Repository navigation
SBOM generator should not look for a pip wheel in a fixed location #114244
Description
Bug report
Bug description:
In Fedora Linux, when building Python RPM, we remove the bundled pip wheel. We use an RPM build available in the system instead.
In the past, a new option was added to Python to define a custom location for that wheel: --with-wheel-pkg-dir (#87022).
generate_sbom.py doesn't count with this possibility, it looks for pip in a hardcoded location and errors if not found.
Even if there was an option to skip the search for pip wheel, would it mean that sbom.spdx.json is shipped in the built Python with incorrect data?
Also, please note that pip bundles a lot of other libraries and the actual project license, if was to reflect that reality, would be tad more complicated, see: Fedora's pip license tag. In https://github.com/python/cpython/blob/main/Misc/sbom.spdx.json#L1719 there's declared MIT only.
(Additionally, we also use the system expat and _decimal/libmpdec libraries instead of the Python copies, which are hardcoded the same way in the script, so there surely will be more issues with the generated metadata if we were trying to create SBOM as downstream repackagers)
CPython versions tested on:
3.13
Operating systems tested on:
Linux
Activity
hugovk commentedon Jan 18, 2024
cc @sethmlarson
sethmlarson commentedon Jan 18, 2024
Thanks for opening this @befeleme!
I created #114250 to address the licensing expression issue for pip wrt bundled dependencies, please take a look at my proposal there.
I wanted to ask how you were intending to use the SBOM being generated (if at all!) or if the issues you're seeing here are more incidental due to being included in
make regen-all. Currently the SBOM itself and tooling around it is being built with the artifacts hosted on python.org/downloads in mind but if it can be useful for others then I would like to learn more :)hroncok commentedon Jan 18, 2024
Technically speaking, if we (Fedora) were to ship the SBOM to our users (which I belive we are not doing unless it's installed by default), we would want pip to be skipped, because it's not part of our Python package, but it's only required. The version available at Python build time might not be the same version that's going to be used, as we update the pip wheel independently.
befeleme commentedon Jan 19, 2024
If regen-sbom was to be a part of regen-all, we'd probably appreciate most a possibility to configure which packages should/not be taken into account when generating the file.
00418: Don't generate sbom in make regen-all
00418: Don't generate sbom in make regen-all
00418: Don't generate sbom in make regen-all
00418: Don't generate sbom in make regen-all