FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Add docs for updating external dependencies by sethmlarson · Pull Request #1280 · python/devguide · GitHub

/ devguide Public

Add docs for updating external dependencies #1280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sethmlarson wants to merge 7 commits into
base: main
Choose a base branch
Could not load branches
Branch not found: {{ refName }}

Are you sure you want to change the base?

Some commits from the old base branch may be removed from the timeline, and old review comments may become outdated.
from
Conversation 32 Commits 7 Checks 0 Files changed
Open

Add docs for updating external dependencies #1280

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6b6bbad
Add docs for updating external dependencies
sethmlarson Feb 27, 2024
6646cf8
Apply suggestions from code review
sethmlarson Feb 29, 2024
cefc01d
Add PCbuild/build.bat --regen option to docs
sethmlarson Feb 29, 2024
a154e01
Apply suggestions from code review
sethmlarson Mar 4, 2024
cc0709a
Update developer-workflow/sbom.rst
sethmlarson Mar 4, 2024
b32b691
Add warning for non-core developers and external dependencies
sethmlarson Mar 4, 2024
3588722
Apply suggestions from code review
sethmlarson Mar 11, 2024
File filter

Filter by extension

Filter by extension .rst  (1) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
34 changes: 33 additions & 1 deletion developer-workflow/sbom.rst
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ After gathering this information:

* ``name`` for the project name.
* ``SPDXID`` which will be ``"SPDXRef-PACKAGE-{name}"``.
* ``licenseConcluded`` for the SPDX license identifier of the project license.
* ``licenseConcluded`` must be ``NOASSERTION``.
* ``versionInfo`` for the version of the project.
* ``downloadLocation`` should be an HTTPS URL for the project download as an archive.
* ``checksums[0].checksumValue`` and ``.algorithm`` will be the SHA-256
Expand Down Expand Up @@ -107,3 +107,35 @@ When removing a dependency:
that correct package is removed from the SBOM.
5. Commit the changes to :cpy-file:`Misc/sbom.spdx.json` and
:cpy-file:`Tools/build/generate_sbom.py`.

Updating external dependencies (``cpython-source-deps``)
Comment thread
sethmlarson marked this conversation as resolved.
--------------------------------------------------------

.. note::
Only core developers can push to the ``cpython-source-deps`` repository.

For this repo to maintain integrity, pull requests from contributors are not accepted. Instead of a pull request,
contributors should
create an issue requesting the updated
version and then wait for a core developer to prepare the new version
before proceeding with the next steps below.

Dependencies for Windows CPython builds are `stored in a separate repository
Comment thread
sethmlarson marked this conversation as resolved.
<https://github.com/python/cpython-source-deps>`_ and then fetched during
builds of CPython for Windows in the script :cpy-file:`PCbuild/get_externals.bat`.

In this :cpy-file:`PCbuild/get_externals.bat`, the libraries to fetch are designated by ``{name}-{version}``
Git refs being added to the ``libraries`` variable.

willingc Mar 6, 2024

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Would be helpful to clarify where the libraries variable is.

willingc Mar 11, 2024

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

This is still unclear.
SBOM tooling in the CPython repository matches these Git refs in order
to build the :cpy-file:`Misc/externals.spdx.json` SBOM file.

When updating external dependencies for a CPython branch:

1. Push the update to the ``cpython-source-deps`` repository and
create a new Git tag.
2. Update the entry for the project in ``get_externals.bat``.
3. Run ``make regen-sbom`` or ``PCbuild/build.bat --regen``
in the CPython source repository.
4. Use ``git diff`` to verify that the metadata (like version, download location)
in ``externals.spdx.json`` SBOM is updated as expected.
5. Commit the changes and have them merged together.
Back | FazBrowse Home | New Git URL