chore: update SBOM for Python 3.8 (#4120)

Co-authored-by: GitHub <[email protected]>

Author: github-actions[bot]

sbom/cve-bin-tool-py3.8.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:120bb2a5-fa0c-4b63-8098-1c048eeed9f3",
+  "serialNumber": "urn:uuid:3178e3ea-d027-4327-a88b-1a6f2c9f1925",
   "version": 1,
   "metadata": {
-    "timestamp": "2024-05-06T00:28:48Z",
+    "timestamp": "2024-05-13T00:29:26Z",
     "tools": {
       "components": [
         {
@@ -483,6 +483,12 @@
       },
       "cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*",
       "description": "CVSS2/3/4 library with interactive calculator for Python 2 and Python 3",
+      "hashes": [
+        {
+          "alg": "SHA-1",
+          "content": "e4cf69bea6bcfa1cbc38dca13b9ec8bf3363a475"
+        }
+      ],
       "licenses": [
         {
           "license": {
@@ -652,7 +658,7 @@
       "type": "library",
       "bom-ref": "16-gsutil",
       "name": "gsutil",
-      "version": "5.28",
+      "version": "5.29",
       "supplier": {
         "name": "Google Inc .",
         "contact": [
@@ -661,7 +667,7 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:google_inc.:gsutil:5.28:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:google_inc.:gsutil:5.29:*:*:*:*:*:*:*",
       "description": "A command line tool for interacting with cloud storage services.",
       "licenses": [
         {
@@ -673,12 +679,12 @@
       ],
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/gsutil/5.28",
+          "url": "https://pypi.org/project/gsutil/5.29",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/gsutil@5.28",
+      "purl": "pkg:pypi/gsutil@5.29",
       "properties": [
         {
           "name": "language",
@@ -1514,7 +1520,7 @@
       "type": "library",
       "bom-ref": "35-cryptography",
       "name": "cryptography",
-      "version": "42.0.6",
+      "version": "42.0.7",
       "supplier": {
         "name": "The Python Cryptographic Authority and individual contributors",
         "contact": [
@@ -1523,7 +1529,7 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.6:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.7:*:*:*:*:*:*:*",
       "description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.",
       "licenses": [
         {
@@ -1532,12 +1538,12 @@
       ],
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/cryptography/42.0.6",
+          "url": "https://pypi.org/project/cryptography/42.0.7",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/[email protected].6",
+      "purl": "pkg:pypi/[email protected].7",
       "properties": [
         {
           "name": "language",
@@ -1940,12 +1946,6 @@
       "name": "markupsafe",
       "version": "2.1.5",
       "description": "Safely add untrusted strings to HTML/XML markup.",
-      "hashes": [
-        {
-          "alg": "SHA-1",
-          "content": "fbba4acd0312826cec9cfe18371c7df07962cb65"
-        }
-      ],
       "licenses": [
         {
           "license": {
@@ -2086,11 +2086,11 @@
       "type": "library",
       "bom-ref": "49-rpds-py",
       "name": "rpds-py",
-      "version": "0.18.0",
+      "version": "0.18.1",
       "supplier": {
         "name": "Julian Berman"
       },
-      "cpe": "cpe:2.3:a:julian_berman:rpds-py:0.18.0:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:julian_berman:rpds-py:0.18.1:*:*:*:*:*:*:*",
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "licenses": [
         {
@@ -2102,12 +2102,12 @@
       ],
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/rpds-py/0.18.0",
+          "url": "https://pypi.org/project/rpds-py/0.18.1",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/[email protected].0",
+      "purl": "pkg:pypi/[email protected].1",
       "properties": [
         {
           "name": "language",
@@ -2420,7 +2420,7 @@
       "type": "library",
       "bom-ref": "57-tenacity",
       "name": "tenacity",
-      "version": "8.2.3",
+      "version": "8.3.0",
       "supplier": {
         "name": "Julien Danjou",
         "contact": [
@@ -2429,14 +2429,8 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:julien_danjou:tenacity:8.2.3:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:julien_danjou:tenacity:8.3.0:*:*:*:*:*:*:*",
       "description": "Retry code until it succeeds",
-      "hashes": [
-        {
-          "alg": "SHA-1",
-          "content": "41ed2420cda8ab7650a39900451099f4730266c3"
-        }
-      ],
       "licenses": [
         {
           "license": {
@@ -2447,12 +2441,12 @@
       ],
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/tenacity/8.2.3",
+          "url": "https://pypi.org/project/tenacity/8.3.0",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/tenacity@8.2.3",
+      "purl": "pkg:pypi/tenacity@8.3.0",
       "properties": [
         {
           "name": "language",

sbom/cve-bin-tool-py3.8.spdx

@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: Python-cve-bin-tool
-DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-e22d6ccd-3b1e-4723-801c-333cec52ae09
+DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-43ca30d9-07f7-4748-a669-8136d177492c
 LicenseListVersion: 3.22
 Creator: Tool: sbom4python-0.10.4
-Created: 2024-05-06T00:27:03Z
+Created: 2024-05-13T00:27:42Z
 CreatorComment: <text>This document has been automatically generated.</text>
 ##### 
 
@@ -189,6 +189,7 @@ PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Organization: Stanislav Red Hat Product Security ([email protected])
 PackageDownloadLocation: https://pypi.org/project/cvss/3.1
 FilesAnalyzed: false
+PackageChecksum: SHA1: e4cf69bea6bcfa1cbc38dca13b9ec8bf3363a475
 PackageLicenseDeclared: NOASSERTION
 PackageLicenseConcluded: LGPL-3.0-or-later
 PackageLicenseComments: <text>cvss declares LGPLv3+ which is not currently a valid SPDX License identifier or expression.</text>
@@ -249,18 +250,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:tomas_aparicio:filetype:1.2.0:*:*:*:*:
 
 PackageName: gsutil
 SPDXID: SPDXRef-Package-16-gsutil
-PackageVersion: 5.28
+PackageVersion: 5.29
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Google Inc. ([email protected])
-PackageDownloadLocation: https://pypi.org/project/gsutil/5.28
+PackageDownloadLocation: https://pypi.org/project/gsutil/5.29
 FilesAnalyzed: false
 PackageLicenseDeclared: NOASSERTION
 PackageLicenseConcluded: Apache-2.0
 PackageLicenseComments: <text>gsutil declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>A command line tool for interacting with cloud storage services.</text>
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/gsutil@5.28
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.28:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/gsutil@5.29
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.29:*:*:*:*:*:*:*
 ##### 
 
 PackageName: argcomplete
@@ -557,17 +558,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_pyopenssl_developers:pyopenssl:24.
 
 PackageName: cryptography
 SPDXID: SPDXRef-Package-35-cryptography
-PackageVersion: 42.0.6
+PackageVersion: 42.0.7
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Organization: The Python Cryptographic Authority and individual contributors ([email protected])
-PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.6
+PackageDownloadLocation: https://pypi.org/project/cryptography/42.0.7
 FilesAnalyzed: false
 PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause
 PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>cryptography is a package which provides cryptographic recipes and primitives to Python developers.</text>
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].6
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.6:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].7
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_python_cryptographic_authority_and_individual_contributors:cryptography:42.0.7:*:*:*:*:*:*:*
 ##### 
 
 PackageName: cffi
@@ -721,7 +722,6 @@ PrimaryPackagePurpose: LIBRARY
 PackageSupplier: NOASSERTION
 PackageDownloadLocation: https://pypi.org/project/MarkupSafe/2.1.5
 FilesAnalyzed: false
-PackageChecksum: SHA1: fbba4acd0312826cec9cfe18371c7df07962cb65
 PackageLicenseDeclared: BSD-3-Clause
 PackageLicenseConcluded: BSD-3-Clause
 PackageCopyrightText: NOASSERTION
@@ -777,17 +777,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.35.1:*:*:*
 
 PackageName: rpds-py
 SPDXID: SPDXRef-Package-49-rpds-py
-PackageVersion: 0.18.0
+PackageVersion: 0.18.1
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Julian Berman
-PackageDownloadLocation: https://pypi.org/project/rpds-py/0.18.0
+PackageDownloadLocation: https://pypi.org/project/rpds-py/0.18.1
 FilesAnalyzed: false
 PackageLicenseDeclared: MIT
 PackageLicenseConcluded: MIT
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>Python bindings to Rust's persistent data structures (rpds)</text>
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.18.0:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.18.1:*:*:*:*:*:*:*
 ##### 
 
 PackageName: pkgutil-resolve-name
@@ -902,19 +902,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:5.22.0:*:*:*:*:*:*:*
 
 PackageName: tenacity
 SPDXID: SPDXRef-Package-57-tenacity
-PackageVersion: 8.2.3
+PackageVersion: 8.3.0
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Julien Danjou ([email protected])
-PackageDownloadLocation: https://pypi.org/project/tenacity/8.2.3
+PackageDownloadLocation: https://pypi.org/project/tenacity/8.3.0
 FilesAnalyzed: false
-PackageChecksum: SHA1: 41ed2420cda8ab7650a39900451099f4730266c3
 PackageLicenseDeclared: NOASSERTION
 PackageLicenseConcluded: Apache-2.0
 PackageLicenseComments: <text>tenacity declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>Retry code until it succeeds</text>
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/tenacity@8.2.3
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.2.3:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/tenacity@8.3.0
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.3.0:*:*:*:*:*:*:*
 ##### 
 
 PackageName: python-gnupg