Figure out how to use PEP770 (SBOM)

[alex]

Goal:

• Nothing in our sdists (we don't vendor anything)
• Our wheels contain:
  • SBOM for all used cargo deps
  • SBOM for OpenSSL, if linked statically

[reaperhulk]

Does any tooling exist yet or is it all just metadata definition?

[alex]

The PEP was approved like yesterday, so I don't think anything exists for it.

[alex]

I guess there's a feature request here for maturin to include an SBOM for all cargo packages?

[alex]

Filed PyO3/maturin#2554

[reaperhulk]

Should we be looking at pep725 as well?

[alex]

It's not standardized yet.

…

On Sun, Apr 13, 2025 at 1:06 PM Paul Kehrer ***@***.***> wrote: Should we be looking at pep725 as well? — Reply to this email directly, view it on GitHub <#12764 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBBFNS7L6IPH3JMLNXL2ZKRQZAVCNFSM6AAAAAB3BG3N22VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQMBQGA2TOMRXGE> . You are receiving this because you authored the thread.Message ID: ***@***.***> *reaperhulk* left a comment (pyca/cryptography#12764) <#12764 (comment)> Should we be looking at pep725 as well? — Reply to this email directly, view it on GitHub <#12764 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBBFNS7L6IPH3JMLNXL2ZKRQZAVCNFSM6AAAAAB3BG3N22VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQMBQGA2TOMRXGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.