Changelog¶

Unreleased¶

Expose MissingExtraError from python_sbom so callers can catch a missing optional dependency without importing the private errors module.

A wheel built from an sdist no longer warns that git cannot read the source revision when the sdist names the commit, as when uv builds it under the empty .git file it keeps in its cache (#10) by @gaborbernat.

A wheel’s SBOM now links to every other file in its .dist-info/sboms directory, such as maturin’s or auditwheel’s, by file name and SHA-256, and python-sbom validate also checks the .cyclonedx.json files maturin writes (#8) by @gaborbernat.

Give each build backend its own how-to page, under a new backends section, built around an example project whose build and check the test suite runs, and add one for maturin projects: what maturin’s SBOM and python-sbom’s each hold, and how to add python-sbom’s when a build frontend, maturin build or maturin-action builds the wheel (#8) by @gaborbernat.

Write the SBOM with any build backend: a pdm-backend hook and a setuptools plugin act for every project with a [tool.python-sbom] table, and python_sbom.backend wraps any other backend, such as meson-python or maturin, named by the new build-backend option. Each records the source revision in the sdist, as the hatchling hook does (#7) by @gaborbernat.

Load a project’s own content provider when the process already imported a module of the same name from another project, as a test suite building copies of one project does, instead of refusing it. The module cached from elsewhere is dropped with its submodules, and a provider loaded earlier keeps working (#5) by @gaborbernat.

First release on PyPI. The 0.1.0 tag was never published: its release build lacked hashes for the packages python-sbom’s own build hook needs, so 0.1.1 is the first release and carries everything listed under 0.1.0 (#4) by @gaborbernat.

Add the python-sbom hatchling build hook, which writes a CycloneDX 1.6 SBOM into each wheel, the Python API behind it, and the python-sbom command: embed writes the same SBOM into wheels other build backends build, archive describes another zip archive a project publishes, such as a zipapp, and with --embed adds that SBOM to it, deflated, spdx renders an SBOM as SPDX, and validate checks the SBOMs in wheels and archives against the official CycloneDX schema files python-sbom ships, with jsonschema-rs, and rejects one listing more than 100,000 components unless --max-components allows more (#2) by @gaborbernat.