88Including SBOMs in wheels (PEP 770)
99***********************************
1010
11- `PEP 770 `_ specifies that wheels may carry Software Bill of Materials
12- (SBOM) documents under the ``.dist-info/sboms/ `` directory.
13- ``meson-python `` places any file installed under
14- ``{py_purelib}/<distname>-<version>.dist-info/<subdir>/... `` into the
15- wheel's ``.dist-info/<subdir>/ `` at pack time. This is the mechanism
16- scientific-Python projects (pandas, NumPy, SciPy, scikit-learn) use to
17- ship SBOMs in their wheels without post-build wheel surgery.
18-
19- The ``<distname>-<version>.dist-info `` directory name is recognised
20- regardless of whether the user wrote the project name with hyphens or
21- underscores — the comparison is canonicalised.
11+ `PEP 770 `_ defines a location for Software Bill of Materials (SBOM)
12+ files inside the wheel's ``.dist-info/sboms/ `` directory.
13+ ``meson-python `` routes any file installed under
14+ ``{py_purelib}/<name>-<version>.dist-info/<subdir>/... `` or
15+ ``{py_platlib}/<name>-<version>.dist-info/<subdir>/... `` into the
16+ wheel's own ``.dist-info/<subdir>/ `` at pack time, giving projects a
17+ way to ship SBOMs and other dist-info-bound metadata files without
18+ post-build wheel surgery.
2219
2320.. _PEP 770 : https://peps.python.org/pep-0770/
2421
2522Static SBOM files
2623=================
2724
28- For SBOMs that are checked into the source tree ( typically describing
29- source-vendored components) :
25+ For SBOMs that are checked into the source tree, typically describing
26+ source-vendored components:
3027
3128.. code-block :: meson
3229
@@ -41,21 +38,17 @@ source-vendored components):
4138 install_dir: py.get_install_dir() / distinfo / 'sboms',
4239 )
4340
44- ``py.get_install_dir() `` returns a path under ``{py_purelib} `` for
45- ``pure: true `` projects and ``{py_platlib} `` for ``pure: false ``
46- (the common case when shipping C extensions). ``meson-python ``
47- recognises the distinfo prefix under either root.
48-
4941 The files end up in the wheel at
5042``my_project-1.0.0.dist-info/sboms/component1.cdx.json `` and
51- ``component2.cdx.json ``.
43+ ``component2.cdx.json ``. ``py.get_install_dir() `` returns a path under
44+ ``{py_purelib} `` for ``pure: true `` projects and ``{py_platlib} `` for
45+ ``pure: false `` projects; both roots are recognized.
5246
5347Dynamically generated SBOMs
5448===========================
5549
56- Many projects generate the SBOM at build time from a TOML manifest of
57- vendored components. Use a ``custom_target `` that produces the SBOM file
58- and installs it to the same location:
50+ When the SBOM is generated at build time, use a ``custom_target `` that
51+ writes the file and installs it to the same location:
5952
6053.. code-block :: meson
6154
@@ -67,36 +60,38 @@ and installs it to the same location:
6760 install_dir: py.get_install_dir() / distinfo / 'sboms',
6861 )
6962
70- The generator runs during the build, and `` meson-python `` injects the
71- output into ``my_project-1.0.0.dist-info/sboms/vendored.cdx.json ``.
63+ The generator runs during the build, and the output is routed into
64+ ``my_project-1.0.0.dist-info/sboms/vendored.cdx.json ``.
7265
7366Other ``.dist-info `` subdirectories
7467===================================
7568
76- Any subdirectory under the `` .dist-info `` directory works the same way.
77- PEP 639 license files can be placed under ``licenses ``, for example :
69+ Any subdirectory works the same way. Additional PEP 639 license files,
70+ for example, can go under ``licenses ``:
7871
7972.. code-block :: meson
8073
8174 install_data('LICENSES/extra.txt',
8275 install_dir: py.get_install_dir() / distinfo / 'licenses')
8376
84- PEP 639 license files declared via ``project.license-files `` in
85- ``pyproject.toml `` are handled separately and go into
86- `` .dist-info/licenses/ `` automatically (no ``meson.build `` change
87- needed). Use the pattern above only for additional license files
88- outside the standard ``project.license-files `` list.
77+ License files declared via ``project.license-files `` in
78+ ``pyproject.toml `` are already placed in `` .dist-info/licenses/ ``
79+ automatically and do not need a ``meson.build `` entry. Use the pattern
80+ above only for additional files outside the standard
81+ ``project.license-files `` list.
8982
9083File naming and validation
9184==========================
9285
93- * Files installed under ``<distname>-<version>.dist-info/<subdir>/ ``
94- must have unique basenames within their subdirectory. ``meson-python ``
95- raises an error at build time if two files would write to the same
96- path inside ``.dist-info/<subdir>/ ``. The collision check covers
97- files routed via this mechanism and PEP 639 license-files from
98- ``project.license-files ``.
99- * The recommended file extensions are ``.cdx.json `` for CycloneDX and
86+ * Files installed under ``<name>-<version>.dist-info/<subdir>/ `` must
87+ have unique basenames within their subdirectory. ``meson-python ``
88+ raises a ``BuildError `` at build time if two files would write to
89+ the same path, including collisions between files routed through
90+ this mechanism and files written from ``project.license-files ``.
91+ * The ``<name>-<version>.dist-info `` directory name is matched
92+ canonically, so hyphens and underscores in the user's project name
93+ do not break routing.
94+ * Recommended file extensions are ``.cdx.json `` for CycloneDX and
10095 ``.spdx.json `` for SPDX, per the PSF
10196 `SBOMs for Python packages `_ proposal.
10297
@@ -105,10 +100,8 @@ File naming and validation
105100Editable installs
106101=================
107102
108- Files staged via this mechanism are placed in the wheel when
109- ``meson-python `` builds a regular wheel (``pip install . `` or
110- ``python -m build ``). They are **not ** included in editable wheels
111- (``pip install -e . ``), because editable wheels redirect imports to the
112- build directory rather than carrying project files. SBOMs are intended
113- for distribution artefacts, so this limitation generally does not
114- affect development workflows.
103+ Files staged via this mechanism are only placed in non-editable wheels
104+ (``pip install . `` or ``python -m build ``). Editable wheels
105+ (``pip install -e . ``) redirect imports to the build directory and do
106+ not carry dist-info-bound payloads. Since SBOMs are distribution
107+ artifacts, this limitation does not affect development workflows.
0 commit comments