Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-112302: Change 'licenseConcluded' field to 'NOASSERTION'#115038

Merged
hugovk merged 2 commits intopython:mainfrom
sethmlarson:sbom-license-concluded
Feb 6, 2024
Merged

gh-112302: Change 'licenseConcluded' field to 'NOASSERTION'#115038
hugovk merged 2 commits intopython:mainfrom
sethmlarson:sbom-license-concluded

Conversation

@sethmlarson
Copy link
Contributor

@sethmlarsonsethmlarson commentedFeb 5, 2024•
edited
Loading

Changes thelicenseConcluded field toNOASSERTION to signal that we are deliberately omitting licensing information from the SBOM for the following reasons:

  • CPython's licensing situation iscomplex and difficult to represent in absolute terms in an SBOM.
  • The CPython SBOM is primarily for security use-cases, and licensing information isn't necessary to fulfill this use-case (for example, licensing information isn't required by NTIA minimum elements).

@hugovk
Copy link
Member

Does the SBOM generation tool need updating to emit this?

@sethmlarson
Copy link
ContributorAuthor

@hugovk, yes it does for pip specifically, thank you.

@sethmlarson
Copy link
ContributorAuthor

@hugovk Fixed that ind451a50

Copy link
Member

@hugovkhugovk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Thanks!

@bedevere-bot
Copy link

⚠️⚠️⚠️ Buildbot failure⚠️⚠️⚠️

Hi! The buildbotAMD64 FreeBSD14 3.x has failed when building commit4bf4187.

What do you need to do:

  1. Don't panic.
  2. Checkthe buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/1232/builds/1261) and take a look at the build logs.
  4. Check if the failure is related to this commit (4bf4187) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/1232/builds/1261

Failed tests:

  • test.test_multiprocessing_spawn.test_processes

Summary of the results of the build (if available):

==

Click to see traceback logs
remote:Enumerating objects: 13, done.remote:Counting objects:   7% (1/13)remote:Counting objects:  15% (2/13)remote:Counting objects:  23% (3/13)remote:Counting objects:  30% (4/13)remote:Counting objects:  38% (5/13)remote:Counting objects:  46% (6/13)remote:Counting objects:  53% (7/13)remote:Counting objects:  61% (8/13)remote:Counting objects:  69% (9/13)remote:Counting objects:  76% (10/13)remote:Counting objects:  84% (11/13)remote:Counting objects:  92% (12/13)remote:Counting objects: 100% (13/13)remote:Counting objects: 100% (13/13), done.remote:Compressing objects:  14% (1/7)remote:Compressing objects:  28% (2/7)remote:Compressing objects:  42% (3/7)remote:Compressing objects:  57% (4/7)remote:Compressing objects:  71% (5/7)remote:Compressing objects:  85% (6/7)remote:Compressing objects: 100% (7/7)remote:Compressing objects: 100% (7/7), done.remote:Total 7 (delta 6), reused 0 (delta 0), pack-reused 0From https://github.com/python/cpython * branch                  main       -> FETCH_HEADNote:switching to '4bf41879d03b1da3c6d38c39a04331e3ae2e7545'.You are in 'detached HEAD' state. You can look around, make experimentalchanges and commit them, and you can discard any commits you make in thisstate without impacting any branches by switching back to a branch.If you want to create a new branch to retain commits you create, you maydo so (now or later) by using -c with the switch command. Example:  git switch -c <new-branch-name>Or undo this operation with:  git switch -Turn off this advice by setting config variable advice.detachedHead to falseHEAD is now at 4bf41879d0 gh-112302: Change 'licenseConcluded' field to 'NOASSERTION' (#115038)Switched to and reset branch 'main'configure:WARNING: pkg-config is missing. Some dependencies may not be detected correctly.

@sethmlarsonsethmlarson deleted the sbom-license-concluded branchFebruary 6, 2024 13:50
@sethmlarsonsethmlarson added the needs backport to 3.12only security fixes labelFeb 6, 2024
@miss-islington-app
Copy link

Thanks@sethmlarson for the PR, and@hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestFeb 6, 2024
…thonGH-115038)(cherry picked from commit4bf4187)Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

GH-115088 is a backport of this pull request to the3.12 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.12only security fixes labelFeb 6, 2024
Yhg1s pushed a commit that referenced this pull requestFeb 6, 2024
…H-115038) (#115088)*gh-112302: Change 'licenseConcluded' field to 'NOASSERTION' (GH-115038)(cherry picked from commit4bf4187)Co-authored-by: Seth Michael Larson <seth@python.org>* Update pip SBOM package to version in source---------Co-authored-by: Seth Michael Larson <seth@python.org>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@hugovkhugovkhugovk approved these changes

Assignees

No one assigned

Labels

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sethmlarson@hugovk@bedevere-bot

Comments

[8]ページ先頭
©2009-2026 Movatter.jp