Use it with meson-python

meson-python has no plugin interface, so its projects get the SBOM through the wrapper backend. Make python_sbom.backend the project’s backend, keep meson-python in the build requirements, and name mesonpy in [tool.python-sbom] build-backend:

pyproject.toml

[build-system]
build-backend = "python_sbom.backend"
requires = [ "meson>=1.6", "meson-python>=0.18", "ninja", "python-sbom>=0.3" ]

[project]
name = "greet"
version = "1.0"
description = "says hello"
license = "MIT"
requires-python = ">=3.11"
classifiers = [
  "Programming Language :: Python :: 3 :: Only",
  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Programming Language :: Python :: 3.14",
  "Programming Language :: Python :: 3.15",
]
dependencies = [ "packaging>=24" ]

[tool.python-sbom]
build-backend = "mesonpy"
supplier = { name = "You", url = [ "https://github.com/you" ] }

meson.build

project('greet', 'c', version: '1.0')

py = import('python').find_installation(pure: false)
py.extension_module('_greet', 'src/greet/_greet.c', install: true, subdir: 'greet')
py.install_sources('src/greet/__init__.py', 'src/greet/cli.py', subdir: 'greet')

Then build a wheel and check it:

$ python -m build --wheel
$ python-sbom validate dist/
SBOM in greet-1.0-cp315-cp315-linux_x86_64.whl is valid

docs/examples/meson-python holds the whole project. Use it with any other backend describes what the wrapper does with each hook.

Pitfall: an sdist outside a checkout

meson-python builds an sdist with meson dist, which needs a git or Mercurial checkout; the wrapper changes nothing there.

Pitfall: a repair after the build

cibuildwheel repairs a Linux wheel with auditwheel, which renames it to its manylinux tag, and a macOS one with delocate. Both may copy shared libraries into the wheel, and the SBOM the wrapper wrote names neither those libraries nor the new file name. Run python-sbom embed on the repaired wheel, as After a repair shows with this project.