[3.13] gh-112844: Update CPE references for external dependencies (GH-118521) (#119237)

miss-islington · sethmlarson · web-flow · commit d8c562af55a0 · 2024-05-20T13:32:38.000-06:00
Co-authored-by: Seth Michael Larson &lt;seth@python.org&gt;
diff --git a/Tools/build/generate_sbom.py b/Tools/build/generate_sbom.py
@@ -305,7 +305,21 @@ def create_externals_sbom() -> None:
 
     # Set the versionInfo and downloadLocation fields for all packages.
     for package in sbom_data["packages"]:
-        package["versionInfo"] = externals_name_to_version[package["name"]]
+        package_version = externals_name_to_version[package["name"]]
+
+        # Update the version information in all the locations.
+        package["versionInfo"] = package_version
+        for external_ref in package["externalRefs"]:
+            if external_ref["referenceType"] != "cpe23Type":
+                continue
+            # Version is the fifth field of a CPE.
+            cpe23ref = external_ref["referenceLocator"]
+            external_ref["referenceLocator"] = re.sub(
+                r"\A(cpe(?::[^:]+){4}):[^:]+:",
+                fr"\1:{package_version}:",
+                cpe23ref
+            )
+
         download_location = (
             f"https://github.com/python/cpython-source-deps/archive/refs/tags/{externals_name_to_git_tag[package['name']]}.tar.gz"
         )
