Repository navigation
Add Software Bill-of-Materials for Windows source dependencies #112844
Description
Activity
FTR, historically, macOS installer builds do not use
cpython-source-depsand there are no plans to do so. That repo was created specifically for Windows builds and has contained patches to various upstream releases (like here) that might not apply to other platforms and doesn't contain patches that may be needed on other platforms like for the macOS installer.Reacted by Seth Larson@ned-deily That's good to know that these sources are patched! Ack on macOS, I must have misremembered something else.
FTR, I have no concerns about that repo containing patches for other platforms. Virtually all the time those patches are taken from upstream, so they'll work everywhere.
When we patch, we add another tag with an extra version field (e.g. the 8.6.13**.1** I just tagged for Tcl and Tk). And a particular release of Python should always pull from a tag, and those are only listed in
get_externals.bat(there are other references in some of the.propsfiles, but those aren't as easy to parse out).Reacted by Seth Larson- added a commit that references this issue
on Feb 29, 2024 - added a commit that references this issue
on Apr 16, 2024 - added a commit that references this issue
on Apr 16, 2024 Going to close this issue as we now have Windows SBOMs containing source dependencies for 3.13.0b1 🥳
Reacted by Hugo van Kemenade
Proposal:
Part of #112302
An SBOM document has been added for dependencies within CPython itself. This document is kept up-to-date using tooling and CI within the CPython repository. For building the Windows there exists a repository
cpython-source-depswhich "mirrors" the source code of projects not in the CPython git repo.These dependencies are pulled in optionally, I still need to investigate what combinations are possible, but I know the possible projects and versions for each CPython branch is captured currently in
PCBuild/get_externals.bat.Will be investigating what the best method for creating an SBOM for these dependencies such that release-tools can stitch it into the final SBOMs that are distributed with release artifacts. There's a chance that no work needs to be done on this repository, in that case this issue will be migrated.
cc @zooba @ned-deily @ambv
Has this already been discussed elsewhere?
See the Discourse topic
Linked PRs