add basic sbom support; added pypijson representation for use in downstream

Author: FredHappyface

depgather/models/__init__.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from enum import StrEnum
+
+from pydantic import Field, HttpUrl
+
+from depgather.models.defaultonnone import DefaultOnNoneModel
+
+DEFAULT_URL = HttpUrl("https://example.invalid")
+
+
+class ComponentType(StrEnum):
+	application = "application"
+	framework = "framework"
+	library = "library"
+	container = "container"
+	operating_system = "operating-system"
+	device = "device"
+	firmware = "firmware"
+	file = "file"
+
+
+class Hash(DefaultOnNoneModel):
+	alg: str = ""
+	content: str = ""
+
+
+class License(DefaultOnNoneModel):
+	id: str = ""
+	name: str = ""
+
+
+class LicenseChoice(DefaultOnNoneModel):
+	license: License = License()
+
+
+class OrganizationalEntity(DefaultOnNoneModel):
+	name: str = ""
+	urls: list[HttpUrl] = Field(default_factory=list)
+	contacts: list[str] = Field(default_factory=list)
+
+
+class ExternalReference(DefaultOnNoneModel):
+	type: str = ""
+	url: HttpUrl = DEFAULT_URL
+	comment: str = ""
+
+
+class Tool(DefaultOnNoneModel):
+	vendor: str = ""
+	name: str = ""
+	version: str = ""
+
+
+class Component(DefaultOnNoneModel):
+	type: ComponentType = ComponentType.application
+	name: str = ""
+
+	version: str = ""
+	bom_ref: str = Field("", alias="bom-ref")
+	purl: str = ""
+	cpe: str = ""
+
+	supplier: OrganizationalEntity = OrganizationalEntity()
+
+	hashes: list[Hash] = Field(default_factory=list)
+	licenses: list[LicenseChoice] = Field(default_factory=list)
+	external_references: list[ExternalReference] = Field(
+		default_factory=list,
+		alias="externalReferences",
+	)
+
+	components: list[Component] = Field(default_factory=list)
+
+
+class Metadata(DefaultOnNoneModel):
+	timestamp: datetime = datetime.now(tz=UTC)
+	tools: list[Tool] = Field(default_factory=list)
+	component: Component = Component()
+
+
+class Bom(DefaultOnNoneModel):
+	bom_format: str = Field(alias="bomFormat", default="")
+	spec_version: str = Field(alias="specVersion", default="")
+	serial_number: str | None = Field(None, alias="serialNumber")
+	version: int = 1
+
+	metadata: Metadata = Metadata()
+	components: list[Component] = Field(default_factory=list)

depgather/models/cyclonedx.py

@@ -0,0 +1,45 @@
+from typing import Any
+
+from pydantic import BaseModel, ValidationInfo, field_validator, model_validator
+from pydantic.fields import FieldInfo
+from pydantic_core import PydanticUndefined
+
+
+class DefaultOnNoneModel(BaseModel):
+	@model_validator(mode="before")
+	@classmethod
+	def default_on_none(cls, values: Any) -> Any | dict[Any, Any]:
+		if not isinstance(values, dict):
+			return values
+
+		result = dict(values)
+
+		for name, field in cls.model_fields.items():
+			if name in result and result[name] is None:
+				if field.default_factory is not None:
+					result[name] = field.default_factory()
+				elif field.default is not None:
+					result[name] = field.default
+
+		return result
+
+	@field_validator("*", mode="wrap")
+	@classmethod
+	def fallback_to_default(
+		cls,
+		value: Any,
+		handler,
+		info: ValidationInfo,
+	) -> Any:
+		try:
+			return handler(value)
+		except Exception:
+			field: FieldInfo = cls.model_fields[info.field_name]
+
+			if field.default_factory is not None:
+				return field.default_factory()
+
+			if field.default is not PydanticUndefined:
+				return field.default
+
+			raise

depgather/models/defaultonnone.py

@@ -0,0 +1,93 @@
+from datetime import UTC, datetime
+
+from pydantic import Field, HttpUrl
+
+from depgather.models.defaultonnone import DefaultOnNoneModel
+
+DEFAULT_URL = HttpUrl("https://example.invalid")
+
+
+class Downloads(DefaultOnNoneModel):
+	last_day: int = 0
+	last_month: int = 0
+	last_week: int = 0
+
+
+class Digests(DefaultOnNoneModel):
+	blake2b_256: str = ""
+	md5: str = ""
+	sha256: str = ""
+
+
+class Info(DefaultOnNoneModel):
+	author: str = ""
+	author_email: str = ""
+	bugtrack_url: HttpUrl = DEFAULT_URL
+	classifiers: list[str] = Field(default_factory=list)
+	description: str = ""
+	description_content_type: str = ""
+	docs_url: HttpUrl = DEFAULT_URL
+	download_url: HttpUrl = DEFAULT_URL
+	downloads: Downloads = Downloads()
+	dynamic: list[str] = Field(default_factory=list)
+	home_page: str = ""
+	keywords: str = ""
+	license: str = ""
+	license_expression: str = ""
+	license_files: list[str] | None = None
+	maintainer: str = ""
+	maintainer_email: str = ""
+	name: str = ""
+	package_url: HttpUrl = DEFAULT_URL
+	platform: str = ""
+	project_url: HttpUrl = DEFAULT_URL
+	project_urls: dict[str, HttpUrl] = Field(default_factory=dict)
+	provides_extra: list[str] = Field(default_factory=list)
+	release_url: HttpUrl = DEFAULT_URL
+	requires_dist: list[str] | None = None
+	requires_python: str = ""
+	summary: str = ""
+	version: str = ""
+	yanked: bool = False
+	yanked_reason: str = ""
+
+
+class File(DefaultOnNoneModel):
+	comment_text: str = ""
+	digests: Digests = Digests()
+	downloads: int = 0
+	filename: str = ""
+	has_sig: bool = False
+	md5_digest: str = ""
+	packagetype: str = ""
+	python_version: str = ""
+	requires_python: str = ""
+	size: int | None = None
+	upload_time: datetime = datetime(1970, 1, 1, tzinfo=UTC)
+	upload_time_iso_8601: datetime = datetime(1970, 1, 1, tzinfo=UTC)
+	url: HttpUrl = DEFAULT_URL
+	yanked: bool = False
+	yanked_reason: str = ""
+
+
+class OwnershipRole(DefaultOnNoneModel):
+	role: str = ""
+	user: str = ""
+
+
+class Ownership(DefaultOnNoneModel):
+	roles: list[OwnershipRole]
+	organization: str = ""
+
+
+class Vulnerability(DefaultOnNoneModel):
+	# PyPI's schema can evolve; keep flexible unless you need validation.
+	pass
+
+
+class ProjectResponse(DefaultOnNoneModel):
+	info: Info = Info()
+	last_serial: int = 1
+	urls: list[File] = Field(default_factory=list)
+	vulnerabilities: list[dict] = Field(default_factory=list)
+	ownership: Ownership | None = None

depgather/models/pypijson.py

@@ -0,0 +1,109 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from enum import StrEnum
+
+from pydantic import Field, HttpUrl
+
+from depgather.models.defaultonnone import DefaultOnNoneModel
+
+DEFAULT_URL = HttpUrl("https://example.invalid")
+
+
+class SPDXDataLicense(StrEnum):
+	CC0_1_0 = "CC0-1.0"
+
+
+class RelationshipType(StrEnum):
+	depends_on = "DEPENDS_ON"
+	dependency_of = "DEPENDENCY_OF"
+	contains = "CONTAINS"
+	contained_by = "CONTAINED_BY"
+	describes = "DESCRIBES"
+
+
+class Checksum(DefaultOnNoneModel):
+	algorithm: str = ""
+	checksum_value: str = Field("", alias="checksumValue")
+
+
+class License(DefaultOnNoneModel):
+	id: str = ""
+	name: str = ""
+
+
+class ExternalReference(DefaultOnNoneModel):
+	reference_type: str = Field("", alias="referenceType")
+	locator: HttpUrl = DEFAULT_URL
+	comment: str = ""
+
+
+class CreationInfo(DefaultOnNoneModel):
+	created: datetime = datetime.now(tz=UTC)
+	creators: list[str] = Field(default_factory=list)
+	license_list_version: str = Field("", alias="licenseListVersion")
+
+
+class Package(DefaultOnNoneModel):
+	name: str = ""
+	spdx_id: str = Field("", alias="SPDXID")
+
+	version_info: str = Field("", alias="versionInfo")
+	supplier: str = ""
+	originator: str = ""
+
+	download_location: HttpUrl = DEFAULT_URL
+
+	license_concluded: str = Field("", alias="licenseConcluded")
+	license_declared: str = Field("", alias="licenseDeclared")
+
+	copyright_text: str = Field("", alias="copyrightText")
+
+	checksums: list[Checksum] = Field(default_factory=list)
+	external_refs: list[ExternalReference] = Field(
+		default_factory=list,
+		alias="externalRefs",
+	)
+
+
+class File(DefaultOnNoneModel):
+	file_name: str = Field("", alias="fileName")
+	spdx_id: str = Field("", alias="SPDXID")
+
+	checksums: list[Checksum] = Field(default_factory=list)
+	license_concluded: str = Field("", alias="licenseConcluded")
+
+
+class Relationship(DefaultOnNoneModel):
+	spdx_element_id: str = Field("", alias="spdxElementId")
+	relationship_type: RelationshipType = Field(
+		RelationshipType.depends_on,
+		alias="relationshipType",
+	)
+	related_spdx_element: str = Field(
+		"",
+		alias="relatedSpdxElement",
+	)
+
+
+class SPDX(DefaultOnNoneModel):
+	spdx_version: str = Field("SPDX-2.3", alias="spdxVersion")
+	data_license: SPDXDataLicense = Field(
+		SPDXDataLicense.CC0_1_0,
+		alias="dataLicense",
+	)
+
+	name: str = ""
+	document_namespace: HttpUrl = Field(
+		DEFAULT_URL,
+		alias="documentNamespace",
+	)
+
+	creation_info: CreationInfo = Field(
+		default_factory=CreationInfo,
+		alias="creationInfo",
+	)
+
+	packages: list[Package] = Field(default_factory=list)
+	files: list[File] = Field(default_factory=list)
+	relationships: list[Relationship] = Field(default_factory=list)