Skip to content

v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@Urist-McGit Urist-McGit released this 17 Nov 11:49
· 12 commits to main since this release
v0.4.0
a600f60

You can find the associated container to this release here.

All releases are published automatically on PyPI. You can install it by running pip install debsbom[download].

Improvements

  • Always include package field in download result when using the --json option for the download command
    It was optional before, now it is always there.
  • Add PURL field to download result when using the --json option for the download command
  • Add --mtime option for repack and source-merge commands
    This option sets a custom timestamp for the created tarballs. If this option is not set, the timestamp from the most recent changelog is used, as before.
  • Checksum matching is now done in a defined order if there are multiple available, with the best algorithms being tried first
  • Improve handling of malformed apt-cache data
  • Improve error messages for malformed package lists
  • Add --skip-pkgs option to the download command
    This new option allows us to skip a select number of packages. This is useful if one does not want to leak private package names to the snapshot mirror.
  • Add VCS information to SBOM
    Debian source packages may contain information about the used VCS and provide a link to it. Include this information in the SBOM as it might be useful for repository analysis and other purposes.

Bug fixes

  • Fixed residual config packages being placed in SBOMs
    Packages that are not properly installed showed up in the SBOM before and only their dependency resolution was disabled. Properly remove them now.
  • Actually use the output directory specified by the --output option for the source-merge command
  • Fix incorrect application of patches for the repack command
    When using the --apply-patches flag we previously always skipped the inclusion of the.pc directory, essentially ignoring the flag.
  • Fix wrong inclusion of orig.tar tarballs for the repack command

Documentation

  • Document many design decisions
  • Use relationship instead of relation when describing Debian package relationships
    This is the terminology used in the Debian documentation, so we stay consistent with it.
Assets 2
Loading