Conversation
V0.2 Regression hardening and CLI output contract cleanup
…ility feat: adding logic to enable use with earlier supported python versions
Merge pull request #79 from GenAI-Security-Project/v0.2
) v0.2 carries the same scoring bug as main: the component_basic external_references field uses the singular jsonpath $.component.externalReferences (field_registry.json), and the fallback presence check in scoring.py compares the snake_case registry name against the camelCase BOM key, so a populated externalReferences array under components[0] is scored as missing. - field_registry.json: jsonpath -> $.components[0].externalReferences (scoring/detection path only; aibom_generation.location left untouched, consistent with the convention v0.2 already uses). - scoring.py: a registry-name -> BOM-key alias map for the fallback check (also covers component_version -> version). - tests/test_scoring.py: a positive regression (detection under components[0] via both jsonpath and fallback) and a negative guard. Confirmed the regression reproduces on v0.2 (positive test fails before the change) and all of tests/test_scoring.py passes after it.
Add two format-agnostic, repo-level distribution attributes extracted from
the HuggingFace file listing:
* model_file_size — total bytes of all weight files
* runtime_requirement — "python" (safetensors/PyTorch/etc. loadable from a
Python ML stack) or "llm-stack" (GGUF/GGML-only,
needs llama.cpp/Ollama)
- model_file_extractors.py: new extract_distribution_metadata() runs for every
repo regardless of weight format
- extractor.py: wire into EnhancedExtractor (REPOSITORY_FILES / HIGH confidence)
- service.py: emit as CycloneDX properties under the custom
owasp:aibom:distribution namespace (kept out of the official genai:aibom
namespace, which forbids unofficial names)
- field_registry.json: register both as supplementary-tier fields
- result.html: render a friendly "Deployment & Hardware" section
…backend - Switch summarization model from google/flan-t5-small to facebook/bart-large-cnn - Fix prompt-leak bug: BART is a summarization model, not instruction-following. Feed it document text only (never an instruction prompt), which it would otherwise echo into the output and hallucinate generic summaries. Add _strip_prompt_leak() as defense-in-depth - Add optional instruction-tuned backend via Ollama (AIBOM_SUMMARIZER_BACKEND=ollama), falling back to BART on any failure - Guard against BART hallucination on short inputs (<280 chars): return the clean extract instead of abstracting - Penalize quant-repackaging marketing text; strip markdown emphasis/headings; add no_repeat_ngram_size to stop repetition loops
fix(scoring): detect externalReferences under components[0] on v0.2 (#76)
Signed-off-by: Dmitry Raidman <eaglei15@gmail.com>
feat: Add training data transparency flags with HF Hub verification
test_training_data_flag_with_datasets and _without_datasets live in TestProcessLicenses, whose setUp does not mock hf_api. Setting self.service.hf_api.model_info.return_value on the real bound method raised AttributeError. Mock hf_api in each test before use.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.