1 files changed, 50 insertions, 94 deletions
diff --git a/pkgs/tools/security/cve-bin-tool/default.nix b/pkgs/tools/security/cve-bin-tool/default.nix
index 88b52da21eb32..b269cd362f2b0 100644
--- a/pkgs/tools/security/cve-bin-tool/default.nix
+++ b/pkgs/tools/security/cve-bin-tool/default.nix
@@ -1,134 +1,90 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
-, fetchpatch
+  # aiohttp[speedups]
+, aiodns
+, aiohttp
+, beautifulsoup4
+, brotlipy
+, cvss
+, distro
+, filetype
+, google-cloud-sdk
+, jinja2
 , jsonschema
+, lib4sbom
+, packageurl-python
+, packaging
 , plotly
-, beautifulsoup4
+, pytestCheckHook
+, python-gnupg
 , pyyaml
-, isort
-, py
-, jinja2
-, rpmfile
-, reportlab
-, zstandard
 , rich
-, aiohttp
+, rpmfile
+, setuptools
 , toml
-, distro
-  # aiohttp[speedups]
-, aiodns
-, brotlipy
-, faust-cchardet
-, pillow
-, pytestCheckHook
 , xmlschema
-, setuptools
-, packaging
-, cvss
-, google-cloud-sdk
+, zstandard
+, reportlab
 , pip
 , testers
 , cve-bin-tool
-# pinned packaging
-, pyparsing
-, fetchPypi
-, buildPythonPackage
-, pretend
-, pythonOlder
-, wheel
 }:
 
-let
-  # pin packaging to < 22 until issue related to https://github.com/intel/cve-bin-tool/pull/2436 are resolved by upstream (post-3.2)
-  packaging_21_3 = buildPythonPackage rec {
-    inherit (packaging) pname passthru meta;
-    version = "21.3";
-    format = "pyproject";
-    disabled = pythonOlder "3.6";
-
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "sha256-3UfEKSfYmrkR5gZRiQfMLTofOLvQJjhZcGQ/nFuOz+s=";
-    };
-    nativeBuildInputs = [
-      setuptools
-      wheel
-    ];
-    propagatedBuildInputs = [
-      pyparsing
-    ];
-
-    nativeCheckInputs = [
-      pytestCheckHook
-      pretend
-    ];
-
-    doCheck = false;
-  };
-in
 buildPythonApplication rec {
   pname = "cve-bin-tool";
-  version = "3.2";
+  version = "3.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "cve-bin-tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QOnWt6iit0/F6d/MfZ8qJqDuT3IHh0Qjs6BcJkI/CBw=";
+    hash = "sha256-A5w4U5EDX+UZWNMuz8GTOcubo8N2KfDlVV0aRNsO8/E=";
   };
 
-  patches = [
-    # Not needed as python dependency, should just be on the PATH
-    ./no-gsutil-python-dependency.patch
-    # Already merged upstream, to be removed post-3.2
-    # https://github.com/intel/cve-bin-tool/pull/2524
-    (fetchpatch {
-      name = "cve-bin-tool-version-success.patch";
-      url = "https://github.com/intel/cve-bin-tool/commit/6f9bd565219932c565c1443ac467fe4163408dd8.patch";
-      hash = "sha256-Glj6qiOvmvsuetXn4tysyiN/vrcOPFLORh+u3BoGzCI=";
-    })
-  ];
-
   # Wants to open a sqlite database, access the internet, etc
   doCheck = false;
 
-  propagatedNativeBuildInputs = [
-    pip
-  ];
-
-  propagatedBuildInputs = [
-    google-cloud-sdk
+  dependencies = [
+    # aiohttp[speedups]
+    aiodns
+    aiohttp
+    beautifulsoup4
+    brotlipy
+    cvss
+    distro
+    filetype
+    google-cloud-sdk # gsutil
+    jinja2
     jsonschema
+    lib4sbom
+    packageurl-python
+    packaging
     plotly
-    beautifulsoup4
+    python-gnupg
     pyyaml
-    isort
-    py
-    jinja2
-    rpmfile
-    reportlab
-    zstandard
     rich
-    aiohttp
-    toml
-    distro
-    # aiohttp[speedups]
-    aiodns
-    brotlipy
-    faust-cchardet
-    # needed by brotlipy
-    pillow
+    rpmfile
     setuptools
+    toml
     xmlschema
-    cvss
-    packaging_21_3
+    zstandard
+  ];
+
+  optional-dependencies = {
+    pdf = [
+      reportlab
+    ];
+  };
+
+  propagatedBuildInputs = [
+    pip
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [
     "cve_bin_tool"