Skip to content

Commit b56f86a

Browse files
rnjudgernjudge
committed
Prepare for Release 2.7.0
- Added release notes and freeze file - Bumped the dependency versions - Updated the README with the new Release number - Updated project roadmap Signed-off-by: Rose Judge <[email protected]>
1 parent 273e3c8 commit b56f86a

File tree

5 files changed

+220
-7
lines changed

5 files changed

+220
-7
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -311,12 +311,13 @@ $ python tests/<test file>.py
311311
```
312312

313313
## Project Status<a name="project-status"/>
314-
Release 2.6.1 is out! See the [release notes](docs/releases/v2_6_1.md) for more information.
314+
Release 2.7.0 is out! See the [release notes](docs/releases/v2_7_0.md) for more information.
315315

316-
We try to keep the [project roadmap](./docs/project-roadmap.md) as up to date as possible. We are currently working on Release 2.7.0.
316+
We try to keep the [project roadmap](./docs/project-roadmap.md) as up to date as possible. We are currently working on Release 2.8.0.
317317

318318
## Previous Releases
319319
Be advised: version 2.4.0 and below contain a high-severity security vulnerability (CVE-2021-28363). Please update to version 2.5.0 or later.
320+
* [v2.6.1](docs/releases/v2_6_1.md)
320321
* [v2.5.0](docs/releases/v2_5_0.md)
321322
* [v2.4.0](docs/releases/v2_4_0.md)
322323
* [v2.3.0](docs/releases/v2_3_0.md)

‎docs/project-roadmap.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
# Project Road Map
22

33
## 2021
4-
We are getting very close to a beta release. Our beta release is targeted for the summer timeframe.
4+
We are getting very close to a beta release. Our beta release is targeted for the second half of the year.
55

66
Our goal is to meet these requirements by the end of the year.
77
- We will continue investigating how we can run Tern without root privileges.
88
- We want to transition away from using the Docker Python library to pull container images from Dockerhub. For motivation and context, see the Kubernetes [announcement](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/) and past [discussion](https://github.com/tern-tools/meetings/blob/main/minutes/04-13-2021.md) on the topic from Tern's community meeting.
99
- Create a database backend with an associated API.
10-
- Improve coverage of Tern's CI/CD pipeline.
10+
- Automate aspects of Tern's release process.
1111

1212

1313
We will also continue to work on the following:

‎docs/releases/v2_7_0-requirements.txt

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
#
2+
# This file is autogenerated by pip-compile with python 3.8
3+
# To update, run:
4+
#
5+
# pip-compile --generate-hashes --output-file=v2_7_0-requirements.txt
6+
#
7+
attrs==21.2.0 \
8+
--hash=sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1 \
9+
--hash=sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb
10+
# via debian-inspector
11+
certifi==2021.5.30 \
12+
--hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee \
13+
--hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8
14+
# via requests
15+
chardet==4.0.0 \
16+
--hash=sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa \
17+
--hash=sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5
18+
# via
19+
# debian-inspector
20+
# requests
21+
debian-inspector==21.5.25 \
22+
--hash=sha256:5c619eaeb2ebb4b7010eda15141cf6738db3b0171527316d415b4d0038567db4 \
23+
--hash=sha256:d5f5542e584e5f218903e14333112326e295a07bfb4e8cdfcdd2a51482610a4e
24+
# via -r requirements.in
25+
docker==5.0.0 \
26+
--hash=sha256:3e8bc47534e0ca9331d72c32f2881bb13b93ded0bcdeab3c833fb7cf61c0a9a5 \
27+
--hash=sha256:fc961d622160e8021c10d1bcabc388c57d55fb1f917175afbe24af442e6879bd
28+
# via -r requirements.in
29+
dockerfile-parse==1.2.0 \
30+
--hash=sha256:07e65eec313978e877da819855870b3ae47f3fac94a40a965b9ede10484dacc5 \
31+
--hash=sha256:c3fc8f491e1af8cb5f9e23ea6437a2913467b88a4be143095f150330b090be7e
32+
# via -r requirements.in
33+
gitdb==4.0.7 \
34+
--hash=sha256:6c4cc71933456991da20917998acbe6cf4fb41eeaab7d6d67fbc05ecd4c865b0 \
35+
--hash=sha256:96bf5c08b157a666fec41129e6d327235284cca4c81e92109260f353ba138005
36+
# via gitpython
37+
gitpython==3.1.18 \
38+
--hash=sha256:b838a895977b45ab6f0cc926a9045c8d1c44e2b653c1fcc39fe91f42c6e8f05b \
39+
--hash=sha256:fce760879cd2aebd2991b3542876dc5c4a909b30c9d69dfc488e504a8db37ee8
40+
# via -r requirements.in
41+
idna==2.10 \
42+
--hash=sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6 \
43+
--hash=sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0
44+
# via requests
45+
pbr==5.6.0 \
46+
--hash=sha256:42df03e7797b796625b1029c0400279c7c34fd7df24a7d7818a1abb5b38710dd \
47+
--hash=sha256:c68c661ac5cc81058ac94247278eeda6d2e6aecb3e227b0387c30d277e7ef8d4
48+
# via
49+
# -r requirements.in
50+
# stevedore
51+
prettytable==2.1.0 \
52+
--hash=sha256:5882ed9092b391bb8f6e91f59bcdbd748924ff556bb7c634089d5519be87baa0 \
53+
--hash=sha256:bb5abc72bdfae6f3cdadb04fb7726f6915af0ddb7c897a41d4ad7736d9bfd8fd
54+
# via -r requirements.in
55+
pyyaml==5.4.1 \
56+
--hash=sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf \
57+
--hash=sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696 \
58+
--hash=sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393 \
59+
--hash=sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77 \
60+
--hash=sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922 \
61+
--hash=sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5 \
62+
--hash=sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8 \
63+
--hash=sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10 \
64+
--hash=sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc \
65+
--hash=sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018 \
66+
--hash=sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e \
67+
--hash=sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253 \
68+
--hash=sha256:72a01f726a9c7851ca9bfad6fd09ca4e090a023c00945ea05ba1638c09dc3347 \
69+
--hash=sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183 \
70+
--hash=sha256:895f61ef02e8fed38159bb70f7e100e00f471eae2bc838cd0f4ebb21e28f8541 \
71+
--hash=sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb \
72+
--hash=sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185 \
73+
--hash=sha256:bfb51918d4ff3d77c1c856a9699f8492c612cde32fd3bcd344af9be34999bfdc \
74+
--hash=sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db \
75+
--hash=sha256:cb333c16912324fd5f769fff6bc5de372e9e7a202247b48870bc251ed40239aa \
76+
--hash=sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46 \
77+
--hash=sha256:d483ad4e639292c90170eb6f7783ad19490e7a8defb3e46f97dfe4bacae89122 \
78+
--hash=sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b \
79+
--hash=sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63 \
80+
--hash=sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df \
81+
--hash=sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc \
82+
--hash=sha256:fd7f6999a8070df521b6384004ef42833b9bd62cfee11a09bda1079b4b704247 \
83+
--hash=sha256:fdc842473cd33f45ff6bce46aea678a54e3d21f1b61a7750ce3c498eedfe25d6 \
84+
--hash=sha256:fe69978f3f768926cfa37b867e3843918e012cf83f680806599ddce33c2c68b0
85+
# via -r requirements.in
86+
regex==2021.7.6 \
87+
--hash=sha256:0eb2c6e0fcec5e0f1d3bcc1133556563222a2ffd2211945d7b1480c1b1a42a6f \
88+
--hash=sha256:15dddb19823f5147e7517bb12635b3c82e6f2a3a6b696cc3e321522e8b9308ad \
89+
--hash=sha256:173bc44ff95bc1e96398c38f3629d86fa72e539c79900283afa895694229fe6a \
90+
--hash=sha256:1c78780bf46d620ff4fff40728f98b8afd8b8e35c3efd638c7df67be2d5cddbf \
91+
--hash=sha256:2366fe0479ca0e9afa534174faa2beae87847d208d457d200183f28c74eaea59 \
92+
--hash=sha256:2bceeb491b38225b1fee4517107b8491ba54fba77cf22a12e996d96a3c55613d \
93+
--hash=sha256:2ddeabc7652024803666ea09f32dd1ed40a0579b6fbb2a213eba590683025895 \
94+
--hash=sha256:2fe5e71e11a54e3355fa272137d521a40aace5d937d08b494bed4529964c19c4 \
95+
--hash=sha256:319eb2a8d0888fa6f1d9177705f341bc9455a2c8aca130016e52c7fe8d6c37a3 \
96+
--hash=sha256:3f5716923d3d0bfb27048242a6e0f14eecdb2e2a7fac47eda1d055288595f222 \
97+
--hash=sha256:422dec1e7cbb2efbbe50e3f1de36b82906def93ed48da12d1714cabcd993d7f0 \
98+
--hash=sha256:4c9c3155fe74269f61e27617529b7f09552fbb12e44b1189cebbdb24294e6e1c \
99+
--hash=sha256:4f64fc59fd5b10557f6cd0937e1597af022ad9b27d454e182485f1db3008f417 \
100+
--hash=sha256:564a4c8a29435d1f2256ba247a0315325ea63335508ad8ed938a4f14c4116a5d \
101+
--hash=sha256:59506c6e8bd9306cd8a41511e32d16d5d1194110b8cfe5a11d102d8b63cf945d \
102+
--hash=sha256:598c0a79b4b851b922f504f9f39a863d83ebdfff787261a5ed061c21e67dd761 \
103+
--hash=sha256:59c00bb8dd8775473cbfb967925ad2c3ecc8886b3b2d0c90a8e2707e06c743f0 \
104+
--hash=sha256:6110bab7eab6566492618540c70edd4d2a18f40ca1d51d704f1d81c52d245026 \
105+
--hash=sha256:6afe6a627888c9a6cfbb603d1d017ce204cebd589d66e0703309b8048c3b0854 \
106+
--hash=sha256:791aa1b300e5b6e5d597c37c346fb4d66422178566bbb426dd87eaae475053fb \
107+
--hash=sha256:8394e266005f2d8c6f0bc6780001f7afa3ef81a7a2111fa35058ded6fce79e4d \
108+
--hash=sha256:875c355360d0f8d3d827e462b29ea7682bf52327d500a4f837e934e9e4656068 \
109+
--hash=sha256:89e5528803566af4df368df2d6f503c84fbfb8249e6631c7b025fe23e6bd0cde \
110+
--hash=sha256:99d8ab206a5270c1002bfcf25c51bf329ca951e5a169f3b43214fdda1f0b5f0d \
111+
--hash=sha256:9a854b916806c7e3b40e6616ac9e85d3cdb7649d9e6590653deb5b341a736cec \
112+
--hash=sha256:b85ac458354165405c8a84725de7bbd07b00d9f72c31a60ffbf96bb38d3e25fa \
113+
--hash=sha256:bc84fb254a875a9f66616ed4538542fb7965db6356f3df571d783f7c8d256edd \
114+
--hash=sha256:c92831dac113a6e0ab28bc98f33781383fe294df1a2c3dfd1e850114da35fd5b \
115+
--hash=sha256:cbe23b323988a04c3e5b0c387fe3f8f363bf06c0680daf775875d979e376bd26 \
116+
--hash=sha256:ccb3d2190476d00414aab36cca453e4596e8f70a206e2aa8db3d495a109153d2 \
117+
--hash=sha256:d8bbce0c96462dbceaa7ac4a7dfbbee92745b801b24bce10a98d2f2b1ea9432f \
118+
--hash=sha256:db2b7df831c3187a37f3bb80ec095f249fa276dbe09abd3d35297fc250385694 \
119+
--hash=sha256:e586f448df2bbc37dfadccdb7ccd125c62b4348cb90c10840d695592aa1b29e0 \
120+
--hash=sha256:e5983c19d0beb6af88cb4d47afb92d96751fb3fa1784d8785b1cdf14c6519407 \
121+
--hash=sha256:e6a1e5ca97d411a461041d057348e578dc344ecd2add3555aedba3b408c9f874 \
122+
--hash=sha256:eaf58b9e30e0e546cdc3ac06cf9165a1ca5b3de8221e9df679416ca667972035 \
123+
--hash=sha256:ed693137a9187052fc46eedfafdcb74e09917166362af4cc4fddc3b31560e93d \
124+
--hash=sha256:edd1a68f79b89b0c57339bce297ad5d5ffcc6ae7e1afdb10f1947706ed066c9c \
125+
--hash=sha256:f080248b3e029d052bf74a897b9d74cfb7643537fbde97fe8225a6467fb559b5 \
126+
--hash=sha256:f9392a4555f3e4cb45310a65b403d86b589adc773898c25a39184b1ba4db8985 \
127+
--hash=sha256:f98dc35ab9a749276f1a4a38ab3e0e2ba1662ce710f6530f5b0a6656f1c32b58
128+
# via -r requirements.in
129+
requests==2.25.1 \
130+
--hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804 \
131+
--hash=sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e
132+
# via
133+
# -r requirements.in
134+
# docker
135+
six==1.16.0 \
136+
--hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
137+
--hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
138+
# via dockerfile-parse
139+
smmap==4.0.0 \
140+
--hash=sha256:7e65386bd122d45405ddf795637b7f7d2b532e7e401d46bbe3fb49b9986d5182 \
141+
--hash=sha256:a9a7479e4c572e2e775c404dcd3080c8dc49f39918c2cf74913d30c4c478e3c2
142+
# via gitdb
143+
stevedore==3.3.0 \
144+
--hash=sha256:3a5bbd0652bf552748871eaa73a4a8dc2899786bc497a2aa1fcb4dcdb0debeee \
145+
--hash=sha256:50d7b78fbaf0d04cd62411188fa7eedcb03eb7f4c4b37005615ceebe582aa82a
146+
# via -r requirements.in
147+
urllib3==1.26.6 \
148+
--hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \
149+
--hash=sha256:f57b4c16c62fa2760b7e3d97c35b255512fb6b59a259730f36ba32ce9f8e342f
150+
# via requests
151+
wcwidth==0.2.5 \
152+
--hash=sha256:beb4802a9cebb9144e99086eff703a642a13d6a0052920003a230f3294bbe784 \
153+
--hash=sha256:c4d647b99872929fdb7bdcaa4fbe7f01413ed3d98077df798530e5b04f116c83
154+
# via prettytable
155+
websocket-client==1.1.0 \
156+
--hash=sha256:b68e4959d704768fa20e35c9d508c8dc2bbc041fd8d267c0d7345cffe2824568 \
157+
--hash=sha256:e5c333bfa9fa739538b652b6f8c8fc2559f1d364243c8a689d7c0e1d41c2e611
158+
# via docker

‎docs/releases/v2_7_0.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Release 2.7.0
2+
3+
## Summary
4+
This is a smaller release in terms of commits but still manages to introduce three new features and a few bug fixes. Namely, the `dockerfile lock` functionality now works for multistage Dockerfiles. We also added a complementary feature to the `--live` functionality that can take in one or more layer SBOMs and reason about them in context with the current layer during a `--live` Tern run. Currently, this feature only works for Tern-produced JSON formatted SBOMs. Lastly, the package type was added to the default report which indicates to the user the method of metadata collection that was used for the layer. A bug was also fixed that should enable the Tern + Scancode execution path to run without error when collecting package metadata.
5+
6+
## New Features
7+
* [Enable Dockerfile "locking" for multistage builds](https://github.com/tern-tools/tern/issues/969): Tern's `dockerfile lock` command now works for multistage Dockerfiles.
8+
* [Add functionality for consuming JSON reports](https://github.com/tern-tools/tern/issues/946): This feature introduces the CLI argument `--with-context` or `-ctx` which takes a list of reports that can provide previous context for container builds. This argument is meant to be used with the `--live` option to input reports from previous runs.
9+
* [Show package type in default report](https://github.com/tern-tools/tern/issues/984): This feature updates the default report to include the package type in the report (i.e. deb, rpm, etc). This might be helpful for users who want to look for source code for the package or those who simply want to know what package manger was used to collect the information outputted in the report.
10+
11+
## Bug Fixes
12+
* [Error getting package licenses with Scancode](https://github.com/tern-tools/tern/issues/985)
13+
* [Can't generate html output when running Scancode](https://github.com/tern-tools/tern/issues/844)
14+
* [Fix live execution if no previous SBOMs are given](https://github.com/tern-tools/tern/commit/273e3c8cd8969df3dacc56c5d878d65378d8e4bf)
15+
16+
## Future Work
17+
* Use skopeo to pull container images
18+
* Automate parts of the release process
19+
* Investigation for potential support of CycleDX BOM format
20+
* Add functionality for consuming SPDX JSON reports
21+
22+
## Changelog
23+
Note: This changelog will not include these release notes
24+
25+
Changelog generated by command: `git log --pretty=format:"%h %s" v2.6.1..main`
26+
27+
```
28+
273e3c8 Fix live execution if no previous sboms are given
29+
20573c4 Fix Scancode collection of package licenses
30+
b8e7837 Show package type in default report
31+
e62a6c1 Bump debian-inspector version
32+
81f441c Make "tern lock" work for multistage docker file
33+
8ae40cc Fix prereqs.fs_shell variable naming
34+
383905a Introduce JSON consumer
35+
2d295cf Fix diffing of packages in layers
36+
fce138b Connect machinery to ingest previous reports
37+
1e167fa main: Add command line arg for consuming reports
38+
ccec6cd Install scancode in /install
39+
95acf0a Install scancode with fixed dependencies
40+
0c46292 formats: Add layer level JSON consumer
41+
837f3aa formats: Add consumer abstract base class
42+
```
43+
44+
## Contributors
45+
```
46+
Jeroen Knoops [email protected]
47+
Mukul Taneja [email protected]
48+
```
49+
50+
## Contact the Maintainers
51+
52+
Nisha Kumar: [email protected]
53+
Rose Judge: [email protected]
54+

‎requirements.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2017-2020 VMware, Inc. All Rights Reserved.
1+
# Copyright (c) 2017-2021 VMware, Inc. All Rights Reserved.
22
# SPDX-License-Identifier: BSD-2-Clause
33
#
44
# Please only add direct dependencies here, i.e., do not update with the
@@ -8,11 +8,11 @@
88

99
PyYAML>=5.4
1010
docker~=5.0
11-
dockerfile-parse~=1.1
11+
dockerfile-parse~=1.2
1212
requests~=2.25
1313
stevedore>=3.3
1414
pbr>=5.6
1515
debian-inspector>=21.5
16-
regex>=2021.4
16+
regex>=2021.7
1717
GitPython~=3.1
1818
prettytable~=2.1

0 commit comments

Comments
 (0)