10000 Add initial guide for maintaining Software Bill-of-Materials by sethmlarson · Pull Request #1251 · python/devguide · GitHub
[go: up one dir, main page]
Skip to content

Add initial guide for maintaining Software Bill-of-Materials #1251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 19, 2023
Merged

Add initial guide for maintaining Software Bill-of-Materials #1251

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c8e96f2
Add initial guide for maintaining Software Bill-of-Materials
sethmlarson Dec 18, 2023
4e60f1e
Incorporate review suggestions
sethmlarson Dec 18, 2023
e1e0fda
Flatten embedded lists, add more guidance for SBOM fields
sethmlarson Dec 19, 2023
3361cb2
Apply suggestions from code review
sethmlarson Dec 19, 2023
af05a5a
Fix inline code example
sethmlarson Dec 19, 2023
1090a1a
Add period to end of list item
sethmlarson Dec 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Apply suggestions from code review 
Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
  • Loading branch information
@sethmlarson @hugovk
sethmlarson and hugovk authored Dec 19, 2023
commit 3361cb2b19105c9b0d6b314deb8d1a9429b6ddeb
10 changes: 5 additions & 5 deletions developer-workflow/sbom.rst
8000
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,9 @@ The recommended workflow is:
update the embedded version within URLs and project identifiers.
Don't update any information in ``files`` and ``relationships`` as this will
be generated automatically by the SBOM tool.
4. Run ``$ make regen-sbom`` or :cpy-file:`Tools/build/generate_sbom.py`.
4. Run ``make regen-sbom`` or `` python Tools/build/generate_sbom.py``.
Ensure that this doesn't fail with validation errors.
5. Run ``$ git diff Misc/sbom.spdx.json`` and check the diff matches the
5. Run ``git diff Misc/sbom.spdx.json`` and check the diff matches the
expected changes.
6. Commit the changes to :cpy-file:`Misc/sbom.spdx.json` along with the
update to the dependency code.
Expand All @@ -56,7 +56,7 @@ When adding a dependency it's important to have the following information:
(`CPE <https://nvd.nist.gov/products/cpe>`_ and
`Package URLs <https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst>`_
or "PURLs")
* Path(s) to include and exclude in the CPython source tree corresponding to this dependency.
* Paths to include and exclude in the CPython source tree corresponding to this dependency

After gathering this information:

Expand Down Expand Up @@ -86,7 +86,7 @@ After gathering this information:
``SPDXRef-PACKAGE-*`` prefix) in :cpy-file:`Tools/build/generate_sbom.py`.
4. Run the tool with ``make regen-sbom`` or ``python Tools/build/generate_sbom.py``.
Ensure that the tool doesn't fail with any validation errors.
5. Compare the changes to :cpy-file:`Misc/sbom.spdx.json` with ``$ git diff``, check
5. Compare the changes to :cpy-file:`Misc/sbom.spdx.json` with ``git diff``, check
that all information appears correct.
6. Commit the changes to :cpy-file:`Misc/sbom.spdx.json` and
:cpy-file:`Tools/build/generate_sbom.py`.
Expand All @@ -103,7 +103,7 @@ When removing a dependency:
2. Remove the corresponding ``PackageFiles`` entry in :cpy-file:`Tools/build/generate_sbom.py`
3. Run the tool with ``make regen-sbom`` or ``python Tools/build/generate_sbom.py``.
Ensure that the tool doesn't fail with any validation errors.
4. Compare the changes to :cpy-file:`Misc/sbom.spdx.json` with ``$ git diff``, check
4. Compare the changes to :cpy-file:`Misc/sbom.spdx.json` with ``git diff``, check
that correct package is removed from the SBOM.
5. Commit the changes to :cpy-file:`Misc/sbom.spdx.json` and
:cpy-file:`Tools/build/generate_sbom.py`.
0