[SBOM] Drop support for cyclonedx-python-lib v4 #89

hedtke · 2023-11-08T11:16:37Z

This PR drops support for cyclonedx-python-lib v4 as dependency track cannot parse the resulting XML. We now support only v5.

New XML was tested with dependency track v4.9.1 and it works now

fixes #88

memsharded

This looks good, thanks for the contribution.

I'd like to ask if there are strong reasons to provide support for version 3. Maybe we can jump directly to support version 5 only, and simplify things? I guess that cyclonedx community is also moving forward, tooling, etc, will be supporting the latest versions, so we can move forward without issues and drop 3 support?

hedtke · 2023-11-08T12:58:14Z

I'd like to ask if there are strong reasons to provide support for version 3. Maybe we can jump directly to support version 5 only, and simplify things? I guess that cyclonedx community is also moving forward, tooling, etc, will be supporting the latest versions, so we can move forward without issues and drop 3 support?

The GitHub Workflow for the Conan extensions works with python 3.6, and there only v3 is supported. I was surprised by the usage of such an old python version when I wrote the first version of the extension: #66 (comment)

jkowalleck · 2023-11-08T13:29:46Z

extensions/commands/sbom/cmd_cyclonedx.py

            component.external_references.add(ExternalReference(
                type=ExternalReferenceType.WEBSITE,  # noqa
                url=XsUri(node.conanfile.homepage),
            ))  # noqa
        return component

    def me_as_tool() -> Tool:
-        tool = Tool(name="conan extension recipe:create-sbom")
-        if cyclonedx_major_version_is_4():
+        tool = Tool(name="conan extension sbom:cyclonedx")


this change of the route - is a breaking change, right?

... even though it was already documented as the "new" value in the README.

I am not sure what you mean by "route". I just stumbled across this outdated tool name. Something that I overlooked in #66. Should we keep it as it was?

understood.

memsharded · 2023-11-08T13:36:37Z

The GitHub Workflow for the Conan extensions works with python 3.6, and there only v3 is supported. I was surprised by the usage of such an old python version when I wrote the first version of the extension: #66 (comment)

It is true that Conan itself still supports Python 3.6, this is our backward and stability commitment. If this is important and allows to simplify things and have a cleaner and simpler integration, I think we can increase the Python version requirement, and use something newer to test it. What minimum Python version would be necessary for version 5?

hedtke · 2023-11-08T13:38:45Z

What minimum Python version would be necessary for version 5?

Python 3.8, https://pypi.org/project/cyclonedx-python-lib/

hedtke · 2023-11-08T13:39:38Z

I would then drop the support for v3 of cyclonedx-python-lib completely

CLAassistant · 2023-11-15T10:35:51Z

All committers have signed the CLA.

hedtke · 2023-11-20T09:05:04Z

What do we do here? Wait for minimum Python 3.8, or continue with supporting two different versions of cyclonedx-python-lib?

memsharded · 2023-11-20T09:45:01Z

What do we do here? Wait for minimum Python 3.8, or continue with supporting two different versions of cyclonedx-python-lib?

I think we should be able to require Python 3.8 in the CI of this repo so this can be tested, and the extension could have a check for minimum Python version to give a good error in case some user tries to use it with older Python versions.

But I need to discuss this with the team and get feedback, sorry I haven't been able to do this yet, I'll do it as soon as possible.

hedtke · 2024-02-01T12:57:01Z

I'd like to ping here 😸

czoido · 2024-02-01T15:06:31Z

I'd like to ping here 😸

Hi @hedtke,

I have just update the python version the CI runs to 3.8, so you can update the PR accordingly and add a warning to the extension and check for minimum Python version in the extension to give a good error in case some user tries to use it with older Python versions.
Thanks a lot and sorry for the delay

hedtke · 2024-04-12T07:55:31Z

Sorry, it took me a while to continue here. Ready for the next review round. Support for cyclonedx-python-lib v4 dropped and Python 3.8 now required

jkowalleck

why are all these # noqa needed?

jkowalleck · 2024-04-12T09:38:50Z

extensions/commands/sbom/cmd_cyclonedx.py

    def package_type_to_component_type(pt: str) -> ComponentType:
        return ComponentType.APPLICATION if pt == "application" else ComponentType.LIBRARY

-    def licenses(ls: Optional[Union[Tuple[str, ...], Set[str], List[str], str]]) -> Optional[Iterable[LicenseChoice]]:
+    def licenses(ls: Optional[Union[Tuple[str, ...], Set[str], List[str], str]]):


where is the return type hint gone?

I had to drop it when we supported v3 and v5 which returned different things. I re-added them

jkowalleck · 2024-04-12T09:39:39Z

extensions/commands/sbom/cmd_cyclonedx.py

-            return [LicenseChoice(license=LicenseFactory().make_from_string(i)) for i in ls]  # noqa
-        else:
-            return [LicenseChoice(license_=LicenseFactory().make_from_string(i)) for i in ls]
+        return [LicenseFactory().make_from_string(i) for i in ls]  # noqa


why is that # noqa needed?

sorry, they were required when parts of the code were not tested in the CI, I dropped it

jkowalleck · 2024-04-12T09:42:03Z

extensions/commands/sbom/cmd_cyclonedx.py

-            )
-        if node.conanfile.homepage and cyclonedx_major_version_is_4():  # bug in cyclonedx 3 enforces hashes
+        component = Component(
+            type=package_type_to_component_type(node.conanfile.package_type),  # noqa


why uis this # noqa needed?

sorry, they were required when parts of the code were not tested in the CI, I dropped it

extensions/commands/sbom/cmd_cyclonedx.py

Co-authored-by: Carlos Zoido <[email protected]>

czoido

Looks good to me! Thanks a lot @hedtke for contributing this

See conan-io/conan-extensions#89.

* Add conan-recipes * Add generate conan sboms for zenoh-c and zenoh-cpp * fix: Conan SBOM filename * feat: Support zenoh-pico * fix: Update zenoh-recipes submodule * chore: Rerun workflows * chore: Rerun workflows (again) * fix: Update cyclonedx-python-lib requirement See conan-io/conan-extensions#89. * fix: Autodetect Conan profile * fix: Collapse path to Conan SBOMs * fix: Handle error from `conan profile detect` --------- Co-authored-by: Mahmoud Mazouz <[email protected]>

Drop support for cyclonedx-python-lib v4

882b8d4

hedtke mentioned this pull request Nov 8, 2023

SBOM XML namespace cannot be parsed by dependencytrack #88

Closed

danimtb approved these changes Nov 8, 2023

View reviewed changes

memsharded approved these changes Nov 8, 2023

View reviewed changes

jkowalleck reviewed Nov 8, 2023

View reviewed changes

memsharded added the look into label Nov 20, 2023

hedtke added 2 commits April 12, 2024 09:42

Drop support for cyclonedx-python-lib v4

92e6d5d

Require at least python 3.8

e1df0fb

jkowalleck reviewed Apr 12, 2024

View reviewed changes

hedtke added 2 commits April 12, 2024 12:17

Readd type hints and drop noqa

2eac6d3

Fix import

be62403

czoido reviewed Apr 12, 2024

View reviewed changes

extensions/commands/sbom/cmd_cyclonedx.py Outdated Show resolved Hide resolved

Add missing quote

b5bd792

Co-authored-by: Carlos Zoido <[email protected]>

czoido approved these changes Apr 12, 2024

View reviewed changes

czoido merged commit 3c971d1 into conan-io:main Apr 12, 2024
2 checks passed

fuzzypixelz added a commit to ZettaScaleLabs/zenoh-sboms that referenced this pull request Apr 18, 2024

fix: Update cyclonedx-python-lib requirement

c503a50

See conan-io/conan-extensions#89.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SBOM] Drop support for cyclonedx-python-lib v4 #89

[SBOM] Drop support for cyclonedx-python-lib v4 #89

hedtke commented Nov 8, 2023 •

edited

Loading

memsharded left a comment

hedtke commented Nov 8, 2023

jkowalleck Nov 8, 2023

hedtke Nov 8, 2023

jkowalleck Nov 8, 2023

memsharded commented Nov 8, 2023

hedtke commented Nov 8, 2023

hedtke commented Nov 8, 2023

CLAassistant commented Nov 15, 2023 •

edited

Loading

hedtke commented Nov 20, 2023

memsharded commented Nov 20, 2023

hedtke commented Feb 1, 2024

czoido commented Feb 1, 2024

hedtke commented Apr 12, 2024

jkowalleck left a comment

jkowalleck Apr 12, 2024

hedtke Apr 12, 2024

jkowalleck Apr 12, 2024

hedtke Apr 12, 2024

jkowalleck Apr 12, 2024

hedtke Apr 12, 2024

czoido left a comment

[SBOM] Drop support for cyclonedx-python-lib v4 #89

[SBOM] Drop support for cyclonedx-python-lib v4 #89

Conversation

hedtke commented Nov 8, 2023 • edited Loading

memsharded left a comment

Choose a reason for hiding this comment

hedtke commented Nov 8, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

memsharded commented Nov 8, 2023

hedtke commented Nov 8, 2023

hedtke commented Nov 8, 2023

CLAassistant commented Nov 15, 2023 • edited Loading

hedtke commented Nov 20, 2023

memsharded commented Nov 20, 2023

hedtke commented Feb 1, 2024

czoido commented Feb 1, 2024

hedtke commented Apr 12, 2024

jkowalleck left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

czoido left a comment

Choose a reason for hiding this comment

hedtke commented Nov 8, 2023 •

edited

Loading

CLAassistant commented Nov 15, 2023 •

edited

Loading