sPj8ddlZddlZddlmZddlmZddlmZmZm Z ddl m Z ejdk\rddl m Z nddlm Z ddlZddlmZdd lmZd d lmZd d lmZmZd d lmZmZd dl m!Z!m"Z"m#Z#d dl$m%Z%m&Z&d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/d dl0m1Z2m3Z4ddl5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mm?Z?ddl@mAZAmBZBddlCmDZDmEZEddlFmGZGddlHmIZIddlJmKZKddlLmMZMmNZNmOZOddlPmQZQejdGddZSejGd d!eUeZVGd"d#ejjZYejGd$d%eUeZZGd&d'ejjZ[ejdGd(d)Z\ejGd*d+eUeZ]ejdGd,d-Z^ejdGd.d/Z_ejdGd0d1Z`ejdGd2d3ejjZaejdGd4d5ejjZbejdGd6d7eIZcy)8N)Iterable)Enum)AnyOptionalUnion)warn) ) deprecated) PackageURL) SortedSet)bom_ref_from_str)ComparablePackageURLComparableTuple)InvalidOmniBorIdExceptionInvalidSwhidException)!CycloneDxDeserializationException'SerializationOfUnexpectedValueException0SerializationOfUnsupportedComponentTypeException)SchemaDeprecationWarning1Dot3SchemaDeprecationWarning1Dot6)SchemaVersion1Dot0SchemaVersion1Dot1SchemaVersion1Dot2SchemaVersion1Dot3SchemaVersion1Dot4SchemaVersion1Dot5SchemaVersion1Dot6SchemaVersion1Dot7) PackageUrlXmlBoolAttribute) AttachedTextExternalReference HashAlgorithmHashTypeIdentifiableActionPropertyXsUri&_HashTypeRepositorySerializationHelper)BomRef)ComponentEvidence%_ComponentEvidenceSerializationHelper)OrganizationalContactOrganizationalEntity)CryptoProperties) Dependable) IssueType)LicenseLicenseRepository%_LicenseRepositorySerializationHelper) ReleaseNotesT)%ignore_unknown_during_deserializationc eZdZdZdddddddeedeedeedeedeed df d Ze e jd e je jjd eefd Zej deed dfd Ze e jdd eefdZej deed dfdZe e jdd eefdZej deed dfdZe e jdd eefdZej deed dfdZe e jde je jjd eefdZej deed dfdZd efdZded efdZded efdZd efdZd efdZy) Commitz Our internal representation of the `commitType` complex type. .. note:: See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_commitType Nuidurlauthor committermessager<r=r>r?r@returncJ||_||_||_||_||_yNr;)selfr<r=r>r?r@s ^/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/cyclonedx/model/component.py__init__zCommit.__init__Ts' " r#c|jS)z A unique identifier of the commit. This may be version control specific. For example, Subversion uses revision numbers whereas git uses commit hashes. Returns: `str` if set else `None` _uidrDs rEr<z Commit.uidbsyyrGc||_yrCrI)rDr<s rEr<z Commit.uido  rGrc|jS)z The URL to the commit. This URL will typically point to a commit in a version control system. Returns: `XsUri` if set else `None` _urlrKs rEr=z Commit.urlssyyrGc||_yrCrOrDr=s rEr=z Commit.url~rMrGr c|jS)z The author who created the changes in the commit. Returns: `IdentifiableAction` if set else `None` _authorrKs rEr>z Commit.author||rGc||_yrCrTrDr>s rEr>z Commit.author  rGc|jS)z The person who committed or pushed the commit Returns: `IdentifiableAction` if set else `None`  _committerrKs rEr?zCommit.committersrGc||_yrCr\)rDr?s rEr?zCommit.committer #rGc|jS)z| The text description of the contents of the commit. Returns: `str` if set else `None` _messagerKs rEr@zCommit.messages}}rGc||_yrCrb)rDr@s rEr@zCommit.message  rGct|j|j|j|j|j fSrC)_ComparableTupler<r=r>r?r@rKs rE__comparable_tuplezCommit.__comparable_tuples5 HHdhh KK LL!   rGothercft|tr!|j|jk(SyNF) isinstancer:_Commit__comparable_tuplerDris rE__eq__z Commit.__eq__s, eV $**,0H0H0JJ JrGcpt|tr!|j|jkStSrC)rlr:rmNotImplementedrns rE__lt__z Commit.__lt__s/ eV $**,u/G/G/II IrGc4t|jSrC)hashrmrKs rE__hash__zCommit.__hash__D++-..rGcVd|jd|jd|jdS)Nz )r<r=r@rKs rE__repr__zCommit.__repr__s)dhhZvdhhZz$,,qQQrG)__name__ __module__ __qualname____doc__rstrr*r(rFproperty serializable xml_sequence xml_stringXmlStringSerializationTypeNORMALIZED_STRINGr<setterr=r>r?r@rgrmobjectboolrorrrintruryrGrEr:r:Ks"#/326!%  c] e_ +,  ./  #   \q!\\DDVVWXc]X" ZZx}\q!Xe_" ZZx4\q!!34" ]]X&89d\q!8$67"$8,>#?$D$$\q!\\DDVVW#X" ^^ x}    $4 Ft CD /#/R#RrGr:ceZdZdZdZdZdZy)ComponentScopez Enum object that defines the permissable 'scopes' for a Component according to the CycloneDX schema. .. note:: See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_scope requiredoptionalexcludedN)rzr{r|r}REQUIREDOPTIONALEXCLUDEDrrGrErrsHHHrGrc eZdZUdZeZeeeje e fe d<e e je jhee<eee jhzee<eeee<eeee<eeee<eeee<eeee<eeee<ede deejdeefdZededeeejdedeefd Zededeeejdedeefd Zedede fd Zy ) "_ComponentScopeSerializationHelper THIS CLASS IS NON-PUBLIC API )_ComponentScopeSerializationHelper__CASEScsviewrAcZ||jj|dvr |jSdS)Nr)rgetvalue)clsrrs rE __normalizez._ComponentScopeSerializationHelper.__normalizes1S[[__T2..xx  rGo__c .|J|j||SrC-_ComponentScopeSerializationHelper__normalizerrrrs rEjson_normalizez1_ComponentScopeSerializationHelper.json_normalize!q$''rGc .|J|j||SrCrrs rE xml_normalizez0_ComponentScopeSerializationHelper.xml_normalizerrGct|SrC)rrrs rE deserializez._ComponentScopeSerializationHelper.deserializes a  rGN)rzr{r|r}dictrtyperViewType frozensetr__annotations__rrrrrrrrrrr classmethodrr~rrrrrrrGrErrs*LPFGT$|,,-y/HH IR"+-#G #**<"=A#G #**<"=G ")*<"=G ")*<"=G ")*<"=G ")*<"=G ")*<"=G ^4 8M8M3NS[\_S` (s(%d<+@+@&AB( (%-c](( (c($T,*?*?%@A(($,SM(( !C!N!!rGrcDeZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZy) ComponentTypez Enum object that defines the permissible 'types' for a Component according to the CycloneDX schema. .. note:: See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_classification application containerzcryptographic-assetdatadevicez device-driverfilefirmware frameworklibraryzmachine-learning-modelzoperating-systemplatformN)rzr{r|r} APPLICATION CONTAINERCRYPTOGRAPHIC_ASSETDATADEVICE DEVICE_DRIVERFILEFIRMWARE FRAMEWORKLIBRARYMACHINE_LEARNING_MODELOPERATING_SYSTEMPLATFORMrrGrErrsM KI/ D F#M DHIG5)HrGrc eZdZUdZeZeeeje e fe d<e e je je je je j hee<eee j$hzee<eee j(e j*hzee<eeee<eeee<eee j2e j4e j6e j8hzee<eee j<hzee<eeee <e!de deejde"e#fdZ$e!de%de"eejde%de"e#fd Z&e!de%de"eejde%de"e#fd Z'e!de%de fd Z(y ) !_ComponentTypeSerializationHelperr(_ComponentTypeSerializationHelper__CASESctrrAcx||jj|dvr |jStd|d|)Nrz unsupported z for view )rrrr)rrrs rErz-_ComponentTypeSerializationHelper.__normalize8s= r* *88O>bVS]^b]e?fggrGrrc .|J|j||SrC,_ComponentTypeSerializationHelper__normalizers rErz0_ComponentTypeSerializationHelper.json_normalize>rrGc .|J|j||SrCrrs rErz/_ComponentTypeSerializationHelper.xml_normalizeErrGct|SrC)rrs rErz-_ComponentTypeSerializationHelper.deserializeLs QrGN))rzr{r|r}rrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrr~rrrrrrrGrErrsP*KO6GT$|,,-y/GG HQ"+!!&& -#G #**<"=A#G #**<"=A#G #**<"=G ")*<"=G ")*<"=##,, A#G  #**<"=))A#G #**<"=G h]h$|7L7L2MhRZ[^R_hh (s(%d<+@+@&AB( (%-c](( (c($T,*?*?%@A(($,SM((  C M  rGrceZdZdZddddeedeeddfdZedeefdZ e jdeeddfd Z edeefd Z e jdeeddfd Z de fd Z d edefdZd edefdZdefdZdefdZy)Diffz Our internal representation of the `diffType` complex type. .. note:: See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_diffType Ntextr=rr=rAc ||_||_yrCr)rDrr=s rErFz Diff.__init__Zs  rGc|jS)zz Specifies the optional text of the diff. Returns: `AttachedText` if set else `None` _textrKs rErz Diff.textbzzrGc||_yrCrrDrs rErz Diff.textl  rGc|jS)zi Specifies the URL to the diff. Returns: `XsUri` if set else `None` rOrKs rEr=zDiff.urlpyyrGc||_yrCrOrRs rEr=zDiff.urlzrMrGcDt|j|jfSrC)rgr=rrKs rErhzDiff.__comparable_tuple~s" HH II!   rGricft|tr!|j|jk(Syrk)rlr_Diff__comparable_tuplerns rEroz Diff.__eq__, eT "**,0H0H0JJ JrGcpt|tr!|j|jkStSrC)rlrrrqrns rErrz Diff.__lt__/ eT "**,u/G/G/II IrGc4t|jSrC)rtrrKs rEruz Diff.__hash__rvrGc"d|jdS)Nz %k2rGr c|jS)ae Variants describe relations where the relationship between the components are not known. For example, if Component A contains nearly identical code to Component B. They are both related, but it is unclear if one is derived from the other, or if they share a common ancestor. Returns: Set of `Component` ) _variantsrKs rErzPedigree.variantsBs~~rGc$t||_yrC)r r%)rDrs rErzPedigree.variantsPrrGcommitrZc|jS)z A list of zero or more commits which provide a trail describing how the component deviates from an ancestor, descendant, or variant. Returns: Set of `Commit` )_commitsrKs rErzPedigree.commitsTs}}rGc$t||_yrC)r r))rDrs rErzPedigree.commitsa!'* rGpatchr`c|jS)a A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complimentary to commits or may be used in place of commits. Returns: Set of `Patch` )_patchesrKs rErzPedigree.patchese"}}rGc$t||_yrC)r r.)rDrs rErzPedigree.patchesxr+rGc|jS)z Notes, observations, and other non-structured commentary describing the components pedigree. Returns: `str` if set else `None` _notesrKs rErzPedigree.notes|{{rGc||_yrCr3)rDrs rErzPedigree.notes  rGc tt|jt|jt|jt|jt|j |j fSrC)rgrrrrrrrKs rErhzPedigree.__comparable_tuplesY T^^ , T-- . T]] + T\\ * T\\ * JJ !   rGricft|tr!|j|jk(Syrk)rlr_Pedigree__comparable_tuplerns rErozPedigree.__eq__s, eX &**,0H0H0JJ JrGcpt|tr!|j|jkStSrC)rlrr:rqrns rErrzPedigree.__lt__s/ eX &**,u/G/G/II IrGc4t|jSrC)rtr:rKs rEruzPedigree.__hash__rvrGc8dt|dt|dS)Nz #>rGrceZdZdZdddddddededeedeedeed eed ee d dfd Z e e jd efd Zejded dfdZe e jd efdZejded dfdZe e jd eefdZejdeed dfdZe e jd eefdZejdeed dfdZe e jd eefdZejdeed dfdZe d eefdZejd eed dfdZe d ee fdZejd ee d dfdZd efdZded efdZded efdZd efdZd efd Zy)!Swidz Our internal representation of the `swidType` complex type. .. note:: See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_swidType N)version tag_versionr,rr=tag_idnamerArBr,rr=rAcf||_||_||_||_||_||_||_yrC)rCrDrArBr,rr=)rDrCrDrArBr,rr=s rErFz Swid.__init__s6   &  rGc|jS)z^ Maps to the tagId of a SoftwareIdentity. Returns: `str` _tag_idrKs rErCz Swid.tag_idrVrGc||_yrCrG)rDrCs rErCz Swid.tag_idrYrGc|jS)z^ Maps to the name of a SoftwareIdentity. Returns: `str` _namerKs rErDz Swid.nameszzrGc||_yrCrKrDrDs rErDz Swid.namerrGc|jS)zu Maps to the version of a SoftwareIdentity. Returns: `str` if set else `None`. _versionrKs rErAz Swid.versions}}rGc||_yrCrPrDrAs rErAz Swid.versionrerGc|jS)zv Maps to the tagVersion of a SoftwareIdentity. Returns: `int` if set else `None`  _tag_versionrKs rErBzSwid.tag_versions   rGc||_yrCrU)rDrBs rErBzSwid.tag_version 'rGc|jS)zs Maps to the patch of a SoftwareIdentity. Returns: `bool` if set else `None` _patchrKs rEr,z Swid.patchr5rGc||_yrCrZ)rDr,s rEr,z Swid.patchr7rGc|jS)z} Specifies the full content of the SWID tag. Returns: `AttachedText` if set else `None` rrKs rErz Swid.text rrGc||_yrCrrs rErz Swid.textrrGc|jS)zd The URL to the SWID file. Returns: `XsUri` if set else `None` rOrKs rEr=zSwid.urlrrGc||_yrCrOrRs rEr=zSwid.url$rMrGc t|j|j|j|j|j |j |jfSrC)rgrCrDrArBr,r=rrKs rErhzSwid.__comparable_tuple(sF KK IIt||    JJ HH II !   rGricft|tr!|j|jk(Syrk)rlr@_Swid__comparable_tuplerns rEroz Swid.__eq__2rrGcpt|tr!|j|jkStSrC)rlr@rcrqrns rErrz Swid.__lt__7rrGc4t|jSrC)rtrcrKs rEruz Swid.__hash__<rvrGcVd|jd|jd|jdS)Nz dh|, [[,/DXe_ ZZx4 $4 Ft Ft /#/W#WrGr@c&eZdZdZej dZdeddfdZe e jde jddefdZ ed edefd Zed eddfd Zd edefd Zd edefdZdefdZdefdZdefdZy) OmniborIdz Helper class that allows us to perform validation on data strings that must conform to https://www.iana.org/assignments/uri-schemes/prov/gitoid. z6^gitoid:(blob|tree|commit|tag):sha(1|256):([a-z0-9]+)$r rANcntjj|td|d||_yNzSupplied value "z$ does not meet format specification.)rj_VALID_OMNIBOR_ID_REGEXmatchr_idrDr s rErFzOmniborId.__init__Ms<  , , 2 22 6 >+"2$&JK rG.c|jSrCrorKs rEr z OmniborId.idT xxrGrcTt|tr t|Std|)Nz&Attempt to serialize a non-OmniBorId: )rlrjr~rrs rE serializezOmniborId.serializeZs, a #q6M54QE :<   r|ricVt|tr|j|jk(Syrk)rlrrorns rEroz Swhid.__eq__s" eU #88uyy( (rGc`t|tr|j|jkStSrC)rlrrorqrns rErrz Swhid.__lt__s% eU #88eii' 'rGc,t|jSrCrrKs rEruzSwhid.__hash__rrGc"d|jdS)Nze>jJdeeddfd>Z>ee jjd?e jLe jNjxdeefd@Z?e?jJdeeddfdAZ?ee jjdBe jLe jNjxdefdCZ@e@jJd eddfdDZ@ee jeBdEe je,dEe je-dEe je.dEe jjdFe jLe jNjxdeefdGZCeCjJdeeddfdHZCee jjdIe jLe jNjxdeefdJZDeDjJdeeddfdKZDee jBeEe jjdLdeefdMZFeFjJdeeddfdNZFee jTdOe jfdOe jFe jBeGe jVe2deefdPZHeHjJdeeddfdQZHee jBeIe jjdRddSZJeJjJdeeddfdTZJee jVe,e jVe-e jVe.e jVe/e jVe0e jVe1e jVe2e jBeKe jjdUdeLfdVZMeMjJdeeddfdWZMee jjdXe jLe jNjxdeefdYZNeNjJdeeddfdZZNee jjd[deefd\ZOeOjJdeeddfd]ZOee jBePe jjd^deefd_ZQeQjJdeeddfd`ZQee jTdae jVe1e jVe2e jpe jrjdabe jjdcdddZSeSjJd$eeddfdeZSee jTdfe jVe1e jVe2e jpe jrjdfbe jjdgddhZTeTjJd%eeddfdiZTee jVe-e jVe.e jVe/e jVe0e jVe1e jVe2e jjdjdeefdkZUeUjJdeeddfdlZUee jVeBe jjdmdefdnZVeVjJd!eddfdoZVee jVe,e jVe-e jVe.e jVe/e jVe0e jVe1e jVe2e jjdpdeefdqZWeWjJdeeddfdrZWee jVe,e jVe-e jVe.e jVe/e jVe0e jVe1e jVe2e jpe jrjtdse jjdtdduZXeXjJdeeddfdvZXee jVe.e jVe/e jVe0e jVe1e jVe2e jpe jrjtdwe jjdxddyZYeYjJdeeddfdzZYee jpe jrjtd{e jjd|dd}ZZeZjJdedddfd~ZZee jVe.e jVe/e jVe0e jVe1e jVe2e jjde jBe[deefdZ\e\jJd eeddfdZ\ee jVe/e jVe0e jVe1e jVe2e jjddeefdZ]e]jJdeeddfdZ]ee jVe1e jVe2e jjddeefdZ^e^jJd&eeddfdZ^ee jVe1e jVe2e jpe jrjtde jjdddZ_e_jJd'eeddfdZ_ddede`dfdZadefdZbdecfdZddeedefdZfdegdefdZhdeifdZjdefdZky)rz This is our internal representation of a Component within a Bom. .. note:: See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_component z`Deprecated - use cyclonedx.contrib.component.builders.ComponentBuilder().make_for_file() insteadabsolute_file_path path_for_bomrAcddlm}|j||}td|jDd}|Jd|dd|_t d |r|n|d|dd |_|S) uWDeprecated — Wrapper of :func:`cyclonedx.contrib.component.builders.ComponentBuilder.make_for_file`. Helper method to create a Component that represents the provided local file as a Component. .. deprecated:: next Use ``cyclonedx.contrib.component.builders.ComponentBuilder().make_for_file()`` instead. r)ComponentBuilder)rDc3nK|]-}|jtjus |j/ywrC)algr&SHA_1content).0hs rE z%Component.for_file..s%^-J]J]A]!))^s!55Nz0.0.0-r generic)rrDrA)contrib.component.buildersr make_for_filenexthashesrAr purl)rrrr sha1_hashs rEfor_filezComponent.for_files B$&445Gl4[ ^Y-=-=^`de $$$$Yq_$56 #CUYq_-. rGNF)r mime_typebom_refsupplier publishergrouprA descriptionscope is_externalrlicenses copyrightrexternal_references properties release_notescpeswidpedigree componentsevidencemodified manufacturerauthors omnibor_idsswhidscrypto_propertiestagsr>rDrrrrrrrArrrrrrrrrrrrrrrrrrrrrrr>c||_||_t||_||_||_|xsg|_||_||_||_ | |_ | |_ | |_ | xsg|_ | xsg|_||_||_||_|xsg|_|xsg|_||_||_|xsg|_|xsg|_|xsg|_||_||_||_|xsg|_||_||_||_yrC) rr_bom_ref_from_str_bom_refrrrrrrDrrrrrrrrrrrrrrrrrrrr>rrA) rDrDrrrrrrrArrrrrrrrrrrrrrrrrrrrrrr>s rErFzComponent.__init__sF ")'2   (}" "  & &l  B " &,"l    #6#<" $*$*  *!2JB     rGc|jS)z Get the type of this Component. Returns: Declared type of this Component as `ComponentType`. rrKs rErzComponent.typerrGc||_yrCrrs rErzComponent.type(rrGc|jS)aw Get any declared mime-type for this Component. When used on file components, the mime-type can provide additional context about the kind of file being represented such as an image, font, or executable. Some library or framework components may also have an associated mime-type. Returns: `str` if set else `None`  _mime_typerKs rErzComponent.mime_type,srGc||_yrCr)rDrs rErzComponent.mime_type;r_rGzbom-refc|jS)z An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref MUST be unique within the BOM. Returns: `BomRef` )rrKs rErzComponent.bom_ref?s(}}rGr#c|jS)z The organization that supplied the component. The supplier may often be the manufacture, but may also be a distributor or repackager. Returns: `OrganizationalEntity` if set else `None`  _supplierrKs rErzComponent.supplierUs ~~rGc||_yrCr)rDrs rErzComponent.supplierg !rGrc|jS)a& The organization that created the component. Manufacturer is common in components created through automated processes. Components created through manual means may have `@.authors` instead. Returns: `OrganizationalEntity` if set else `None`  _manufacturerrKs rErzComponent.manufacturerks!!!rGc||_yrCr)rDrs rErzComponent.manufacturerzs )rGr c|jS)a. The person(s) who created the component. Authors are common in components created through manual processes. Components created through automated means may have `@.manufacturer` instead. Returns: `Iterable[OrganizationalContact]` if set else `None` )_authorsrKs rErzComponent.authors~s}}rGc$t||_yrC)r r)rDrs rErzComponent.authorsr+rGrZc|jS)z The person(s) or organization(s) that authored the component. Returns: `str` if set else `None` rTrKs rEr>zComponent.authors ||rGcB|tjdd||_y)Nz@.authorz@.authors` or `@.manufacturer)r_warnrUrXs rEr>zComponent.authors   ) / / <[ \ rGr`c|jS)z The person(s) or organization(s) that published the component Returns: `str` if set else `None`  _publisherrKs rErzComponent.publishersrGc||_yrCr)rDrs rErzComponent.publisherr_rGr1c|jS)a The grouping name or identifier. This will often be a shortened, single name of the company or project that produced the component, or the source package or domain name. Whitespace and special characters should be avoided. Examples include: `apache`, `org.apache.commons`, and `apache.org`. Returns: `str` if set else `None` _grouprKs rErzComponent.groups{{rGc||_yrCr)rDrs rErzComponent.groupr7rGc|jS)z The name of the component. This will often be a shortened, single name of the component. Examples: `commons-lang3` and `jquery`. Returns: `str` rKrKs rErDzComponent.nameszzrGc||_yrCrKrNs rErDzComponent.namerrGc|jS)a} The component version. The version should ideally comply with semantic versioning but is not enforced. This is NOT optional for CycloneDX Schema Version < 1.4 but was agreed to default to an empty string where a version was not supplied for schema versions < 1.4 Returns: Declared version of this Component as `str` or `None` rPrKs rErAzComponent.versionr/rGcR|rt|dkDrtdt||_y)NizD`@.version`has a maximum length of 1024 from CycloneDX v1.6 onwards.)lenr UserWarningrQrSs rErAzComponent.versions# s7|d* WYd e rG c|jS)zq Get the description of this Component. Returns: `str` if set, else `None`.  _descriptionrKs rErzComponent.descriptions   rGc||_yrCr)rDrs rErzComponent.descriptionrXrG c|jS)z Specifies the scope of the component. If scope is not specified, 'required' scope should be assumed by the consumer of the BOM. Returns: `ComponentScope` or `None` _scoperKs rErzComponent.scope s{{rGc||_yrCr)rDrs rErzComponent.scoper7rG isExternalc|jS)a9 Determine whether this component is external. An external component is one that is not part of an assembly, but is expected to be provided by the environment, regardless of the component's scope. This setting can be useful for distinguishing which components are bundled with the product and which can be relied upon to be present in the deployment environment. This may be set to true for runtime components only. For metadata.component, it must be set to false. Returns: `bool` if set else `None`  _is_externalrKs rErzComponent.is_externals"   rGc||_yrCr)rDrs rErzComponent.is_external0rXrG c|jS)z Optional list of hashes that help specify the integrity of this Component. Returns: Set of `HashType` )_hashesrKs rErzComponent.hashes4s||rGc$t||_yrC)r r)rDrs rErzComponent.hashes@ ( rGrc|jS)z A optional list of statements about how this Component is licensed. Returns: Set of `LicenseChoice` ) _licensesrKs rErzComponent.licensesD"~~rGc$t||_yrC)r5r)rDrs rErzComponent.licensesWs*84rGr c|jS)z An optional copyright notice informing users of the underlying claims to copyright ownership in a published work. Returns: `str` or `None`  _copyrightrKs rErzComponent.copyright[srGc||_yrCr)rDrs rErzComponent.copyrighthr_rGc|jS)z Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe Returns: `str` if set else `None` _cperKs rErz Component.cpelsyyrGc||_yrCr )rDrs rErz Component.cpexrMrGc|jS)z Specifies the package-url (PURL). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec Returns: `PackageURL` or `None` _purlrKs rErzComponent.purl|zzrGc||_yrCr)rDrs rErzComponent.purlrrG omniborId) child_namec|jS)a Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid Returns: `Iterable[str]` or `None` ) _omnibor_idsrKs rErzComponent.omnibor_idss   rGc$t||_yrC)r r)rDrs rErzComponent.omnibor_idsr#rGswhidc|jS)aE Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html Returns: `Iterable[Swhid]` if set else `None` )_swhidsrKs rErzComponent.swhidss||rGc$t||_yrC)r r)rDrs rErzComponent.swhidsrrGc|jS)z Specifies metadata and content for ISO-IEC 19770-2 Software Identification (SWID) Tags. Returns: `Swid` if set else `None` _swidrKs rErzComponent.swidszzrGc||_yrCr")rDrs rErzComponent.swidrrGc|jSrC) _modifiedrKs rErzComponent.modifieds~~rGcB|rtjdd||_y)Nz @.modifiedz @.pedigree)rrr')rDrs rErzComponent.modifieds  ) / / l K!rGc|jS)a Component pedigree is a way to document complex supply chain scenarios where components are created, distributed, modified, redistributed, combined with other components, etc. Returns: `Pedigree` if set else `None`  _pedigreerKs rErzComponent.pedigreerrGc||_yrCr+)rDrs rErzComponent.pedigreerrG referencec|jS)z Provides the ability to document external references related to the component or to the project the component describes. Returns: Set of `ExternalReference` )_external_referencesrKs rErzComponent.external_referencess$(((rGc$t||_yrC)r r1)rDrs rErzComponent.external_referencess$-.A$B!rGrc|jS)a Provides the ability to document properties in a key/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Return: Set of `Property` ) _propertiesrKs rErzComponent.properties s rGc$t||_yrC)r r5)rDrs rErzComponent.properties$Z0rGrc|jS)a^ A list of software and hardware components included in the parent component. This is not a dependency tree. It provides a way to specify a hierarchical representation of component assemblies, similar to system -> subsystem -> parts assembly in physical supply chains. Returns: Set of `Component` ) _componentsrKs rErzComponent.componentssrGc$t||_yrC)r r:)rDrs rErzComponent.components-r7rGc|jS)z Provides the ability to document evidence collected through various forms of extraction or analysis. Returns: `ComponentEvidence` if set else `None`  _evidencerKs rErzComponent.evidence1s~~rGc||_yrCr>)rDrs rErzComponent.evidenceBrrGc|jS)zj Specifies optional release notes. Returns: `ReleaseNotes` or `None` _release_notesrKs rErzComponent.release_notesFs"""rGc||_yrCrC)rDrs rErzComponent.release_notesUs +rGc|jS)ae Cryptographic assets have properties that uniquely define them and that make them actionable for further reasoning. As an example, it makes a difference if one knows the algorithm family (e.g. AES) or the specific variant or instantiation (e.g. AES-128-GCM). This is because the security level and the algorithm primitive (authenticated encryption) is only defined by the definition of the algorithm variant. The presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also makes a difference. Returns: `CryptoProperties` or `None` _crypto_propertiesrKs rErzComponent.crypto_propertiesos&&&rGc||_yrCrH)rDrs rErzComponent.crypto_propertiess "3rGtagc|jS)a Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often serve as a way to group or categorize similar or related objects by various attributes. Returns: `Iterable[str]` )_tagsrKs rErzComponent.tagsrrGc$t||_yrC)r rN)rDrs rErzComponent.tagss t_ rG include_selfct}|r|j||jD]#}|j|j d%|S)NT)rP)setaddrupdateget_all_nested_components)rDrPrcs rErUz#Component.get_all_nested_componentssQU  NN4  NA   a99t9L M NrGcp|jrd|jd|jSd|jS)Nzhttps://pypi.org/project//)rArDrKs rE get_pypi_urlzComponent.get_pypi_urls5 <<.tyyk4<<.I I.tyyk: :rGctg|j|j|j|j|j j |jdnt|j|j|jt|j|j|j|j|j|j |j"t|j$t|j&|j(|j*t|j,t|j.t|j0|j2|j4|j6t|j8t|j:|j<|j>t|j@|jBSrC)"rgrrrDrArrr_ComparablePackageURLrrrrr>rrrrrrrrrrrrrrrrrrrrrKs rErhzComponent.__comparable_tuples! II! zz! #'99! .2ll! LL  ! II%D+@+K!  II ! xx ! "2$++!> ! MM !  ;; ! )- !    !  NN! !JJ! )9(E!  T]] +! .2^^!  MM!  T55 6! 9I8Y!  T__ -! 04}}! ?C>P>P! SWR_R_!  T\\ *! -=T=M=M,N! QUPaPa!   " "! %5TYY$?!    !   rGricft|tr!|j|jk(Syrk)rlr_Component__comparable_tuplerns rErozComponent.__eq__s, eY '**,0H0H0JJ JrGcpt|tr!|j|jkStSrC)rlrr]rqrns rErrzComponent.__lt__s/ eY '**,u/G/G/II IrGc4t|jSrC)rtr]rKs rEruzComponent.__hash__rvrGc d|jd|jd|jd|jd|jd S)Nz)rAzSortedSet[str])F)lrzr{r|r} staticmethodr r~rrrrrr,r0rrrr'r4r r%r)r7r@rr-r/rjrr1rFrr type_mappingrr rrrrTOKENrrrrrrrrrr rrrrrrrrrrr>rrrD include_nonerrArrr_XmlBoolAttributeSHrr+rr6r5rrr PackageUrlSHrFLATrrrrrrrrr.rrrrrRrUrYrgr]rrorrrrruryrrGrErrsrsS +t.,33#'0437#'#!%%)*.&*/304#'%)EI3704!#'+6:047;=A59,08<(, $CBBBC= B %V ,- B /0 BC=B}B#Bc]B'Bd^B(+,B8G,-BC=B z"!B"&h/@&AB#B$Xh/0%B& -'B(c])B*tn+B,8$-B.Xk23/B0,-1B23B4345B6(#89:7B8hy129B:%);B<$$45=B>x}%?BB CBD EBH\@A\!m"B [[4\\DDJJK 8C= L $8C=$T$$\I&\v&\)*\)*\)*\)*\)*\)*\)*\!\9%&"+++++++''\)*\)*\)*\)*\)*\)*\q!(#78"++++++__"*>!?"D""\)*\)*\q! "h';< ""++ "*2F)G*D**\)*\)*\LBBII8T\q! "U++  ^^+x(=>+4++\)*\)*\)*\)*\)*\)*\q!\\DDVVW X"++++++ ]]Xc]t \q!\\DDVVW8C=X"$8C=$T$$\q!\\DDVVW x} X"  \\8C=T\q!\\DDVVW c X"  [[\126\126\126\126\q!\\DDVVW # X"7777  ^^ x}   \q!\\DDVVW!Xc]!X"!(x}(((\AB\r" x/ #C  \\8N3\L)\<(\!\23\)* !Xd^ !+4")* !(x~($((\EF\r"#G ]])Xh/)D))\)*\)*\)*\)*\)*\)*\)*\DE\r"+#F+++++++__5'!25t55\r"\\DDVVW8C=X#$8C=$T$$\r"Xc]# ZZx}\|,\r" hz* #-  [[*-$\K(\)*\)*\LBBGGT_`\r" !#a++) !3x ':3t33\G$\)*\)*\LBBGGT[\\r" #]++%  ]])Xe_)))\)*\)*\)*\)*\)*\)*\r"htn#++++++ [[$D\)*\r"$#+__""$"" \)*\)*\)*\)*\)*\)*\)*\r"(8,#+++++++__"(!3"""\)*\)*\)*\)*\)*\)*\)*\LBBII;W\r")#X+++++++)Cx@Q7RCW[C C\)*\)*\)*\)*\)*\LBBII:V\r" #W+++++ 1Xh%71D11\LBBII;W\r"  #X  1Xk%:1t11\)*\)*\)*\)*\)*\r"\DE(#45F#+++++__"*;!<"""\)*\)*\)*\)*\r"#x 5##++++ #,8L+A,d,,2\)*\)*\r" '8,<#= '#++ '48rs$ $''w#,'!&ErN ^   `   X@$"VV&!  tLyRyRMyRx S$   (!)=)=)H)H(!VC .5 (<(<(G(G5 p!  tL@(@(M@(F #t   !  tLV:V:MV:r!  tLe>e>Me>P!  tLYWYWMYWx!  tL7 $$//7M7t!  tL7L + +7M7t!  tLN 9 N 9MN 9rG