Skip to content

Commit 48eea25

Browse files
vargenauvargenau
authored
Merge pull request #213 from nokia/add-validator-0.3.2-sbom
Add SBOM for version 0.3.2 of the validator
2 parents edb5904 + ffce4fa commit 48eea25

File tree

3 files changed

+542
-0
lines changed

3 files changed

+542
-0
lines changed

‎tools/openchain_telco_sbom_validator/open-source-compliance-artifacts/openchain-telco-sbom-validator-0.3.2.spdx‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
SPDXVersion: SPDX-2.3
2+
DataLicense: CC0-1.0
3+
SPDXID: SPDXRef-DOCUMENT
4+
DocumentName: openchain-telco-sbom-validator-0.3.2
5+
DocumentNamespace: https://nokia.com/spdx/openchain-telco-sbom-validator-0.3.2
6+
7+
## Creation Information
8+
LicenseListVersion: 3.27
9+
Creator: Organization: Nokia
10+
Creator: Tool: Nokia Compliance Tool - 1.0
11+
Created: 2025-07-29T10:45:51Z
12+
CreatorComment: CISA SBOM type: Source
13+
14+
##### Package: openchain-telco-sbom-validator
15+
16+
PackageName: openchain-telco-sbom-validator
17+
SPDXID: SPDXRef-openchain-telco-sbom-validator
18+
PackageVersion: 0.3.2
19+
PackageDownloadLocation: https://files.pythonhosted.org/packages/2d/95/1e35d9c9729d5bfe77e89959c380f2cfda4fcdf3f2312db8cd81474eab3e/openchain_telco_sbom_validator-0.3.2.tar.gz
20+
FilesAnalyzed: false
21+
PackageLicenseConcluded: Apache-2.0
22+
PackageLicenseDeclared: Apache-2.0
23+
PackageCopyrightText: (c) 2024-2025 Nokia Authors Gergely Csatari, Marc-Etienne Vargenau
24+
PackageSupplier: Organization: https://pypi.org
25+
PackageOriginator: Organization: Nokia
26+
PackageChecksum: SHA256: c95d3c0d517ba84594ec8ebb036b63b53b863962b5f10f6a9fe36403144f4e05
27+
PackageChecksum: MD5: b40cb73f6ced71b09db9c3e06b542d31
28+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/openchain-telco-sbom-validator@0.3.2
29+
30+
##### Package: ntia-conformance-checker
31+
32+
PackageName: ntia-conformance-checker
33+
SPDXID: SPDXRef-Package-python-ntia-conformance-checker
34+
PackageVersion: 3.2.0
35+
PackageSupplier: Organization: https://pypi.org
36+
PackageDownloadLocation: https://files.pythonhosted.org/packages/f6/1b/af3e028ffb25aba8b9efcaee5ab0430699769924d0e2274300ef19eed003/ntia_conformance_checker-3.2.0.tar.gz
37+
FilesAnalyzed: false
38+
PackageLicenseConcluded: Apache-2.0
39+
PackageLicenseDeclared: Apache-2.0
40+
PackageCopyrightText: 2024 SPDX contributors
41+
PackageChecksum: SHA256: 474ae33d7477c9db361a53dac3137066f94f56f0ac42c3e65f4de3ddb4c2c326
42+
PackageChecksum: MD5: 475ad3e19c1e7ed6f0b4c3783b5cd219
43+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/ntia-conformance-checker@3.2.0
44+
45+
##### Package: packageurl-python
46+
47+
PackageName: packageurl-python
48+
SPDXID: SPDXRef-Package-python-packageurl-python
49+
PackageVersion: 0.17.1
50+
PackageSupplier: Organization: https://pypi.org
51+
PackageDownloadLocation: https://files.pythonhosted.org/packages/a9/b6/d28c4fa7535530879e7d64176f7ff081fb6308b50cac8e30f038a89e8fdd/packageurl_python-0.17.1.tar.gz
52+
FilesAnalyzed: false
53+
PackageLicenseConcluded: MIT
54+
PackageLicenseDeclared: MIT
55+
PackageCopyrightText: Copyright (c) the purl authors
56+
PackageChecksum: SHA256: 5db592a990b60bc02446033c50fb1803a26c5124cd72c5a2cd1b8ea1ae741969
57+
PackageChecksum: MD5: bc2a019812c3f3afe2186b18bcc4319c
58+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/packageurl-python@0.17.1
59+
60+
##### Package: prettytable
61+
62+
PackageName: prettytable
63+
SPDXID: SPDXRef-Package-python-prettytable
64+
PackageVersion: 3.16.0
65+
PackageSupplier: Organization: https://pypi.org
66+
PackageDownloadLocation: https://files.pythonhosted.org/packages/99/b1/85e18ac92afd08c533603e3393977b6bc1443043115a47bb094f3b98f94f/prettytable-3.16.0.tar.gz
67+
FilesAnalyzed: false
68+
PackageLicenseConcluded: BSD-3-Clause
69+
PackageLicenseDeclared: BSD-3-Clause
70+
PackageCopyrightText: Copyright (c) 2009-2014, Luke Maurits <luke@maurits.id.au>
71+
PackageChecksum: SHA256: 3c64b31719d961bf69c9a7e03d0c1e477320906a98da63952bc6698d6164ff57
72+
PackageChecksum: MD5: 85a6f1812e31ea2dcf8119f219c1a032
73+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/prettytable@3.16.0
74+
75+
##### Package: requests
76+
77+
PackageName: requests
78+
SPDXID: SPDXRef-Package-python-requests
79+
PackageVersion: 2.32.4
80+
PackageSupplier: Organization: https://pypi.org
81+
PackageDownloadLocation: https://files.pythonhosted.org/packages/e1/0a/929373653770d8a0d7ea76c37de6e41f11eb07559b103b1c02cafb3f7cf8/requests-2.32.4.tar.gz
82+
FilesAnalyzed: false
83+
PackageLicenseConcluded: Apache-2.0
84+
PackageLicenseDeclared: Apache-2.0
85+
PackageCopyrightText: Copyright 2019 Kenneth Reitz. All rights reserved.
86+
PackageChecksum: SHA256: 27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
87+
PackageChecksum: MD5: 4a380c14fe0f4465c9dbf79ffacefd8f
88+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/requests@2.32.4
89+
90+
##### Package: spdx-tools
91+
92+
PackageName: spdx-tools
93+
SPDXID: SPDXRef-Package-python-spdx-tools
94+
PackageVersion: 0.8.3
95+
PackageSupplier: Organization: https://pypi.org
96+
PackageDownloadLocation: https://files.pythonhosted.org/packages/f1/99/3470b28dc4b64fd29db3b1dcf5e84c743ec88e25ea7b214794f5930f0319/spdx-tools-0.8.3.tar.gz
97+
FilesAnalyzed: false
98+
PackageLicenseConcluded: Apache-2.0
99+
PackageLicenseDeclared: Apache-2.0
100+
PackageCopyrightText: 2023 spdx contributors
101+
PackageChecksum: SHA256: 68b8f9ce2893b5216bd90b2e63f1c821c2884e4ebc4fd295ebbf1fa8b8a94b93
102+
PackageChecksum: MD5: ebbd9ca439294df364a99e4f491fbbe8
103+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/spdx-tools@0.8.3
104+
105+
##### Package: validators
106+
107+
PackageName: validators
108+
SPDXID: SPDXRef-Package-python-validators
109+
PackageVersion: 0.35.0
110+
PackageSupplier: Organization: https://pypi.org
111+
PackageDownloadLocation: https://files.pythonhosted.org/packages/53/66/a435d9ae49850b2f071f7ebd8119dd4e84872b01630d6736761e6e7fd847/validators-0.35.0.tar.gz
112+
FilesAnalyzed: false
113+
PackageLicenseConcluded: MIT
114+
PackageLicenseDeclared: MIT
115+
PackageCopyrightText: Copyright (c) 2013 - 2025 Konsta Vesterinen
116+
PackageChecksum: SHA256: 992d6c48a4e77c81f1b4daba10d16c3a9bb0dbb79b3a19ea847ff0928e70497a
117+
PackageChecksum: MD5: 8376f37ec2028053cee8f4789dadd947
118+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/validators@0.35.0
119+
120+
##### Relationships
121+
122+
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-openchain-telco-sbom-validator
123+
Relationship: SPDXRef-openchain-telco-sbom-validator CONTAINS SPDXRef-Package-python-ntia-conformance-checker
124+
Relationship: SPDXRef-openchain-telco-sbom-validator CONTAINS SPDXRef-Package-python-packageurl-python
125+
Relationship: SPDXRef-openchain-telco-sbom-validator CONTAINS SPDXRef-Package-python-prettytable
126+
Relationship: SPDXRef-openchain-telco-sbom-validator CONTAINS SPDXRef-Package-python-requests
127+
Relationship: SPDXRef-openchain-telco-sbom-validator CONTAINS SPDXRef-Package-python-spdx-tools
128+
Relationship: SPDXRef-openchain-telco-sbom-validator CONTAINS SPDXRef-Package-python-validators

‎tools/openchain_telco_sbom_validator/open-source-compliance-artifacts/openchain-telco-sbom-validator-0.3.2.spdx.json‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
{
2+
"SPDXID": "SPDXRef-DOCUMENT",
3+
"creationInfo": {
4+
"created": "2025-07-29T10:45:51Z",
5+
"creators": [
6+
"Organization: Nokia",
7+
"Tool: Nokia Compliance Tool - 1.0"
8+
],
9+
"licenseListVersion": "3.27",
10+
"comment": "CISA SBOM type: Source"
11+
},
12+
"dataLicense": "CC0-1.0",
13+
"name": "openchain-telco-sbom-validator-0.3.2",
14+
"spdxVersion": "SPDX-2.3",
15+
"documentNamespace": "https://nokia.com/spdx/openchain-telco-sbom-validator-0.3.2",
16+
"packages": [
17+
{
18+
"SPDXID": "SPDXRef-openchain-telco-sbom-validator",
19+
"checksums": [
20+
{
21+
"algorithm": "SHA256",
22+
"checksumValue": "c95d3c0d517ba84594ec8ebb036b63b53b863962b5f10f6a9fe36403144f4e05"
23+
},
24+
{
25+
"algorithm": "MD5",
26+
"checksumValue": "b40cb73f6ced71b09db9c3e06b542d31"
27+
}
28+
],
29+
"copyrightText": "(c) 2024-2025 Nokia Authors Gergely Csatari, Marc-Etienne Vargenau",
30+
"downloadLocation": "https://files.pythonhosted.org/packages/2d/95/1e35d9c9729d5bfe77e89959c380f2cfda4fcdf3f2312db8cd81474eab3e/openchain_telco_sbom_validator-0.3.2.tar.gz",
31+
"externalRefs": [
32+
{
33+
"referenceCategory": "PACKAGE_MANAGER",
34+
"referenceLocator": "pkg:pypi/openchain-telco-sbom-validator@0.3.2",
35+
"referenceType": "purl"
36+
}
37+
],
38+
"filesAnalyzed": false,
39+
"licenseConcluded": "Apache-2.0",
40+
"licenseDeclared": "Apache-2.0",
41+
"name": "openchain-telco-sbom-validator",
42+
"originator": "Organization: Nokia",
43+
"supplier": "Organization: https://pypi.org",
44+
"versionInfo": "0.3.2"
45+
},
46+
{
47+
"SPDXID": "SPDXRef-Package-python-ntia-conformance-checker",
48+
"checksums": [
49+
{
50+
"algorithm": "SHA256",
51+
"checksumValue": "474ae33d7477c9db361a53dac3137066f94f56f0ac42c3e65f4de3ddb4c2c326"
52+
},
53+
{
54+
"algorithm": "MD5",
55+
"checksumValue": "475ad3e19c1e7ed6f0b4c3783b5cd219"
56+
}
57+
],
58+
"copyrightText": "2024 SPDX contributors",
59+
"downloadLocation": "https://files.pythonhosted.org/packages/f6/1b/af3e028ffb25aba8b9efcaee5ab0430699769924d0e2274300ef19eed003/ntia_conformance_checker-3.2.0.tar.gz",
60+
"externalRefs": [
61+
{
62+
"referenceCategory": "PACKAGE_MANAGER",
63+
"referenceLocator": "pkg:pypi/ntia-conformance-checker@3.2.0",
64+
"referenceType": "purl"
65+
}
66+
],
67+
"filesAnalyzed": false,
68+
"licenseConcluded": "Apache-2.0",
69+
"licenseDeclared": "Apache-2.0",
70+
"name": "ntia-conformance-checker",
71+
"supplier": "Organization: https://pypi.org",
72+
"versionInfo": "3.2.0"
73+
},
74+
{
75+
"SPDXID": "SPDXRef-Package-python-packageurl-python",
76+
"checksums": [
77+
{
78+
"algorithm": "SHA256",
79+
"checksumValue": "5db592a990b60bc02446033c50fb1803a26c5124cd72c5a2cd1b8ea1ae741969"
80+
},
81+
{
82+
"algorithm": "MD5",
83+
"checksumValue": "bc2a019812c3f3afe2186b18bcc4319c"
84+
}
85+
],
86+
"copyrightText": "Copyright (c) the purl authors",
87+
"downloadLocation": "https://files.pythonhosted.org/packages/a9/b6/d28c4fa7535530879e7d64176f7ff081fb6308b50cac8e30f038a89e8fdd/packageurl_python-0.17.1.tar.gz",
88+
"externalRefs": [
89+
{
90+
"referenceCategory": "PACKAGE_MANAGER",
91+
"referenceLocator": "pkg:pypi/packageurl-python@0.17.1",
92+
"referenceType": "purl"
93+
}
94+
],
95+
"filesAnalyzed": false,
96+
"licenseConcluded": "MIT",
97+
"licenseDeclared": "MIT",
98+
"name": "packageurl-python",
99+
"supplier": "Organization: https://pypi.org",
100+
"versionInfo": "0.17.1"
101+
},
102+
{
103+
"SPDXID": "SPDXRef-Package-python-prettytable",
104+
"checksums": [
105+
{
106+
"algorithm": "SHA256",
107+
"checksumValue": "3c64b31719d961bf69c9a7e03d0c1e477320906a98da63952bc6698d6164ff57"
108+
},
109+
{
110+
"algorithm": "MD5",
111+
"checksumValue": "85a6f1812e31ea2dcf8119f219c1a032"
112+
}
113+
],
114+
"copyrightText": "Copyright (c) 2009-2014, Luke Maurits <luke@maurits.id.au>",
115+
"downloadLocation": "https://files.pythonhosted.org/packages/99/b1/85e18ac92afd08c533603e3393977b6bc1443043115a47bb094f3b98f94f/prettytable-3.16.0.tar.gz",
116+
"externalRefs": [
117+
{
118+
"referenceCategory": "PACKAGE_MANAGER",
119+
"referenceLocator": "pkg:pypi/prettytable@3.16.0",
120+
"referenceType": "purl"
121+
}
122+
],
123+
"filesAnalyzed": false,
124+
"licenseConcluded": "BSD-3-Clause",
125+
"licenseDeclared": "BSD-3-Clause",
126+
"name": "prettytable",
127+
"supplier": "Organization: https://pypi.org",
128+
"versionInfo": "3.16.0"
129+
},
130+
{
131+
"SPDXID": "SPDXRef-Package-python-requests",
132+
"checksums": [
133+
{
134+
"algorithm": "SHA256",
135+
"checksumValue": "27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"
136+
},
137+
{
138+
"algorithm": "MD5",
139+
"checksumValue": "4a380c14fe0f4465c9dbf79ffacefd8f"
140+
}
141+
],
142+
"copyrightText": "Copyright 2019 Kenneth Reitz. All rights reserved.",
143+
"downloadLocation": "https://files.pythonhosted.org/packages/e1/0a/929373653770d8a0d7ea76c37de6e41f11eb07559b103b1c02cafb3f7cf8/requests-2.32.4.tar.gz",
144+
"externalRefs": [
145+
{
146+
"referenceCategory": "PACKAGE_MANAGER",
147+
"referenceLocator": "pkg:pypi/requests@2.32.4",
148+
"referenceType": "purl"
149+
}
150+
],
151+
"filesAnalyzed": false,
152+
"licenseConcluded": "Apache-2.0",
153+
"licenseDeclared": "Apache-2.0",
154+
"name": "requests",
155+
"supplier": "Organization: https://pypi.org",
156+
"versionInfo": "2.32.4"
157+
},
158+
{
159+
"SPDXID": "SPDXRef-Package-python-spdx-tools",
160+
"checksums": [
161+
{
162+
"algorithm": "SHA256",
163+
"checksumValue": "68b8f9ce2893b5216bd90b2e63f1c821c2884e4ebc4fd295ebbf1fa8b8a94b93"
164+
},
165+
{
166+
"algorithm": "MD5",
167+
"checksumValue": "ebbd9ca439294df364a99e4f491fbbe8"
168+
}
169+
],
170+
"copyrightText": "2023 spdx contributors",
171+
"downloadLocation": "https://files.pythonhosted.org/packages/f1/99/3470b28dc4b64fd29db3b1dcf5e84c743ec88e25ea7b214794f5930f0319/spdx-tools-0.8.3.tar.gz",
172+
"externalRefs": [
173+
{
174+
"referenceCategory": "PACKAGE_MANAGER",
175+
"referenceLocator": "pkg:pypi/spdx-tools@0.8.3",
176+
"referenceType": "purl"
177+
}
178+
],
179+
"filesAnalyzed": false,
180+
"licenseConcluded": "Apache-2.0",
181+
"licenseDeclared": "Apache-2.0",
182+
"name": "spdx-tools",
183+
"supplier": "Organization: https://pypi.org",
184+
"versionInfo": "0.8.3"
185+
},
186+
{
187+
"SPDXID": "SPDXRef-Package-python-validators",
188+
"checksums": [
189+
{
190+
"algorithm": "SHA256",
191+
"checksumValue": "992d6c48a4e77c81f1b4daba10d16c3a9bb0dbb79b3a19ea847ff0928e70497a"
192+
},
193+
{
194+
"algorithm": "MD5",
195+
"checksumValue": "8376f37ec2028053cee8f4789dadd947"
196+
}
197+
],
198+
"copyrightText": "Copyright (c) 2013 - 2025 Konsta Vesterinen",
199+
"downloadLocation": "https://files.pythonhosted.org/packages/53/66/a435d9ae49850b2f071f7ebd8119dd4e84872b01630d6736761e6e7fd847/validators-0.35.0.tar.gz",
200+
"externalRefs": [
201+
{
202+
"referenceCategory": "PACKAGE_MANAGER",
203+
"referenceLocator": "pkg:pypi/validators@0.35.0",
204+
"referenceType": "purl"
205+
}
206+
],
207+
"filesAnalyzed": false,
208+
"licenseConcluded": "MIT",
209+
"licenseDeclared": "MIT",
210+
"name": "validators",
211+
"supplier": "Organization: https://pypi.org",
212+
"versionInfo": "0.35.0"
213+
}
214+
],
215+
"relationships": [
216+
{
217+
"spdxElementId": "SPDXRef-DOCUMENT",
218+
"relatedSpdxElement": "SPDXRef-openchain-telco-sbom-validator",
219+
"relationshipType": "DESCRIBES"
220+
},
221+
{
222+
"spdxElementId": "SPDXRef-openchain-telco-sbom-validator",
223+
"relatedSpdxElement": "SPDXRef-Package-python-ntia-conformance-checker",
224+
"relationshipType": "CONTAINS"
225+
},
226+
{
227+
"spdxElementId": "SPDXRef-openchain-telco-sbom-validator",
228+
"relatedSpdxElement": "SPDXRef-Package-python-packageurl-python",
229+
"relationshipType": "CONTAINS"
230+
},
231+
{
232+
"spdxElementId": "SPDXRef-openchain-telco-sbom-validator",
233+
"relatedSpdxElement": "SPDXRef-Package-python-prettytable",
234+
"relationshipType": "CONTAINS"
235+
},
236+
{
237+
"spdxElementId": "SPDXRef-openchain-telco-sbom-validator",
238+
"relatedSpdxElement": "SPDXRef-Package-python-requests",
239+
"relationshipType": "CONTAINS"
240+
},
241+
{
242+
"spdxElementId": "SPDXRef-openchain-telco-sbom-validator",
243+
"relatedSpdxElement": "SPDXRef-Package-python-spdx-tools",
244+
"relationshipType": "CONTAINS"
245+
},
246+
{
247+
"spdxElementId": "SPDXRef-openchain-telco-sbom-validator",
248+
"relatedSpdxElement": "SPDXRef-Package-python-validators",
249+
"relationshipType": "CONTAINS"
250+
}
251+
]
252+
}

0 commit comments

Comments
 (0)