GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Add Software Bill-of-Materials for Windows source dependencies · Issue #112844 · python/cpython

Add Software Bill-of-Materials for Windows source dependencies #112844

New issue
Copy link
New issue
Copy link
Closed
Closed
Add Software Bill-of-Materials for Windows source dependencies#112844
Copy link
Labels
type-featureA feature request or enhancementA feature request or enhancementtype-securityA security issueA security issue

Description

@sethmlarson
sethmlarson
opened on Dec 7, 2023
Issue body actions

Proposal:

Part of #112302

An SBOM document has been added for dependencies within CPython itself. This document is kept up-to-date using tooling and CI within the CPython repository. For building the Windows there exists a repository cpython-source-deps which "mirrors" the source code of projects not in the CPython git repo.

These dependencies are pulled in optionally, I still need to investigate what combinations are possible, but I know the possible projects and versions for each CPython branch is captured currently in PCBuild/get_externals.bat.

Will be investigating what the best method for creating an SBOM for these dependencies such that release-tools can stitch it into the final SBOMs that are distributed with release artifacts. There's a chance that no work needs to be done on this repository, in that case this issue will be migrated.

cc @zooba @ned-deily @ambv

Has this already been discussed elsewhere?

See the Discourse topic

Linked PRs

  • gh-112844: Add SBOM for external dependencies #115789
  • [3.12] gh-112844: Add SBOM for external dependencies (GH-115789) #116128
  • gh-112844: Fix xz CPE identifier #117656
  • [3.12] gh-112844: Fix xz CPE identifier (GH-117656) #117951
  • gh-112844: Update CPE references for external dependencies #118521
  • [3.13] gh-112844: Update CPE references for external dependencies (GH-118521) #119237
  • [3.12] gh-112844: Update CPE references for external dependencies (GH-118521) #119238

Activity

  1. sethmlarson
    added
    type-featureA feature request or enhancementA feature request or enhancement
    type-securityA security issueA security issue
    on Dec 7, 2023
  2. ned-deily commented on Dec 7, 2023

    @ned-deily
    ned-deily
    on Dec 7, 2023
    Member
    More actions

    FTR, historically, macOS installer builds do not use cpython-source-deps and there are no plans to do so. That repo was created specifically for Windows builds and has contained patches to various upstream releases (like here) that might not apply to other platforms and doesn't contain patches that may be needed on other platforms like for the macOS installer.

    Reacted by Seth Larson
  3. sethmlarson commented on Dec 7, 2023

    @sethmlarson
    sethmlarson
    on Dec 7, 2023
    ContributorAuthor
    More actions

    @ned-deily That's good to know that these sources are patched! Ack on macOS, I must have misremembered something else.

  4. zooba commented on Dec 8, 2023

    @zooba
    zooba
    on Dec 8, 2023
    Member
    More actions

    FTR, I have no concerns about that repo containing patches for other platforms. Virtually all the time those patches are taken from upstream, so they'll work everywhere.

    When we patch, we add another tag with an extra version field (e.g. the 8.6.13**.1** I just tagged for Tcl and Tk). And a particular release of Python should always pull from a tag, and those are only listed in get_externals.bat (there are other references in some of the .props files, but those aren't as easy to parse out).

    Reacted by Seth Larson
  5. hugovk
    added a commit that references this issue on Feb 29, 2024

    gh-112844: Add SBOM for external dependencies (#115789)

    45d8871
  6. miss-islington
    added a commit that references this issue on Feb 29, 2024

    pythongh-112844: Add SBOM for external dependencies (pythonGH-115789)

    1808fa9
  7. hugovk
    added a commit that references this issue on Feb 29, 2024

    [3.12] gh-112844: Add SBOM for external dependencies (GH-115789) (#11…

    211b559
  8. woodruffw
    added a commit that references this issue on Mar 4, 2024

    pythongh-112844: Add SBOM for external dependencies (python#115789)

    0ae4d31
  9. adorilson
    added a commit that references this issue on Mar 25, 2024

    pythongh-112844: Add SBOM for external dependencies (python#115789)

    cb268aa
  10. zooba
    added a commit that references this issue on Apr 16, 2024

    gh-112844: Fix xz CPE identifier (GH-117656)

    d70ee13
  11. miss-islington
    added a commit that references this issue on Apr 16, 2024

    pythongh-112844: Fix xz CPE identifier (pythonGH-117656)

    21c1366
  12. zooba
    added a commit that references this issue on Apr 16, 2024

    gh-112844: Fix xz CPE identifier (GH-117656)

    d9e2126
  13. diegorusso
    added 2 commits that reference this issue on Apr 17, 2024

    pythongh-112844: Add SBOM for external dependencies (python#115789)

    0bf848d

    pythongh-112844: Fix xz CPE identifier (pythonGH-117656)

    f539091
  14. sethmlarson
    added a commit that references this issue on May 2, 2024

    pythongh-112844: Update CPE references for external dependencies

    c4b0175
  15. sethmlarson commented on May 8, 2024

    @sethmlarson
    sethmlarson
    on May 8, 2024
    ContributorAuthor
    More actions

    Going to close this issue as we now have Windows SBOMs containing source dependencies for 3.13.0b1 🥳

    Reacted by Hugo van Kemenade
  16. sethmlarson
    closed this as completedon May 8, 2024
  17. hugovk
    added a commit that references this issue on May 20, 2024

    gh-112844: Update CPE references for external dependencies (#118521)

    1195c16
  18. miss-islington
    added 2 commits that reference this issue on May 20, 2024

    pythongh-112844: Update CPE references for external dependencies (pyt…

    a61746a

    pythongh-112844: Update CPE references for external dependencies (pyt…

    2986afb
  19. hugovk
    added 2 commits that reference this issue on May 20, 2024

    [3.13] gh-112844: Update CPE references for external dependencies (GH…

    d8c562a

    [3.12] gh-112844: Update CPE references for external dependencies (GH…

    386e492
  20. estyxx
    added a commit that references this issue on Jul 17, 2024

    pythongh-112844: Update CPE references for external dependencies (pyt…

    edbc761
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-featureA feature request or enhancementA feature request or enhancementtype-securityA security issueA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.