77
+
78
+ > **Note**: The package name is `uv-sbom-bin`, but the installed command is `uv-sbom`.
79
+
80
+ ## Usage
81
+
82
+ ### Basic Commands
83
+
84
+ ```bash
85
+ # Show version
86
+ uv-sbom --version
87
+
88
+ # Generate CycloneDX JSON SBOM (default)
89
+ uv-sbom --format json
90
+
91
+ # Generate Markdown SBOM
92
+ uv-sbom --format markdown --output SBOM.md
93
+ ```
94
+
95
+ ### Vulnerability Checking
96
+
97
+ ```bash
98
+ # Check for all vulnerabilities
99
+ uv-sbom --format markdown --check-cve
100
+
101
+ # Check for High/Critical severity only
102
+ uv-sbom --format markdown --check-cve --severity-threshold high
103
+
104
+ # Check for CVSS >= 7.0
105
+ uv-sbom --format markdown --check-cve --cvss-threshold 7.0
106
+
107
+ # Ignore specific CVEs
108
+ uv-sbom --format markdown --check-cve --ignore-cve CVE-2024-1234
109
+ ```
110
+
111
+ ### Excluding Packages
112
+
113
+ ```bash
114
+ # Exclude specific packages
115
+ uv-sbom -e "pytest" -e "mypy"
116
+
117
+ # Exclude with wildcards
118
+ uv-sbom -e "*-dev" -e "debug-*"
119
+ ```
120
+
121
+ ### Configuration File
122
+
123
+ Create a `uv-sbom.config.yml` file in your project directory:
124
+
125
+ ```yaml
126
+ format: markdown
127
+ check_cve: true
128
+ severity_threshold: high
129
+ exclude_packages:
130
+ - "pytest"
131
+ - "*-dev"
132
+ ignore_cves:
133
+ - id: CVE-2024-1234
134
+ reason: "False positive for our use case"
135
+ ```
136
+
137
+ Generate a template:
138
+
139
+ ```bash
140
+ uv-sbom --init
141
+ ```
142
+
143
+ ### CI Integration
144
+
145
+ ```yaml
146
+ # GitHub Actions example
147
+ - name: Security Check
148
+ run: uv-sbom --format markdown --check-cve --severity-threshold high
149
+ ```
150
+
151
+ ## Output Example
152
+
153
+ Markdown format with vulnerability report:
154
+
155
+ ```markdown
156
+ # Software Bill of Materials (SBOM)
157
+
158
+ ## Component Inventory
159
+
160
+ | Package | Version | License | Description |
161
+ |---------|---------|---------|-------------|
162
+ | requests | 2.31.0 | Apache 2.0 | HTTP library for Python |
163
+ | pydantic | 2.12.5 | MIT | Data validation using Python type hints |
164
+
165
+ ## Vulnerability Report
166
+
167
+ | Package | Current | Fixed | CVSS | Severity | CVE ID |
168
+ |---------|---------|-------|------|----------|--------|
169
+ | urllib3 | 2.0.0 | 2.0.7 | 9.8 | CRITICAL | CVE-2023-45803 |
170
+ ```
171
+
172
+ ## How It Works
173
+
174
+ This package downloads the prebuilt Rust binary for your platform from the [GitHub releases](https://github.com/Taketo-Yoda/uv-sbom/releases) and installs it.
175
+
176
+ **Supported platforms:**
177
+ - macOS (Apple Silicon and Intel)
178
+ - Linux (x86_64)
179
+ - Windows (x86_64)
180
+
181
+ ## Full Documentation
182
+
183
+ For comprehensive documentation including:
184
+ - Complete command-line reference
185
+ - Security input validation details
186
+ - Network requirements and proxy configuration
187
+ - Exit codes and error handling
188
+ - Troubleshooting guide
189
+
190
+ Visit the main repository: **[uv-sbom on GitHub](https://github.com/Taketo-Yoda/uv-sbom)**
191
+
192
+ ## License
193
+
194
+ MIT License - see [LICENSE](https://github.com/Taketo-Yoda/uv-sbom/blob/main/LICENSE)
uv_sbom_bin-1.1.0/README.md ADDED
@@ -0,0 +1,168 @@
1
+ # uv-sbom-bin
2
+
3
+ [![PyPI - Version](https://img.shields.io/pypi/v/uv-sbom-bin?logo=python&logoColor=white)](https://pypi.org/project/uv-sbom-bin/)
4
+ [![PyPI - Downloads](https://img.shields.io/pypi/dm/uv-sbom-bin?logo=pypi&logoColor=white)](https://pypi.org/project/uv-sbom-bin/)
5
+ [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/Taketo-Yoda/uv-sbom/blob/main/LICENSE)
6
+ [![CI](https://github.com/Taketo-Yoda/uv-sbom/actions/workflows/ci.yml/badge.svg)](https://github.com/Taketo-Yoda/uv-sbom/actions/workflows/ci.yml)
7
+
8
+ Python wrapper for the `uv-sbom` CLI tool written in Rust.
9
+
10
+ Generate SBOMs (Software Bill of Materials) for Python projects managed by [uv](https://github.com/astral-sh/uv).
11
+
12
+ ## Features
13
+
14
+ - **Fast and standalone** - Written in Rust, no Python dependencies required at runtime
15
+ - **Multiple output formats** - CycloneDX 1.6 JSON (standard) and Markdown (human-readable)
16
+ - **Vulnerability scanning** - Check for known CVEs using OSV API with `--check-cve`
17
+ - **Configurable thresholds** - Filter vulnerabilities by severity or CVSS score
18
+ - **Package exclusion** - Exclude internal packages with `--exclude` patterns
19
+ - **Configuration file support** - Define defaults in `uv-sbom.config.yml`
20
+ - **CI/CD ready** - Exit codes for easy integration into pipelines
21
+ - **License detection** - Automatically fetches license info from PyPI
22
+
23
+ ## Why uv-sbom?
24
+
25
+ Unlike other SBOM tools that scan the entire virtual environment, `uv-sbom` focuses on **production runtime dependencies** from `uv.lock`:
26
+
27
+ | Aspect | uv-sbom | CycloneDX Official Tools |
28
+ |--------|---------|--------------------------|
29
+ | **Data Source** | `uv.lock` file | `.venv` virtual environment |
30
+ | **Scope** | Production dependencies only | Entire supply chain |
31
+ | **Package Count** | Fewer (e.g., 16 packages) | More (e.g., 38+ packages) |
32
+ | **Use Case** | Production security scanning | Comprehensive audit |
33
+
34
+ This focused approach reduces noise in security scanning by excluding build-time dependencies that don't ship with your application.
35
+
36
+ ## Installation
37
+
38
+ ### Via uv (Recommended)
39
+
40
+ ```bash
41
+ uv tool install uv-sbom-bin
42
+ ```
43
+
44
+ ### Via pip
45
+
46
+ ```bash
47
+ pip install uv-sbom-bin
48
+ ```
49
+
50
+ After installation, the `uv-sbom` command will be available in your PATH.
51
+
52
+ > **Note**: The package name is `uv-sbom-bin`, but the installed command is `uv-sbom`.
53
+
54
+ ## Usage
55
+
56
+ ### Basic Commands
57
+
58
+ ```bash
59
+ # Show version
60
+ uv-sbom --version
61
+
62
+ # Generate CycloneDX JSON SBOM (default)
63
+ uv-sbom --format json
64
+
65
+ # Generate Markdown SBOM
66
+ uv-sbom --format markdown --output SBOM.md
67
+ ```
68
+
69
+ ### Vulnerability Checking
70
+
71
+ ```bash
72
+ # Check for all vulnerabilities
73
+ uv-sbom --format markdown --check-cve
74
+
75
+ # Check for High/Critical severity only
76
+ uv-sbom --format markdown --check-cve --severity-threshold high
77
+
78
+ # Check for CVSS >= 7.0
79
+ uv-sbom --format markdown --check-cve --cvss-threshold 7.0
80
+
81
+ # Ignore specific CVEs
82
+ uv-sbom --format markdown --check-cve --ignore-cve CVE-2024-1234
83
+ ```
84
+
85
+ ### Excluding Packages
86
+
87
+ ```bash
88
+ # Exclude specific packages
89
+ uv-sbom -e "pytest" -e "mypy"
90
+
91
+ # Exclude with wildcards
92
+ uv-sbom -e "*-dev" -e "debug-*"
93
+ ```
94
+
95
+ ### Configuration File
96
+
97
+ Create a `uv-sbom.config.yml` file in your project directory:
98
+
99
+ ```yaml
100
+ format: markdown
101
+ check_cve: true
102
+ severity_threshold: high
103
+ exclude_packages:
104
+ - "pytest"
105
+ - "*-dev"
106
+ ignore_cves:
107
+ - id: CVE-2024-1234
108
+ reason: "False positive for our use case"
109
+ ```
110
+
111
+ Generate a template:
112
+
113
+ ```bash
114
+ uv-sbom --init
115
+ ```
116
+
117
+ ### CI Integration
118
+
119
+ ```yaml
120
+ # GitHub Actions example
121
+ - name: Security Check
122
+ run: uv-sbom --format markdown --check-cve --severity-threshold high
123
+ ```
124
+
125
+ ## Output Example
126
+
127
+ Markdown format with vulnerability report:
128
+
129
+ ```markdown
130
+ # Software Bill of Materials (SBOM)
131
+
132
+ ## Component Inventory
133
+
134
+ | Package | Version | License | Description |
135
+ |---------|---------|---------|-------------|
136
+ | requests | 2.31.0 | Apache 2.0 | HTTP library for Python |
137
+ | pydantic | 2.12.5 | MIT | Data validation using Python type hints |
138
+
139
+ ## Vulnerability Report
140
+
141
+ | Package | Current | Fixed | CVSS | Severity | CVE ID |
142
+ |---------|---------|-------|------|----------|--------|
143
+ | urllib3 | 2.0.0 | 2.0.7 | 9.8 | CRITICAL | CVE-2023-45803 |
144
+ ```
145
+
146
+ ## How It Works
147
+
148
+ This package downloads the prebuilt Rust binary for your platform from the [GitHub releases](https://github.com/Taketo-Yoda/uv-sbom/releases) and installs it.
149
+
150
+ **Supported platforms:**
151
+ - macOS (Apple Silicon and Intel)
152
+ - Linux (x86_64)
153
+ - Windows (x86_64)
154
+
155
+ ## Full Documentation
156
+
157
+ For comprehensive documentation including:
158
+ - Complete command-line reference
159
+ - Security input validation details
160
+ - Network requirements and proxy configuration
161
+ - Exit codes and error handling
162
+ - Troubleshooting guide
163
+
164
+ Visit the main repository: **[uv-sbom on GitHub](https://github.com/Taketo-Yoda/uv-sbom)**
165
+
166
+ ## License
167
+
168
+ MIT License - see [LICENSE](https://github.com/Taketo-Yoda/uv-sbom/blob/main/LICENSE)
{uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/pyproject.toml RENAMED
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
4
4
 
5
5
  [project]
6
6
  name = "uv-sbom-bin"
7
- version = "1.0.0"
7
+ version = "1.1.0"
8
8
  description = "Python wrapper for uv-sbom - SBOM generation tool for uv projects"
9
9
  readme = "README.md"
10
10
  license = { text = "MIT" }
{uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/uv_sbom_bin/install.py RENAMED
@@ -9,7 +9,7 @@ from pathlib import Path
9
9
  from urllib.request import urlretrieve
10
10
 
11
11
  # Version of uv-sbom to install
12
- UV_SBOM_VERSION = "1.0.0"
12
+ UV_SBOM_VERSION = "1.1.0"
13
13
 
14
14
  # GitHub release URL template
15
15
  RELEASE_URL_TEMPLATE = (
uv_sbom_bin-1.0.0/PKG-INFO DELETED
@@ -1,73 +0,0 @@
1
- Metadata-Version: 2.4
2
- Name: uv-sbom-bin
3
- Version: 1.0.0
4
- Summary: Python wrapper for uv-sbom - SBOM generation tool for uv projects
5
- Project-URL: Homepage, https://github.com/Taketo-Yoda/uv-sbom
6
- Project-URL: Repository, https://github.com/Taketo-Yoda/uv-sbom
7
- Project-URL: Bug Tracker, https://github.com/Taketo-Yoda/uv-sbom/issues
8
- Author-email: Taketo Yoda <exhaust7.drs@gmail.com>
9
- License: MIT
10
- Keywords: cyclonedx,python-wrapper,sbom,security,supply-chain,uv
11
- Classifier: Development Status :: 5 - Production/Stable
12
- Classifier: Intended Audience :: Developers
13
- Classifier: License :: OSI Approved :: MIT License
14
- Classifier: Operating System :: OS Independent
15
- Classifier: Programming Language :: Python :: 3
16
- Classifier: Programming Language :: Python :: 3.8
17
- Classifier: Programming Language :: Python :: 3.9
18
- Classifier: Programming Language :: Python :: 3.10
19
- Classifier: Programming Language :: Python :: 3.11
20
- Classifier: Programming Language :: Python :: 3.12
21
- Classifier: Topic :: Security
22
- Classifier: Topic :: Software Development :: Build Tools
23
- Classifier: Topic :: System :: Software Distribution
24
- Requires-Python: >=3.8
25
- Description-Content-Type: text/markdown
26
-
27
- # uv-sbom-bin
28
-
29
- Python wrapper for the `uv-sbom` CLI tool written in Rust.
30
-
31
- This package allows Python users to install `uv-sbom` via PyPI and use it with `uv tool install`.
32
-
33
- ## Installation
34
-
35
- ### Via pip
36
-
37
- ```bash
38
- pip install uv-sbom-bin
39
- ```
40
-
41
- ### Via uv
42
-
43
- ```bash
44
- uv tool install uv-sbom-bin
45
- ```
46
-
47
- ## Usage
48
-
49
- After installation, the `uv-sbom` command will be available in your PATH:
50
-
51
- ```bash
52
- uv-sbom --version
53
- uv-sbom --format json
54
- uv-sbom --format markdown --output SBOM.md
55
- ```
56
-
57
- ## How It Works
58
-
59
- This package downloads the prebuilt Rust binary for your platform from the [GitHub releases](https://github.com/Taketo-Yoda/uv-sbom/releases) and installs it.
60
-
61
- Supported platforms:
62
- - macOS (Apple Silicon and Intel)
63
- - Linux (x86_64)
64
- - Windows (x86_64)
65
-
66
- ## Development
67
-
68
- This is a wrapper package. The actual tool is developed at:
69
- https://github.com/Taketo-Yoda/uv-sbom
70
-
71
- ## License
72
-
73
- MIT License - see [LICENSE](https://github.com/Taketo-Yoda/uv-sbom/blob/main/LICENSE)
uv_sbom_bin-1.0.0/README.md DELETED
@@ -1,47 +0,0 @@
1
- # uv-sbom-bin
2
-
3
- Python wrapper for the `uv-sbom` CLI tool written in Rust.
4
-
5
- This package allows Python users to install `uv-sbom` via PyPI and use it with `uv tool install`.
6
-
7
- ## Installation
8
-
9
- ### Via pip
10
-
11
- ```bash
12
- pip install uv-sbom-bin
13
- ```
14
-
15
- ### Via uv
16
-
17
- ```bash
18
- uv tool install uv-sbom-bin
19
- ```
20
-
21
- ## Usage
22
-
23
- After installation, the `uv-sbom` command will be available in your PATH:
24
-
25
- ```bash
26
- uv-sbom --version
27
- uv-sbom --format json
28
- uv-sbom --format markdown --output SBOM.md
29
- ```
30
-
31
- ## How It Works
32
-
33
- This package downloads the prebuilt Rust binary for your platform from the [GitHub releases](https://github.com/Taketo-Yoda/uv-sbom/releases) and installs it.
34
-
35
- Supported platforms:
36
- - macOS (Apple Silicon and Intel)
37
- - Linux (x86_64)
38
- - Windows (x86_64)
39
-
40
- ## Development
41
-
42
- This is a wrapper package. The actual tool is developed at:
43
- https://github.com/Taketo-Yoda/uv-sbom
44
-
45
- ## License
46
-
47
- MIT License - see [LICENSE](https://github.com/Taketo-Yoda/uv-sbom/blob/main/LICENSE)
{uv_sbom_bin-1.0.0 → uv_sbom_bin-1.1.0}/.gitignore RENAMED
File without changes