cyclonedx.model.bom

Module Contents

Classes

TlpClassification	Enum object that defines the Traffic Light Protocol (TLP) classification that controls the sharing and distribution
DistributionConstraints	Our internal representation of the distributionConstraints complex type.
BomMetaData	This is our internal representation of the metadata complex type within the CycloneDX standard.
Bom	This is our internal representation of a bill-of-materials (BOM).

class cyclonedx.model.bom.TlpClassification

Bases: str, enum.Enum

Enum object that defines the Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes.

Note

Introduced in CycloneDX v1.7

Note

See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_tlpClassificationType

CLEAR = 'CLEAR'

GREEN = 'GREEN'

AMBER = 'AMBER'

AMBER_AND_STRICT = 'AMBER_AND_STRICT'

RED = 'RED'

capitalize()

Return a capitalized version of the string.

More specifically, make the first character have upper case and the rest lower case.

casefold()

Return a version of the string suitable for caseless comparisons.

center()

Return a centered string of length width.

Padding is done using the specified fill character (default is a space).

count()

S.count(sub[, start[, end]]) -> int

Return the number of non-overlapping occurrences of substring sub in string S[start:end]. Optional arguments start and end are interpreted as in slice notation.

encode()

Encode the string using the codec registered for encoding.

encoding

The encoding in which to encode the string.

errors

The error handling scheme to use for encoding errors. The default is ‘strict’ meaning that encoding errors raise a UnicodeEncodeError. Other possible values are ‘ignore’, ‘replace’ and ‘xmlcharrefreplace’ as well as any other name registered with codecs.register_error that can handle UnicodeEncodeErrors.

endswith()

S.endswith(suffix[, start[, end]]) -> bool

Return True if S ends with the specified suffix, False otherwise. With optional start, test S beginning at that position. With optional end, stop comparing S at that position. suffix can also be a tuple of strings to try.

expandtabs()

Return a copy where all tab characters are expanded using spaces.

If tabsize is not given, a tab size of 8 characters is assumed.

find()

S.find(sub[, start[, end]]) -> int

Return the lowest index in S where substring sub is found, such that sub is contained within S[start:end]. Optional arguments start and end are interpreted as in slice notation.

Return -1 on failure.

format()

S.format(*args, **kwargs) -> str

Return a formatted version of S, using substitutions from args and kwargs. The substitutions are identified by braces (‘{’ and ‘}’).

format_map()

S.format_map(mapping) -> str

Return a formatted version of S, using substitutions from mapping. The substitutions are identified by braces (‘{’ and ‘}’).

index()

S.index(sub[, start[, end]]) -> int

Return the lowest index in S where substring sub is found, such that sub is contained within S[start:end]. Optional arguments start and end are interpreted as in slice notation.

Raises ValueError when the substring is not found.

isalnum()

Return True if the string is an alpha-numeric string, False otherwise.

A string is alpha-numeric if all characters in the string are alpha-numeric and there is at least one character in the string.

isalpha()

Return True if the string is an alphabetic string, False otherwise.

A string is alphabetic if all characters in the string are alphabetic and there is at least one character in the string.

isascii()

Return True if all characters in the string are ASCII, False otherwise.

ASCII characters have code points in the range U+0000-U+007F. Empty string is ASCII too.

isdecimal()

Return True if the string is a decimal string, False otherwise.

A string is a decimal string if all characters in the string are decimal and there is at least one character in the string.

isdigit()

Return True if the string is a digit string, False otherwise.

A string is a digit string if all characters in the string are digits and there is at least one character in the string.

isidentifier()

Return True if the string is a valid Python identifier, False otherwise.

Call keyword.iskeyword(s) to test whether string s is a reserved identifier, such as “def” or “class”.

islower()

Return True if the string is a lowercase string, False otherwise.

A string is lowercase if all cased characters in the string are lowercase and there is at least one cased character in the string.

isnumeric()

Return True if the string is a numeric string, False otherwise.

A string is numeric if all characters in the string are numeric and there is at least one character in the string.

isprintable()

Return True if the string is printable, False otherwise.

A string is printable if all of its characters are considered printable in repr() or if it is empty.

isspace()

Return True if the string is a whitespace string, False otherwise.

A string is whitespace if all characters in the string are whitespace and there is at least one character in the string.

istitle()

Return True if the string is a title-cased string, False otherwise.

In a title-cased string, upper- and title-case characters may only follow uncased characters and lowercase characters only cased ones.

isupper()

Return True if the string is an uppercase string, False otherwise.

A string is uppercase if all cased characters in the string are uppercase and there is at least one cased character in the string.

join()

Concatenate any number of strings.

The string whose method is called is inserted in between each given string. The result is returned as a new string.

Example: ‘.’.join([‘ab’, ‘pq’, ‘rs’]) -> ‘ab.pq.rs’

ljust()

Return a left-justified string of length width.

Padding is done using the specified fill character (default is a space).

lower()

Return a copy of the string converted to lowercase.

lstrip()

Return a copy of the string with leading whitespace removed.

If chars is given and not None, remove characters in chars instead.

partition()

Partition the string into three parts using the given separator.

This will search for the separator in the string. If the separator is found, returns a 3-tuple containing the part before the separator, the separator itself, and the part after it.

If the separator is not found, returns a 3-tuple containing the original string and two empty strings.

removeprefix()

Return a str with the given prefix string removed if present.

If the string starts with the prefix string, return string[len(prefix):]. Otherwise, return a copy of the original string.

removesuffix()

Return a str with the given suffix string removed if present.

If the string ends with the suffix string and that suffix is not empty, return string[:-len(suffix)]. Otherwise, return a copy of the original string.

replace()

Return a copy with all occurrences of substring old replaced by new.

count

Maximum number of occurrences to replace. -1 (the default value) means replace all occurrences.

If the optional argument count is given, only the first count occurrences are replaced.

rfind()

S.rfind(sub[, start[, end]]) -> int

Return the highest index in S where substring sub is found, such that sub is contained within S[start:end]. Optional arguments start and end are interpreted as in slice notation.

Return -1 on failure.

rindex()

S.rindex(sub[, start[, end]]) -> int

Return the highest index in S where substring sub is found, such that sub is contained within S[start:end]. Optional arguments start and end are interpreted as in slice notation.

Raises ValueError when the substring is not found.

rjust()

Return a right-justified string of length width.

Padding is done using the specified fill character (default is a space).

rpartition()

Partition the string into three parts using the given separator.

This will search for the separator in the string, starting at the end. If the separator is found, returns a 3-tuple containing the part before the separator, the separator itself, and the part after it.

If the separator is not found, returns a 3-tuple containing two empty strings and the original string.

rsplit()

Return a list of the substrings in the string, using sep as the separator string.

sep

The separator used to split the string.

When set to None (the default value), will split on any whitespace character (including n r t f and spaces) and will discard empty strings from the result.

maxsplit

Maximum number of splits. -1 (the default value) means no limit.

Splitting starts at the end of the string and works to the front.

rstrip()

Return a copy of the string with trailing whitespace removed.

If chars is given and not None, remove characters in chars instead.

split()

Return a list of the substrings in the string, using sep as the separator string.

sep

The separator used to split the string.

When set to None (the default value), will split on any whitespace character (including n r t f and spaces) and will discard empty strings from the result.

maxsplit

Maximum number of splits. -1 (the default value) means no limit.

Splitting starts at the front of the string and works to the end.

Note, str.split() is mainly useful for data that has been intentionally delimited. With natural text that includes punctuation, consider using the regular expression module.

splitlines()

Return a list of the lines in the string, breaking at line boundaries.

Line breaks are not included in the resulting list unless keepends is given and true.

startswith()

S.startswith(prefix[, start[, end]]) -> bool

Return True if S starts with the specified prefix, False otherwise. With optional start, test S beginning at that position. With optional end, stop comparing S at that position. prefix can also be a tuple of strings to try.

strip()

Return a copy of the string with leading and trailing whitespace removed.

If chars is given and not None, remove characters in chars instead.

swapcase()

Convert uppercase characters to lowercase and lowercase characters to uppercase.

title()

Return a version of the string where each word is titlecased.

More specifically, words start with uppercased characters and all remaining cased characters have lower case.

translate()

Replace each character in the string using the given translation table.

table

Translation table, which must be a mapping of Unicode ordinals to Unicode ordinals, strings, or None.

The table must implement lookup/indexing via __getitem__, for instance a dictionary or list. If this operation raises LookupError, the character is left untouched. Characters mapped to None are deleted.

upper()

Return a copy of the string converted to uppercase.

zfill()

Pad a numeric string with zeros on the left, to fill a field of the given width.

The string is never truncated.

name()

The name of the Enum member.

value()

The value of the Enum member.

class cyclonedx.model.bom.DistributionConstraints(*, tlp: TlpClassification | None = None)

Our internal representation of the distributionConstraints complex type. Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.

Note

Introduced in CycloneDX v1.7

Note

See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_metadata

property tlp: TlpClassification

The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes.

Returns:

TlpClassification enum value

class cyclonedx.model.bom.BomMetaData(*, tools: collections.abc.Iterable[cyclonedx.model.tool.Tool] | cyclonedx.model.tool.ToolRepository | None = None, authors: collections.abc.Iterable[cyclonedx.model.contact.OrganizationalContact] | None = None, component: cyclonedx.model.component.Component | None = None, supplier: cyclonedx.model.contact.OrganizationalEntity | None = None, licenses: collections.abc.Iterable[cyclonedx.model.license.License] | None = None, properties: collections.abc.Iterable[cyclonedx.model.Property] | None = None, timestamp: datetime.datetime | None = None, manufacturer: cyclonedx.model.contact.OrganizationalEntity | None = None, lifecycles: collections.abc.Iterable[cyclonedx.model.lifecycle.Lifecycle] | None = None, distribution_constraints: DistributionConstraints | None = None, manufacture: cyclonedx.model.contact.OrganizationalEntity | None = None)

This is our internal representation of the metadata complex type within the CycloneDX standard.

Note

See the CycloneDX Schema for Bom metadata: https://cyclonedx.org/docs/1.7/xml/#type_metadata

property timestamp: datetime.datetime

The date and time (in UTC) when this BomMetaData was created.

Returns:

datetime instance in UTC timezone

property lifecycles: cyclonedx.model.lifecycle.LifecycleRepository

An optional list of BOM lifecycle stages.

Returns:

Set of Lifecycle

property tools: cyclonedx.model.tool.ToolRepository

Tools used to create this BOM.

Returns:

ToolRepository object.

property authors: SortedSet[OrganizationalContact]

The person(s) who created the BOM.

Authors are common in BOMs created through manual processes.

BOMs created through automated means may not have authors.

Returns:

Set of OrganizationalContact

property component: cyclonedx.model.component.Component | None

The (optional) component that the BOM describes.

Returns:

cyclonedx.model.component.Component instance for this Bom Metadata.

property manufacture: cyclonedx.model.contact.OrganizationalEntity | None

The organization that manufactured the component that the BOM describes.

Returns:

OrganizationalEntity if set else None

property manufacturer: cyclonedx.model.contact.OrganizationalEntity | None

The organization that created the BOM. Manufacturer is common in BOMs created through automated processes. BOMs created through manual means may have @.authors instead.

Returns:

OrganizationalEntity if set else None

property supplier: cyclonedx.model.contact.OrganizationalEntity | None

The organization that supplied the component that the BOM describes.

The supplier may often be the manufacturer, but may also be a distributor or repackager.

Returns:

OrganizationalEntity if set else None

property licenses: cyclonedx.model.license.LicenseRepository

A optional list of statements about how this BOM is licensed.

Returns:

Set of LicenseChoice

property properties: SortedSet[Property]

Provides the ability to document properties in a key/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions.

Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is OPTIONAL.

Return:

Set of Property

property distribution_constraints: DistributionConstraints | None

Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.

Returns:

DistributionConstraints or None

class cyclonedx.model.bom.Bom(*, components: collections.abc.Iterable[cyclonedx.model.component.Component] | None = None, services: collections.abc.Iterable[cyclonedx.model.service.Service] | None = None, external_references: collections.abc.Iterable[cyclonedx.model.ExternalReference] | None = None, serial_number: uuid.UUID | None = None, version: int = 1, metadata: BomMetaData | None = None, dependencies: collections.abc.Iterable[cyclonedx.model.dependency.Dependency] | None = None, vulnerabilities: collections.abc.Iterable[cyclonedx.model.vulnerability.Vulnerability] | None = None, properties: collections.abc.Iterable[cyclonedx.model.Property] | None = None, definitions: cyclonedx.model.definition.Definitions | None = None)

This is our internal representation of a bill-of-materials (BOM).

Once you have an instance of cyclonedx.model.bom.Bom, you can pass this to an instance of cyclonedx.output.BaseOutput to produce a CycloneDX document according to a specific schema version and format.

property serial_number: uuid.UUID

Unique UUID for this BOM

Returns:

UUID instance UUID instance

property version: int

property metadata: BomMetaData

Get our internal metadata object for this Bom.

Returns:

Metadata object instance for this Bom.

Note

See the CycloneDX Schema for Bom metadata: https://cyclonedx.org/docs/1.7/xml/#type_metadata

property components: SortedSet[Component]

Get all the Components currently in this Bom.

Returns:

Set of Component in this Bom

property services: SortedSet[Service]

Get all the Services currently in this Bom.

Returns:

Set of Service in this BOM

property external_references: SortedSet[ExternalReference]

Provides the ability to document external references related to the BOM or to the project the BOM describes.

Returns:

Set of ExternalReference

property dependencies: SortedSet[Dependency]

property properties: SortedSet[Property]

Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is OPTIONAL.

Return:

Set of Property

property vulnerabilities: SortedSet[Vulnerability]

Get all the Vulnerabilities in this BOM.

Returns:

Set of Vulnerability

property definitions: cyclonedx.model.definition.Definitions | None

The repository for definitions

Returns:

Definitions

get_component_by_purl(purl: packageurl.PackageURL | None) → cyclonedx.model.component.Component | None

Get a Component already in the Bom by its PURL

Args:

purl:

An instance of packageurl.PackageURL to look and find Component.

Returns:

Component or None

Deprecated since version next.

get_urn_uuid() → str

Get the unique reference for this Bom.

Returns:

URN formatted UUID that uniquely identified this Bom instance.

Deprecated since version next.

has_component(component: cyclonedx.model.component.Component) → bool

Check whether this Bom contains the provided Component.

Args:

component:

The instance of cyclonedx.model.component.Component to check if this Bom contains.

Returns:

bool - True if the supplied Component is part of this Bom, False otherwise.

Deprecated since version next.

get_vulnerabilities_for_bom_ref(bom_ref: cyclonedx.model.bom_ref.BomRef) → SortedSet[Vulnerability]

Get all known Vulnerabilities that affect the supplied bom_ref.

Args:

bom_ref: BomRef

Returns:

SortedSet of Vulnerability

Deprecated since version next: Deprecated without any replacement.

has_vulnerabilities() → bool

Check whether this Bom has any declared vulnerabilities.

Returns:

bool - True if this Bom has at least one Vulnerability, False otherwise.

Deprecated since version next: Deprecated without any replacement.

register_dependency(target: cyclonedx.model.dependency.Dependable, depends_on: collections.abc.Iterable[cyclonedx.model.dependency.Dependable] | None = None) → None

urn() → str

Deprecated since version next: Deprecated without any replacement.

validate() → bool

Perform data-model level validations to make sure we have some known data integrity prior to attempting output of this Bom

Returns:

bool

Deprecated since version next: Deprecated without any replacement.