Skip to content

Commit 42a779f

Browse files
stacknilstacknil
committed
Normalize v0.3.0 release files for CI
1 parent 6fb90f5 commit 42a779f

15 files changed

Lines changed: 4589 additions & 4589 deletions

‎tools/sbom-diff-and-risk/examples/sample-policy-fail-report.json‎

Lines changed: 658 additions & 658 deletions
Large diffs are not rendered by default.

‎tools/sbom-diff-and-risk/examples/sample-policy-fail-report.md‎

Lines changed: 114 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -1,114 +1,114 @@
1-
# sbom-diff-and-risk report
2-
3-
## Summary
4-
- Before format: cyclonedx-json
5-
- After format: cyclonedx-json
6-
- Added: 1
7-
- Removed: 0
8-
- Version changes: 1
9-
10-
## Risk buckets
11-
- new_package: 1
12-
- major_upgrade: 0
13-
- version_change_unclassified: 1
14-
- unknown_license: 0
15-
- stale_package: 0
16-
- suspicious_source: 0
17-
- not_evaluated: 2
18-
19-
## Policy summary
20-
- Applied: yes
21-
- Policy path: examples/policy-strict.yml
22-
- Exit code: 1
23-
- Blocking findings: 3
24-
- Warnings: 1
25-
- Suppressed findings: 0
26-
27-
## Provenance summary
28-
- Enrichment mode: offline_default
29-
- Network access performed: no
30-
- Candidate components for enrichment: 0
31-
- Supported components for enrichment: 0
32-
- Observed provenance status counts: none
33-
- Components in scope: 2
34-
- PyPI components in scope: 2
35-
- PyPI components without provenance records: 2
36-
- Components with provenance evidence: 0
37-
- Components with attestations: 0
38-
- Components with attestation gaps: 0
39-
- Components with enrichment errors: 0
40-
- Unsupported components: 0
41-
42-
## Attestation gaps
43-
| component | version | statuses |
44-
|-----------|---------|----------|
45-
| _none_ | | |
46-
47-
## Policy impact for provenance-related rules
48-
| rule id | component | level | message |
49-
|---------|-----------|-------|---------|
50-
| _none_ | | | |
51-
52-
## Trust signal notes
53-
- PyPI components are present, but provenance enrichment was not enabled for this run.
54-
55-
## Scorecard summary
56-
- Enrichment enabled: no
57-
- Network access performed: no
58-
- Candidate components for Scorecard enrichment: 0
59-
- Components with supported repository mappings: 0
60-
- Components with mapped repositories: 0
61-
- Components with available Scorecards: 0
62-
- Scorecard unavailable: 0
63-
- Repository unmapped: 0
64-
- Components with enrichment errors: 0
65-
- Observed Scorecard status counts: none
66-
67-
## Scorecard results
68-
| component | version | repository | score | status |
69-
|-----------|---------|------------|-------|--------|
70-
| _none_ | | | | |
71-
72-
## Policy impact for Scorecard-related rules
73-
| rule id | component | level | message |
74-
|---------|-----------|-------|---------|
75-
| _none_ | | | |
76-
77-
## Added components
78-
| name | version | ecosystem | risk buckets |
79-
|------|---------|-----------|--------------|
80-
| urllib3 | 2.2.1 | pypi | new_package, not_evaluated |
81-
82-
## Removed components
83-
| name | version | ecosystem |
84-
|------|---------|-----------|
85-
| _none_ | | |
86-
87-
## Version changes
88-
| name | before | after | classification | risk buckets |
89-
|------|--------|-------|----------------|--------------|
90-
| requests | 2.31.0 | 2.32.0 | version_changed | not_evaluated, version_change_unclassified |
91-
92-
## Risk findings
93-
| bucket | component | version | rationale |
94-
|--------|-----------|---------|-----------|
95-
| new_package | urllib3 | 2.2.1 | Component was not present in the before input. |
96-
| not_evaluated | requests | 2.32.0 | stale_package was not evaluated because enrichment mode is disabled. |
97-
| not_evaluated | urllib3 | 2.2.1 | stale_package was not evaluated because enrichment mode is disabled. |
98-
| version_change_unclassified | requests | 2.32.0 | Version changed but did not qualify as a parseable SemVer major upgrade. |
99-
100-
## Blocking violations
101-
| rule id | component | level | message |
102-
|---------|-----------|-------|---------|
103-
| max_added_packages | | block | Added package count 1 exceeds max_added_packages=0. |
104-
| stale_package | requests | block | stale_package was not evaluated because enrichment mode is disabled. |
105-
| stale_package | urllib3 | block | stale_package was not evaluated because enrichment mode is disabled. |
106-
107-
## Warnings
108-
| rule id | component | level | message |
109-
|---------|-----------|-------|---------|
110-
| new_package | urllib3 | warn | Component was not present in the before input. |
111-
112-
## Notes
113-
- This tool uses heuristic risk classification.
114-
- No network enrichment was performed.
1+
# sbom-diff-and-risk report
2+
3+
## Summary
4+
- Before format: cyclonedx-json
5+
- After format: cyclonedx-json
6+
- Added: 1
7+
- Removed: 0
8+
- Version changes: 1
9+
10+
## Risk buckets
11+
- new_package: 1
12+
- major_upgrade: 0
13+
- version_change_unclassified: 1
14+
- unknown_license: 0
15+
- stale_package: 0
16+
- suspicious_source: 0
17+
- not_evaluated: 2
18+
19+
## Policy summary
20+
- Applied: yes
21+
- Policy path: examples/policy-strict.yml
22+
- Exit code: 1
23+
- Blocking findings: 3
24+
- Warnings: 1
25+
- Suppressed findings: 0
26+
27+
## Provenance summary
28+
- Enrichment mode: offline_default
29+
- Network access performed: no
30+
- Candidate components for enrichment: 0
31+
- Supported components for enrichment: 0
32+
- Observed provenance status counts: none
33+
- Components in scope: 2
34+
- PyPI components in scope: 2
35+
- PyPI components without provenance records: 2
36+
- Components with provenance evidence: 0
37+
- Components with attestations: 0
38+
- Components with attestation gaps: 0
39+
- Components with enrichment errors: 0
40+
- Unsupported components: 0
41+
42+
## Attestation gaps
43+
| component | version | statuses |
44+
|-----------|---------|----------|
45+
| _none_ | | |
46+
47+
## Policy impact for provenance-related rules
48+
| rule id | component | level | message |
49+
|---------|-----------|-------|---------|
50+
| _none_ | | | |
51+
52+
## Trust signal notes
53+
- PyPI components are present, but provenance enrichment was not enabled for this run.
54+
55+
## Scorecard summary
56+
- Enrichment enabled: no
57+
- Network access performed: no
58+
- Candidate components for Scorecard enrichment: 0
59+
- Components with supported repository mappings: 0
60+
- Components with mapped repositories: 0
61+
- Components with available Scorecards: 0
62+
- Scorecard unavailable: 0
63+
- Repository unmapped: 0
64+
- Components with enrichment errors: 0
65+
- Observed Scorecard status counts: none
66+
67+
## Scorecard results
68+
| component | version | repository | score | status |
69+
|-----------|---------|------------|-------|--------|
70+
| _none_ | | | | |
71+
72+
## Policy impact for Scorecard-related rules
73+
| rule id | component | level | message |
74+
|---------|-----------|-------|---------|
75+
| _none_ | | | |
76+
77+
## Added components
78+
| name | version | ecosystem | risk buckets |
79+
|------|---------|-----------|--------------|
80+
| urllib3 | 2.2.1 | pypi | new_package, not_evaluated |
81+
82+
## Removed components
83+
| name | version | ecosystem |
84+
|------|---------|-----------|
85+
| _none_ | | |
86+
87+
## Version changes
88+
| name | before | after | classification | risk buckets |
89+
|------|--------|-------|----------------|--------------|
90+
| requests | 2.31.0 | 2.32.0 | version_changed | not_evaluated, version_change_unclassified |
91+
92+
## Risk findings
93+
| bucket | component | version | rationale |
94+
|--------|-----------|---------|-----------|
95+
| new_package | urllib3 | 2.2.1 | Component was not present in the before input. |
96+
| not_evaluated | requests | 2.32.0 | stale_package was not evaluated because enrichment mode is disabled. |
97+
| not_evaluated | urllib3 | 2.2.1 | stale_package was not evaluated because enrichment mode is disabled. |
98+
| version_change_unclassified | requests | 2.32.0 | Version changed but did not qualify as a parseable SemVer major upgrade. |
99+
100+
## Blocking violations
101+
| rule id | component | level | message |
102+
|---------|-----------|-------|---------|
103+
| max_added_packages | | block | Added package count 1 exceeds max_added_packages=0. |
104+
| stale_package | requests | block | stale_package was not evaluated because enrichment mode is disabled. |
105+
| stale_package | urllib3 | block | stale_package was not evaluated because enrichment mode is disabled. |
106+
107+
## Warnings
108+
| rule id | component | level | message |
109+
|---------|-----------|-------|---------|
110+
| new_package | urllib3 | warn | Component was not present in the before input. |
111+
112+
## Notes
113+
- This tool uses heuristic risk classification.
114+
- No network enrichment was performed.

0 commit comments

Comments
 (0)