tests.test_sbom_base module

tests.test_sbom_base.test_writer_unavailable_reason_separates_absent_from_outdated()

The two failure modes need opposite remedies, so they cannot share a message.

A distribution shipping a writer library below the floor already satisfies [sbom-offline], so telling its user to install that extra strands them: they install it again, nothing changes, and the only clue left is a symbol name belonging to no package they can name. NixOS carries exactly such a cyclonedx-python-lib.

tests.test_sbom_base.test_spdx_names_a_missing_packageurl_python()

A missing packageurl-python disables the SPDX writer under its own name.

spdx-tools does not depend on it, so an install can carry spdx-tools alone. A message calling spdx-tools too old would send the user to upgrade the wrong package. Runs in a fresh interpreter, where a blocked packageurl import and a hidden distribution stand for the missing one.

class tests.test_sbom_base.CannedStatsSBOM(stats)

Bases: SBOM

A document reporting fixed statistics, to drive the summary adapter.

Defaults to JSON export format.

stats()

Return a summary of what landed in the document.

Format-agnostic counters live in the base implementation; SPDX and CycloneDX subclasses extend the returned dict with their own merged-documents, dependency-graph, and any other format-specific counts. Surfaced by the CLI as a post-run INFO-level summary and usable by tests or programmatic consumers without re-parsing the rendered document.

Return type:

dict[str, object]

tests.test_sbom_base.test_sbom_summary_notes(stats, bundled, notes)

Each note appears when the run produced what it counts, and only then.

tests.test_sbom_base.test_all_purls_is_left_to_each_renderer()

tests.test_sbom_base.test_an_alias_equal_to_its_own_purl_is_not_indexed()

A coordinate cannot be an alias of itself.

tests.test_sbom_base.test_a_package_is_counted_once()

A renderer that records one package twice still counts it once.