Skip to content

Commit 24c9003

Browse files
jkowalleckjkowalleck
authored
Merge branch 'main' into feat/model-card
2 parents 4a086f6 + f311b61 commit 24c9003

44 files changed

Lines changed: 932 additions & 378 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<!--🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅
2+
3+
You can expedite processing of your PR by using this template to provide context
4+
and additional information. Before actually opening a PR please make sure that it
5+
does NOT fall into any of the following categories
6+
7+
🚫 Spam PRs (accidental or intentional) - these will result in a 30-days or even
8+
∞ ban from interacting with the project depending on reoccurrence and severity.
9+
10+
🚫 Lazy typo fixing PRs - if you fix a typo in a file, your PR will only be merged
11+
if all other typos in the same file are also fixed with the same PR
12+
13+
🚫 If you fail to provide any _Description_ below, your PR will be considered spam.
14+
If you do not check the _Affirmation_ box below, your PR will not be merged.
15+
16+
🚫 If you do not check one of the _AI Tool Disclosure_ boxes below, your PR will
17+
not be merged. If you used AI tools to assist you in writing code, but fail to
18+
provide the required disclosure, your PR will not be merged.
19+
20+
🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅-->
21+
22+
### Description
23+
24+
<!-- ✍️-->
25+
A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.
26+
27+
Resolves or fixes issue: <!-- ✍️ Add GitHub issue number in format `#0000` or `none` -->
28+
29+
### AI Tool Disclosure
30+
31+
- [ ] My contribution does not include any AI-generated content
32+
- [ ] My contribution includes AI-generated content, as disclosed below:
33+
- AI Tools: `[e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]`
34+
- LLMs and versions: `[e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]`
35+
- Prompts: `[Summarize the key prompts or instructions given to the AI tools]`
36+
37+
### Affirmation
38+
39+
- [ ] My code follows the [CONTRIBUTING.md](https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CONTRIBUTING.md) guidelines

‎.github/workflows/python.yml‎

Lines changed: 11 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
steps:
3434
- name: Checkout
3535
# see https://github.com/actions/checkout
36-
uses: actions/checkout@v5
36+
uses: actions/checkout@v6
3737
- name: Setup Python Environment
3838
# see https://github.com/actions/setup-python
3939
uses: actions/setup-python@v6
@@ -57,7 +57,7 @@ jobs:
5757
steps:
5858
- name: Checkout
5959
# see https://github.com/actions/checkout
60-
uses: actions/checkout@v5
60+
uses: actions/checkout@v6
6161
- name: Setup Python Environment
6262
# see https://github.com/actions/setup-python
6363
uses: actions/setup-python@v6
@@ -81,7 +81,7 @@ jobs:
8181
steps:
8282
- name: Checkout
8383
# see https://github.com/actions/checkout
84-
uses: actions/checkout@v5
84+
uses: actions/checkout@v6
8585
- name: Setup Python Environment
8686
# see https://github.com/actions/setup-python
8787
uses: actions/setup-python@v6
@@ -105,7 +105,7 @@ jobs:
105105
steps:
106106
- name: Checkout
107107
# see https://github.com/actions/checkout
108-
uses: actions/checkout@v5
108+
uses: actions/checkout@v6
109109
- name: Setup Python Environment
110110
# see https://github.com/actions/setup-python
111111
uses: actions/setup-python@v6
@@ -141,7 +141,7 @@ jobs:
141141
steps:
142142
- name: Checkout
143143
# see https://github.com/actions/checkout
144-
uses: actions/checkout@v5
144+
uses: actions/checkout@v6
145145
- name: Setup Python Environment
146146
# see https://github.com/actions/setup-python
147147
uses: actions/setup-python@v6
@@ -180,31 +180,18 @@ jobs:
180180
- "-allExtras"
181181
- "-noExtras"
182182
exclude:
183-
- os: macos-latest
183+
- os: macos-latest # macos-latest is incompatible with some PY versions
184184
python-version: "3.10"
185-
- os: macos-latest
185+
- os: macos-latest # macos-latest is incompatible with some PY versions
186186
python-version: "3.9"
187-
include:
188-
- os: macos-13
189-
python-version: "3.10"
190-
toxenv-factors: "-allExtras"
191-
- os: macos-13
192-
python-version: "3.10"
193-
toxenv-factors: "-noExtras"
194-
- os: macos-13
195-
python-version: "3.9"
196-
toxenv-factors: "-allExtras"
197-
- os: macos-13
198-
python-version: "3.9"
199-
toxenv-factors: "-noExtras"
200187
steps:
201188
- name: Disabled Git auto EOL CRLF transforms
202189
run: |
203190
git config --global core.autocrlf false
204191
git config --global core.eol lf
205192
- name: Checkout
206193
# see https://github.com/actions/checkout
207-
uses: actions/checkout@v5
194+
uses: actions/checkout@v6
208195
- name: Create reports directory
209196
run: mkdir ${{ env.REPORTS_DIR }}
210197
- name: Setup Python Environment
@@ -239,7 +226,7 @@ jobs:
239226
- name: Artifact reports
240227
if: ${{ ! cancelled() }}
241228
# see https://github.com/actions/upload-artifact
242-
uses: actions/upload-artifact@v5
229+
uses: actions/upload-artifact@v6
243230
with:
244231
name: ${{ env.TESTS_REPORTS_ARTIFACT }}-${{ matrix.os }}-py${{ matrix.python-version }}${{ matrix.toxenv-factors }}
245232
path: ${{ env.REPORTS_DIR }}
@@ -253,7 +240,7 @@ jobs:
253240
steps:
254241
- name: fetch test artifacts
255242
# see https://github.com/actions/download-artifact
256-
uses: actions/download-artifact@v6
243+
uses: actions/download-artifact@v7
257244
with:
258245
path: ${{ env.REPORTS_DIR }}
259246
pattern: ${{ env.TESTS_REPORTS_ARTIFACT }}-*
@@ -282,7 +269,7 @@ jobs:
282269
steps:
283270
- name: Checkout
284271
# see https://github.com/actions/checkout
285-
uses: actions/checkout@v5
272+
uses: actions/checkout@v6
286273
- name: Setup Python Environment
287274
# see https://github.com/actions/setup-python
288275
uses: actions/setup-python@v6

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
steps:
4949
- name: Checkout code
5050
# see https://github.com/actions/checkout
51-
uses: actions/checkout@v5
51+
uses: actions/checkout@v6
5252
- name: Setup Python Environment
5353
# see https://github.com/actions/setup-python
5454
uses: actions/setup-python@v6
@@ -70,7 +70,7 @@ jobs:
7070
steps:
7171
- name: Checkout code
7272
# see https://github.com/actions/checkout
73-
uses: actions/checkout@v5
73+
uses: actions/checkout@v6
7474
- name: Setup Python Environment
7575
# see https://github.com/actions/setup-python
7676
uses: actions/setup-python@v6
@@ -105,7 +105,7 @@ jobs:
105105
steps:
106106
- name: Checkout code
107107
# see https://github.com/actions/checkout
108-
uses: actions/checkout@v5
108+
uses: actions/checkout@v6
109109
with:
110110
fetch-depth: 0
111111

‎.readthedocs.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ version: 2
66

77
# Set the version of Python and other tools you might need
88
build:
9-
os: ubuntu-22.04
9+
os: ubuntu-lts-latest
1010
tools:
11-
python: "3.11"
11+
python: "3.14"
1212
# You can also specify other tool versions:
1313
# nodejs: "16"
1414
# rust: "1.55"

‎CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,20 @@
22

33
<!-- version list -->
44

5+
## v11.6.0 (2025-12-02)
6+
7+
### Documentation
8+
9+
- Update 1.7 ([#920](https://github.com/CycloneDX/cyclonedx-python-lib/pull/920),
10+
[`7e6771b`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/7e6771b0c1166d384ee438460e45794914937b6e))
11+
12+
### Features
13+
14+
- Moved non‑standard implementations to Contrib area
15+
([#916](https://github.com/CycloneDX/cyclonedx-python-lib/pull/916),
16+
[`15a9023`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/15a902374bc6507788853a854256d3570ab250a7))
17+
18+
519
## v11.5.0 (2025-10-31)
620

721
### Features

‎cyclonedx/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@
2222

2323
# !! version is managed by semantic_release
2424
# do not use typing here, or else `semantic_release` might have issues finding the variable
25-
__version__ = "11.5.0" # noqa:Q000
25+
__version__ = "11.6.0" # noqa:Q000

‎cyclonedx/builder/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,6 @@
1717

1818
"""
1919
Builders used in this library.
20+
21+
.. deprecated:: next
2022
"""

‎cyclonedx/builder/this.py‎

Lines changed: 41 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -15,69 +15,51 @@
1515
# SPDX-License-Identifier: Apache-2.0
1616
# Copyright (c) OWASP Foundation. All Rights Reserved.
1717

18-
"""Representation of this very python library."""
18+
"""Representation of this very python library.
1919
20-
__all__ = ['this_component', 'this_tool', ]
20+
.. deprecated:: next
21+
"""
2122

22-
from .. import __version__ as __ThisVersion # noqa: N812
23-
from ..model import ExternalReference, ExternalReferenceType, XsUri
24-
from ..model.component import Component, ComponentType
25-
from ..model.license import DisjunctiveLicense, LicenseAcknowledgement
26-
from ..model.tool import Tool
23+
__all__ = ['this_component', 'this_tool']
2724

28-
# !!! keep this file in sync with `pyproject.toml`
25+
import sys
26+
from typing import TYPE_CHECKING
2927

28+
if sys.version_info >= (3, 13):
29+
from warnings import deprecated
30+
else:
31+
from typing_extensions import deprecated
3032

31-
def this_component() -> Component:
32-
"""Representation of this very python library as a :class:`Component`."""
33-
return Component(
34-
type=ComponentType.LIBRARY,
35-
group='CycloneDX',
36-
name='cyclonedx-python-lib',
37-
version=__ThisVersion or 'UNKNOWN',
38-
description='Python library for CycloneDX',
39-
licenses=(DisjunctiveLicense(id='Apache-2.0',
40-
acknowledgement=LicenseAcknowledgement.DECLARED),),
41-
external_references=(
42-
# let's assume this is not a fork
43-
ExternalReference(
44-
type=ExternalReferenceType.WEBSITE,
45-
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/#readme')
46-
),
47-
ExternalReference(
48-
type=ExternalReferenceType.DOCUMENTATION,
49-
url=XsUri('https://cyclonedx-python-library.readthedocs.io/')
50-
),
51-
ExternalReference(
52-
type=ExternalReferenceType.VCS,
53-
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib')
54-
),
55-
ExternalReference(
56-
type=ExternalReferenceType.BUILD_SYSTEM,
57-
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/actions')
58-
),
59-
ExternalReference(
60-
type=ExternalReferenceType.ISSUE_TRACKER,
61-
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/issues')
62-
),
63-
ExternalReference(
64-
type=ExternalReferenceType.LICENSE,
65-
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE')
66-
),
67-
ExternalReference(
68-
type=ExternalReferenceType.RELEASE_NOTES,
69-
url=XsUri('https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md')
70-
),
71-
# we cannot assert where the lib was fetched from, but we can give a hint
72-
ExternalReference(
73-
type=ExternalReferenceType.DISTRIBUTION,
74-
url=XsUri('https://pypi.org/project/cyclonedx-python-lib/')
75-
),
76-
),
77-
# to be extended...
78-
)
33+
from ..contrib.this.builders import this_component as _this_component, this_tool as _this_tool
7934

35+
# region deprecated re-export
8036

81-
def this_tool() -> Tool:
82-
"""Representation of this very python library as a :class:`Tool`."""
83-
return Tool.from_component(this_component())
37+
if TYPE_CHECKING:
38+
from ..model.component import Component
39+
from ..model.tool import Tool
40+
41+
42+
@deprecated('Deprecated re-export location - see docstring of "this_component" for details.')
43+
def this_component() -> 'Component':
44+
"""Deprecated — Alias of :func:`cyclonedx.contrib.this.builders.this_component`.
45+
46+
.. deprecated:: next
47+
This re-export location is deprecated.
48+
Use ``from cyclonedx.contrib.this.builders import this_component`` instead.
49+
The exported symbol itself is NOT deprecated — only this import path.
50+
"""
51+
return _this_component()
52+
53+
54+
@deprecated('Deprecated re-export location - see docstring of "this_tool" for details.')
55+
def this_tool() -> 'Tool':
56+
"""Deprecated — Alias of :func:`cyclonedx.contrib.this.builders.this_tool`.
57+
58+
.. deprecated:: next
59+
This re-export location is deprecated.
60+
Use ``from cyclonedx.contrib.this.builders import this_tool`` instead.
61+
The exported symbol itself is NOT deprecated — only this import path.
62+
"""
63+
return _this_tool()
64+
65+
# endregion deprecated re-export

‎cyclonedx/contrib/README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# CycloneDX Contrib Extensions
2+
3+
This directory contains community-contributed functionality that extends the capabilities of the CycloneDX core library.
4+
Unlike the modules in `../`, these features are not part of the official CycloneDX specification and may vary in stability, scope, or compatibility.
5+
6+
## Contents
7+
- Utilities, helpers, and experimental features developed by the community
8+
- Optional add-ons that may facilitate or enhance use of the CycloneDX core library
9+
- Code that evolves independently of the CycloneDX specification
10+
11+
## Notes
12+
- Contrib modules are optional and not required for strict compliance with the CycloneDX standard.
13+
- They may change more frequently than the core and are not guaranteed to follow the same versioning rules.
14+
- Users should evaluate these modules carefully and consult documentation or source comments for details.
15+
16+
## Contributing
17+
Contributions are welcome. To add an extension:
18+
1. Follow the contribution guidelines in the main repository.
19+
2. Place your code in a clearly named subfolder or file under `contrib/`.
20+
3. Provide documentation and tests to ensure clarity and maintainability.

cyclonedx/_internal/hash.py renamed to cyclonedx/contrib/__init__.py

Lines changed: 6 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,11 @@
1717

1818

1919
"""
20-
!!! ALL SYMBOLS IN HERE ARE INTERNAL.
21-
Everything might change without any notice.
20+
Some features in this library are marked as contrib.
21+
These are community-provided extensions and are not part of the official standard.
22+
They are optional and may evolve independently from the core.
2223
"""
2324

24-
25-
from hashlib import sha1
26-
27-
28-
def file_sha1sum(filename: str) -> str:
29-
"""
30-
Generate a SHA1 hash of the provided file.
31-
32-
Args:
33-
filename:
34-
Absolute path to file to hash as `str`
35-
36-
Returns:
37-
SHA-1 hash
38-
"""
39-
h = sha1() # nosec B303, B324
40-
with open(filename, 'rb') as f:
41-
for byte_block in iter(lambda: f.read(4096), b''):
42-
h.update(byte_block)
43-
return h.hexdigest()
25+
__all__ = [
26+
# there is no intention to export anything in here.
27+
]

0 commit comments

Comments
 (0)