Describe a wheel built outside the build interface

Some wheels never pass through a python-sbom plugin or the wrapper backend: maturin-action calls maturin build directly, and auditwheel repair or delocate rename a wheel after the build and may copy libraries into it. python-sbom embed describes such a wheel after the fact. It writes the same document the plugins write, adds its RECORD row, keeps every other entry of the wheel as it was, and replaces an SBOM python-sbom wrote before.

Embed after the build

Run it from the project root, so it finds [tool.python-sbom]. For docs/examples/maturin, built with maturin build:

$ maturin build --release --out dist
$ python-sbom embed dist/*.whl
wrote greet-1.0.dist-info/sboms/greet.cdx.json into greet-1.0-py3-none-manylinux_2_34_x86_64.whl
$ python-sbom validate dist/
SBOM in greet-1.0-py3-none-manylinux_2_34_x86_64.whl is valid

Record the real build tools

embed lists the packages of the environment --build-env names, by default the one it runs in, and always the interpreter it runs on. Unless that is the environment the wheel was built in, the record does not match the real build. Either build without isolation in the environment embed runs in, installed from the same lock:

$ python -m pip install build python-sbom meson-python meson ninja patchelf
$ python -m build --wheel --no-isolation
$ python-sbom embed dist/*.whl

or install the build requirements into an environment of their own and point --build-env at its site-packages:

$ python -m venv build-env && build-env/bin/pip install maturin
$ python-sbom embed dist/*.whl --build-env build-env/lib/python3.15/site-packages

After a repair

Run embed on the repaired wheel, so the SBOM names the file you publish:

cibuildwheel builds docs/examples/auditwheel, a meson-python project whose extension links libuuid, in a manylinux container, and auditwheel copies libuuid into the wheel:

$ cibuildwheel --only cp313-manylinux_x86_64 --output-dir wheelhouse
$ python-sbom embed wheelhouse/*.whl
wrote greet-1.0.dist-info/sboms/greet.cdx.json into greet-1.0-cp313-cp313-manylinux_2_28_x86_64.whl

auditwheel’s own SBOM, auditwheel.cdx.json, stays in the wheel next to python-sbom’s, which links to it by its file name and SHA-256. The auditwheel.cdx.json written here lists the wheel twice under one bom-ref, which CycloneDX forbids, so python-sbom validate rejects this wheel.

On macOS, delocate repairs the wheel of docs/examples/meson-python:

$ python -m build --wheel
$ delocate-wheel --wheel-dir wheelhouse dist/*.whl
$ python-sbom embed wheelhouse/*.whl
wrote greet-1.0.dist-info/sboms/greet.cdx.json into greet-1.0-cp315-cp315-macosx_11_0_arm64.whl

Name the source revision

embed reads the commit from the checkout it runs in. A wheel built from an sdist elsewhere names its commit through --commit or the PYTHON_SBOM_COMMIT environment variable; Configuration lists the order in which python-sbom looks for it.