Repository navigation

✨ feat: generate PEP 770 SBOMs for Python wheels - #2

Merged

gaborbernat merged 115 commits into

mainfrom

add-sbom-hook

Nov 8, 2026

Merged

✨ feat: generate PEP 770 SBOMs for Python wheels#2
gaborbernat merged 115 commits into
mainfrom
add-sbom-hook

Commits on Nov 7, 2026
- 🔧 build: add project tooling and policies
  gaborbernat
  committed
  5513268
- ✨ feat: add the PEP 770 SBOM build hook
  gaborbernat
  committed
  5c0a18b
- 👷 ci: add check, release and security workflows
  gaborbernat
  committed
  041efed
- 📝 docs: pin the first release in the example
  gaborbernat
  committed
  a692292
- ♻️ refactor: split into private modules, add embed
  gaborbernat
  committed
  b57cafb
- 📝 docs: add the Read the Docs site
  gaborbernat
  committed
  6b77aea
- 🔧 build: adopt the bump-deps-index tooling
  gaborbernat
  committed
  6092cc2
- 🚚 refactor: rename the project to python-sbom
  gaborbernat
  committed
  522b147
- 🐛 fix: hash absolute build scripts on Windows
  gaborbernat
  committed
  993f1a7
- 👷 ci: trim the check matrix to 13 jobs
  gaborbernat
  committed
  1120300
- ✅ test: build the bundled seed wheel at test time
  gaborbernat
  committed
  2c0a899
- ♻️ refactor: split the core from the hatch backend
  gaborbernat
  committed
  f91c1c9
- 🔒 build: relock for the hatch extra and docs deps
  gaborbernat
  committed
  e9efe48
- ♻️ refactor: rebuild around one SBOM pipeline
  gaborbernat
  committed
  9f55e4a
- 📦 build: embed the project's own SBOM
  gaborbernat
  committed
  c4bc75c
- 📝 docs: document providers and the pipeline
  gaborbernat
  committed
  2891f8a
- 🔧 chore: align repository files with conventions
  gaborbernat
  committed
  26b526e
- ♻️ refactor: break the CLI options import cycle
  gaborbernat
  committed
  c45b6ef
- 🐛 fix: import TypeIs only when type checking
  gaborbernat
  committed
  af0e85f
- ♻️ refactor: shrink the API to the provider seam
  gaborbernat
  committed
  5238152
- 📝 docs: document providers and the archive command
  gaborbernat
  committed
  ab7d9f0
- 🔧 chore: follow bump-deps-index tooling
  gaborbernat
  committed
  d4ebc94
- 📝 docs: match the virtualenv example to its patch
  gaborbernat
  committed
  86def47
- 🚧 wip: adopt libraries, cap validation, bench
  gaborbernat
  committed
  6e4335e
- [pre-commit.ci] auto fixes from pre-commit.com hooks
  pre-commit-ci[bot]
  committed
  764f69a
- ♻️ refactor: parse dist-info files with installer
  gaborbernat
  committed
  3bdd22e
- 🔒 build: lock dep-logic
  gaborbernat
  committed
  2d87c0d
- ✅ test: pin embed output byte for byte
  gaborbernat
  committed
  0c4aba6
- ⏪ revert: evaluate markers without dep-logic
  gaborbernat
  committed
  95af3d1
- ⚡ perf: read build-env RECORDs directly
  gaborbernat
  committed
  ed0130b
- ⚡ perf: copy wheel members without recompressing
  gaborbernat
  committed
  ff8e0fc
- 📝 docs: say why the CycloneDX model is our own
  gaborbernat
  committed
  d89b69a
- ♻️ refactor: parse core metadata with packaging
  gaborbernat
  committed
  f986ea0
- ⚡ perf: finish the pyperf benchmark harness
  gaborbernat
  committed
  778cd1b
- 🔒 build: lock the bench dependency group
  gaborbernat
  committed
  2832b0c
- 🐛 fix(bench): keep hostile documents at their count
  gaborbernat
  committed
  d901f72
- ⚡ perf: check uniqueItems in one pass
  gaborbernat
  committed
  2bdde37
- ⚡ perf: settle most iri-reference checks by regex
  gaborbernat
  committed
  be210dc
- ⚡ perf: validate the schema with jsonschema-rs
  gaborbernat
  committed
  cfe70dc
- 📦 build: ship the CycloneDX schema files
  gaborbernat
  committed
  9749e0e
- ✨ feat: raise the default component cap to 100,000
  gaborbernat
  committed
  60381fc
- ⚡ perf: count components before loading the validator
  gaborbernat
  committed
  2ca7b51
- 📝 docs: add the performance changelog fragment
  gaborbernat
  committed
  e7dcf48
- 🐛 fix: compress the SBOM archive --embed adds
  gaborbernat
  committed
  0033c11
- ⚡ perf: parse only the metadata headers
  gaborbernat
  committed
  ad06520
- ⚡ perf: verify bundled wheels in parallel
  gaborbernat
  committed
  fa8c3fd
- ⚡ perf: copy the wheel through the process
  gaborbernat
  committed
  0dcafe6
- ⚡ perf: match uv cache files without a regex
  gaborbernat
  committed
  e5213ad
- ⚡ perf: load the hook's wheel code only for wheels
  gaborbernat
  committed
  f014f18
- ⚡ perf: load each command's modules when it runs
  gaborbernat
  committed
  286033c
- 📝 docs: wrap comments and prose at 120
  gaborbernat
  committed
  7114bfe
- ♻️ refactor: build every artifact's SBOM in one place
  gaborbernat
  committed
  edb4357
- 🐛 fix: fail the build on contributions validate rejects
  gaborbernat
  committed
  9faebb2
- ♻️ refactor: resolve the content provider in one place
  gaborbernat
  committed
  83e18c8
- ✅ test: check member types in the API closure
  gaborbernat
  committed
  94ffd78
- 🐛 fix: read archives from the zip, not the disk
  gaborbernat
  committed
  06c6f74
- ♻️ refactor: write every zip entry one way
  gaborbernat
  committed
  09c0aa4
- 📦 build: declare the schemas' Apache-2.0 license
  gaborbernat
  committed
  53a236e
- ✅ test: validate the built wheel's own SBOM
  gaborbernat
  committed
  744e8f7
- 📝 docs(changelog): fold validation into feature
  gaborbernat
  committed
  a8a6897
- 📝 docs(security): name python-sbom archive
  gaborbernat
  committed
  fee1ec2
- 📝 docs(extend): show the tested seeder hook
  gaborbernat
  committed
  6daa53e
- 📝 docs(extend): read RECORD to list files
  gaborbernat
  committed
  4a3d379
- 📝 docs(contributing): explain updating the schemas
  gaborbernat
  committed
  f48e640
- 📝 docs(contributing): describe the benchmarks
  gaborbernat
  committed
  9fce8b9
- 📝 docs(explanation): drop the drifting SBOM size
  gaborbernat
  committed
  7ca9c92
- 📝 docs(explanation): split the architecture intro
  gaborbernat
  committed
  3929e46
- 📝 docs(bench): explain why _once stays apart
  gaborbernat
  committed
  75ca33b
- 🐛 fix: keep requirements if packaging's tree moves
  gaborbernat
  committed
  5b9bb66
- 🐛 fix: copy the Keywords header as declared
  gaborbernat
  committed
  286ee5c
- ♻️ refactor: share one JSON alias and text cap
  gaborbernat
  committed
  66ec241
- 🐛 fix: blame the JSON parser for deep nesting
  gaborbernat
  committed
  7648ccb
- 🐛 fix: report a broken validate extra as missing
  gaborbernat
  committed
  ab339fb
- 🐛 fix: tie the SBOM size limit to the component cap
  gaborbernat
  committed
  760c7af
- 🐛 fix: report an SBOM that is not UTF-8
  gaborbernat
  committed
  bba7956
- ⚡ perf: check the SPDX rendering in linear time
  gaborbernat
  committed
  9a61125
- ♻️ refactor(model): share one component walker
  gaborbernat
  committed
  6e12241
- ✅ test(content): check the falsy provider is falsy
  gaborbernat
  committed
  f1ae1ea
- ♻️ refactor(model): rename the namespace params
  gaborbernat
  committed
  316278c
- ♻️ refactor: move revision_reader to _collect
  gaborbernat
  committed
  e3f91fe
- ♻️ refactor: drop parameters callers fill alike
  gaborbernat
  committed
  c5d5ea5
- ♻️ refactor: unnest the double-loop comprehensions
  gaborbernat
  committed
  5035b7a
- 🎨 style: keep suppressions within 120 columns
  gaborbernat
  committed
  9bc21af
- ✅ test(bom): parametrize the bundled supplier
  gaborbernat
  committed
  cf5d589
- ✅ test(embed): pin the Python version with mocker
  gaborbernat
  committed
  16d9ad7
- 🐛 fix(model): link files at the built commit
  gaborbernat
  committed
  1263180
- 🐛 fix(model): encode URLs validate would reject
  gaborbernat
  committed
  eb3cd2b
- ♻️ refactor: walk components the same way in validate
  gaborbernat
  committed
  4331139
- ♻️ refactor: give each command its own module
  gaborbernat
  committed
  76676dd
- 📝 docs(cli): describe the spdx command
  gaborbernat
  committed
  5ddcba2
- 🐛 fix: refuse a --max-components below one
  gaborbernat
  committed
  0b53ee0
- 📝 docs(cli): say the component cap sets the size
  gaborbernat
  committed
  1aea9a3
- 🐛 fix: report unreadable spdx input without a trace
  gaborbernat
  committed
  13dcb69
- 🐛 fix: read the source revision once per build
  gaborbernat
  committed
  0d4fd8e
- 🐛 fix: remove the sdist revision file after the build
  gaborbernat
  committed
  18810cf
- 🎨 style: fit the hook's suppressions in 120 columns
  gaborbernat
  committed
  b9bb91a
- 🐛 fix: record the revision in python-sbom's own sdist
  gaborbernat
  committed
  9395d00
- ✅ test: check one behaviour per CLI and hook test
  gaborbernat
  committed
  a935e88
- ⚡ perf: keep validation out of --help and --version
  gaborbernat
  committed
  09c3254
- ♻️ refactor: raise one error class
  gaborbernat
  committed
  b3728af
- 📝 docs: redraw the architecture from the imports
  gaborbernat
  committed
  952da4c
- 🐛 fix: pass the docs and coverage checks
  gaborbernat
  committed
  e1919d4
- 🐛 fix: normalize every pypi purl name
  gaborbernat
  committed
  8112d47
- ⚡ perf: load the license parser only for a policy
  gaborbernat
  committed
  9ea289b
- ⚡ perf: stack only containers in the census
  gaborbernat
  committed
  84412c7
- ⚡ perf: read build-env WHEEL and requirements once
  gaborbernat
  committed
  1425769
- ✨ feat: deflate the SBOM archive --embed adds
  gaborbernat
  committed
  f189bf1
- 🧪 test(spdx): nest deep enough for every stack
  gaborbernat
  committed
  9b29173
- ♻️ refactor: give archive the wheel's layering
  gaborbernat
  committed
  aab7c01
- ♻️ refactor: move bundled wheel checks into _wheel
  gaborbernat
  committed
  4b05ac0
- ♻️ refactor: name bundled wheels while reading them
  gaborbernat
  committed
  eb528e9
- ♻️ refactor: ask providers in component order
  gaborbernat
  committed
  dd1eb38
- 🐛 fix(archive): refuse or describe odd bundled layouts
  gaborbernat
  committed
  79f8dde
- ♻️ refactor: share artifact reads and graph rules
  gaborbernat
  committed
  e8ca8f6
Commits on Nov 8, 2026
- ⬆️ ci: pin github-workflows 6.7.2
  gaborbernat
  committed
  0d98857

Commits

Commits on Nov 7, 2026

Commits on Nov 8, 2026