Package: lib4package
Lib4packageLib4package is a library to handle package metadata to be included in a Software Bill of Materials (SBOMs). The data should be suitable for SBOMs created in bothSPDXandCycloneDXformats.It has been developed on the assumption that having a common way of obtaining component metadata regardless of the language ecosystem will be useful to developers.InstallationTo install use the following command:pip install lib4packageAlternatively, just clone the repo and install dependencies using the following command:pip install -U -r requirements.txtThe tool requires Python 3 (3.8+). It is recommended to use a virtual python environment especially
if you are using different versions of python.virtualenvis a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.APIMetadataThe Metadata module provides methods for accessing the component data from a language ecosystem.
The focus of the implementation is on providing a common set of methods regardless of the language ecosystem.classMetadata(ecosystem="python",debug=False)This creates a simple Metadata object. The object takes two optional parameters,ecosystem,
which represents the language ecosystem to use (the default is Python), anddebugwhich is used to enable
the generation of debugging information (the default is False). The appropriatePURLtype can also be specified for the ecosystem e.g. pypi for Python.The following language ecosystems are supported:dartgojavajavascript.netperlpythonrrubyrustswiftInvalid ecosystems will have no affect.Methodsget_package(name,version=None)Retrieves the data for the specified package. If the version is not specified (the default), the data for the latest version is
retrieved.get_data()Returns a JSON object containing all the metadata for the package.print_data()Prints the metadata for the package.get_checksum(version=None)Return the SHA1 checksum for the specified version of the package. If the version is not specified, the checksum for the latest version is returned.NOTEthat a checksum might not be available for the latest version, in which case None will be returned.get_description()Return the package description. None is returned if no description found.get_license()Return the license for the package. If no license is found, None is returned.get_homepage()Return the URL of the homepage for the package. None is returned if no homepage is available.get_downloadlocation()Return the URL of the download location for the package. None is returned if no download location is available.get_purl()Return the Package URL (PURL) of the package. None is returned if it is not available.get_originator()Return the originator of the package and optionally, an email address. If no originator can be found, None is returned.get_latest_release()Returns the name of the latest release of the package. If no package data is available, None is returned.get_latest_release_time()Returns the time when the latest release of the package was released. If no package data is available, None is returned.get_no_of_versions()Returns the number of releases of the package.get_no_of_updates(version)Returns the number of updates from the specified version to the latest version.ExampleThe following code sample shows the use of the Metadata module.>>>fromlib4package.metadataimportMetadata>>>meta=Metadata(ecosystem="Python")>>>meta.get_package("requests")>>>meta.get_latest_release()'0.12.01'>>>meta.get_description()'Python HTTP for Humans.'>>>meta.get_originator()'Python Software Foundation '>>>meta.get_license()'Apache 2.0'>>>meta=Metadata(ecosystem="java")>>>meta.get_package("org.slf4j:slf4j-api")>>>meta.get_latest_version()'2.0.9'>>>meta.get_description()'The slf4j API'>>>meta.get_checksum()>>>meta.get_license()'MIT License'>>>meta.get_no_of_versions()96>>>m.get_checksum("2.0.6")'5ff6f2c385c36ea4f8b85cacd69f7ca891c37818'LicenseLicensed under the Apache 2.0 Licence.LimitationsThis tool is meant to support software development. The usefulness of the tool is dependent on the metadata
which is provided to the tool from the language ecosystems. Unfortunately, the tool is unable to determine the validity or
completeness of sthe data; users of the tool are therefore reminded that they should assert the quality of any data which is provided to the tool.Feedback and ContributionsBugs and feature requests can be made via GitHub Issues.