FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-112302: Add Software Bill-of-Materials (SBOM) tracking for dependencies by sethmlarson · Pull Request #112303 · python/cpython · GitHub

/ cpython Public

gh-112302: Add Software Bill-of-Materials (SBOM) tracking for dependencies - #112303

Merged
hugovk merged 5 commits into
python:mainfrom
sethmlarson:sbom-gen
Dec 7, 2023
Merged

gh-112302: Add Software Bill-of-Materials (SBOM) tracking for dependencies#112303
hugovk merged 5 commits into
python:mainfrom
sethmlarson:sbom-gen

Conversation

sethmlarson commented Nov 21, 2023
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

This PR is a simple adaptation of the tooling used for my experiment to create SBOMs for past and current Python versions. I created a regen-sbom Makefile target. This PR needs some documentation for how core developers are expected to run the tooling when updating source dependencies.

bedevere-app Bot commented Nov 21, 2023

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Comment thread .github/CODEOWNERS

bedevere-app Bot commented Dec 6, 2023

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

hugovk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I think a NEWS file would be good here.

This PR needs some documentation for how core developers are expected to run the tooling when updating source dependencies.

Yep, would be good to know who should run it and when (running it now, I get about 20 new entries in the JSON). Maybe something for the devguide. Is it something that should be in the CI? Can also be in followups.

Comment thread Tools/build/generate_sbom.py Outdated
Comment thread Tools/build/generate_sbom.py Outdated
Comment thread Tools/build/generate_sbom.py Outdated

sethmlarson commented Dec 6, 2023
edited
Loading

Copy link
Copy Markdown
Contributor Author

Thanks for the review @hugovk!

Yep, would be good to know who should run it and when (running it now, I get about 20 new entries in the JSON). Maybe something for the devguide. Is it something that should be in the CI? Can also be in followups.

I can certainly add something to the devguide, I've created a tracking issue for myself here: python/devguide#1241

For the 20 differences you are seeing, I believe I've pushed the update that would be required (in this case, updating pip). After fetching the latest branch are you seeing the same?

sethmlarson requested a review from hugovk December 6, 2023 20:20

hugovk commented Dec 6, 2023

Copy link
Copy Markdown
Member

I'm still seeing it, looks like this: hugovk@06ed0fa

Copy link
Copy Markdown
Contributor Author

@hugovk Got it! I have to add filtering for gitignored files.

Copy link
Copy Markdown
Contributor Author

@hugovk Give acdd91b a try, that should be filtering out according to gitignore.

hugovk commented Dec 7, 2023

Copy link
Copy Markdown
Member

No change to the JSON file this time 👍

hugovk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Looks good. Ready for merge, want to add more, or someone else to review?

Comment thread Tools/build/generate_sbom.py Outdated
Comment thread Tools/build/generate_sbom.py Outdated
Comment thread Tools/build/generate_sbom.py Outdated

Copy link
Copy Markdown
Contributor Author

@hugovk I'll add the trailing commas then I'm good to merge! Going to add more in followups :)

Copy link
Copy Markdown
Contributor Author

@hugovk Commas have been added! ab65fdd Ready to merge when you are :)

hugovk merged commit 21221c3 into python:main Dec 7, 2023

hugovk commented Dec 7, 2023

Copy link
Copy Markdown
Member

Thanks!

sethmlarson deleted the sbom-gen branch December 7, 2023 16:37

pitrou commented Dec 7, 2023

Copy link
Copy Markdown
Member

It would be good to ensure the generated file is treated as such by review tools.

Copy link
Copy Markdown
Contributor Author

Thanks @pitrou, great suggestion. Here's the PR: #112854

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants


Back | FazBrowse Home | New Git URL