Skip to content

Commit 372f344

Browse files
committed
Polish SBOMs how-to for consistency with the rest of docs/
Stylistic pass so the new page reads like its neighbors: - Condense the 4-paragraph intro to one paragraph. - Move the "files end up in the wheel at…" sentence to right after the static-files code block, where it belongs in the reader's flow. - Fold the canonical-name-match note into the "File naming and validation" bullets rather than giving it its own standalone paragraph. - Drop the scientific-Python project name-drop; the page is meant to be generic, other how-to guides don't namecheck downstream users. - Normalize "artefact" / "recognised" to the American spelling the rest of docs/ use.
1 parent 9cec754 commit 372f344

2 files changed

Lines changed: 39 additions & 46 deletions

File tree

docs/how-to-guides/sboms.rst

Lines changed: 38 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,22 @@
88
Including SBOMs in wheels (PEP 770)
99
***********************************
1010

11-
`PEP 770`_ specifies that wheels may carry Software Bill of Materials
12-
(SBOM) documents under the ``.dist-info/sboms/`` directory.
13-
``meson-python`` places any file installed under
14-
``{py_purelib}/<distname>-<version>.dist-info/<subdir>/...`` into the
15-
wheel's ``.dist-info/<subdir>/`` at pack time. This is the mechanism
16-
scientific-Python projects (pandas, NumPy, SciPy, scikit-learn) use to
17-
ship SBOMs in their wheels without post-build wheel surgery.
18-
19-
The ``<distname>-<version>.dist-info`` directory name is recognised
20-
regardless of whether the user wrote the project name with hyphens or
21-
underscores — the comparison is canonicalised.
11+
`PEP 770`_ defines a location for Software Bill of Materials (SBOM)
12+
files inside the wheel's ``.dist-info/sboms/`` directory.
13+
``meson-python`` routes any file installed under
14+
``{py_purelib}/<name>-<version>.dist-info/<subdir>/...`` or
15+
``{py_platlib}/<name>-<version>.dist-info/<subdir>/...`` into the
16+
wheel's own ``.dist-info/<subdir>/`` at pack time, giving projects a
17+
way to ship SBOMs and other dist-info-bound metadata files without
18+
post-build wheel surgery.
2219

2320
.. _PEP 770: https://peps.python.org/pep-0770/
2421

2522
Static SBOM files
2623
=================
2724

28-
For SBOMs that are checked into the source tree (typically describing
29-
source-vendored components):
25+
For SBOMs that are checked into the source tree, typically describing
26+
source-vendored components:
3027

3128
.. code-block:: meson
3229
@@ -41,21 +38,17 @@ source-vendored components):
4138
install_dir: py.get_install_dir() / distinfo / 'sboms',
4239
)
4340
44-
``py.get_install_dir()`` returns a path under ``{py_purelib}`` for
45-
``pure: true`` projects and ``{py_platlib}`` for ``pure: false``
46-
(the common case when shipping C extensions). ``meson-python``
47-
recognises the distinfo prefix under either root.
48-
4941
The files end up in the wheel at
5042
``my_project-1.0.0.dist-info/sboms/component1.cdx.json`` and
51-
``component2.cdx.json``.
43+
``component2.cdx.json``. ``py.get_install_dir()`` returns a path under
44+
``{py_purelib}`` for ``pure: true`` projects and ``{py_platlib}`` for
45+
``pure: false`` projects; both roots are recognized.
5246

5347
Dynamically generated SBOMs
5448
===========================
5549

56-
Many projects generate the SBOM at build time from a TOML manifest of
57-
vendored components. Use a ``custom_target`` that produces the SBOM file
58-
and installs it to the same location:
50+
When the SBOM is generated at build time, use a ``custom_target`` that
51+
writes the file and installs it to the same location:
5952

6053
.. code-block:: meson
6154
@@ -67,36 +60,38 @@ and installs it to the same location:
6760
install_dir: py.get_install_dir() / distinfo / 'sboms',
6861
)
6962
70-
The generator runs during the build, and ``meson-python`` injects the
71-
output into ``my_project-1.0.0.dist-info/sboms/vendored.cdx.json``.
63+
The generator runs during the build, and the output is routed into
64+
``my_project-1.0.0.dist-info/sboms/vendored.cdx.json``.
7265

7366
Other ``.dist-info`` subdirectories
7467
===================================
7568

76-
Any subdirectory under the ``.dist-info`` directory works the same way.
77-
PEP 639 license files can be placed under ``licenses``, for example:
69+
Any subdirectory works the same way. Additional PEP 639 license files,
70+
for example, can go under ``licenses``:
7871

7972
.. code-block:: meson
8073
8174
install_data('LICENSES/extra.txt',
8275
install_dir: py.get_install_dir() / distinfo / 'licenses')
8376
84-
PEP 639 license files declared via ``project.license-files`` in
85-
``pyproject.toml`` are handled separately and go into
86-
``.dist-info/licenses/`` automatically (no ``meson.build`` change
87-
needed). Use the pattern above only for additional license files
88-
outside the standard ``project.license-files`` list.
77+
License files declared via ``project.license-files`` in
78+
``pyproject.toml`` are already placed in ``.dist-info/licenses/``
79+
automatically and do not need a ``meson.build`` entry. Use the pattern
80+
above only for additional files outside the standard
81+
``project.license-files`` list.
8982

9083
File naming and validation
9184
==========================
9285

93-
* Files installed under ``<distname>-<version>.dist-info/<subdir>/``
94-
must have unique basenames within their subdirectory. ``meson-python``
95-
raises an error at build time if two files would write to the same
96-
path inside ``.dist-info/<subdir>/``. The collision check covers
97-
files routed via this mechanism and PEP 639 license-files from
98-
``project.license-files``.
99-
* The recommended file extensions are ``.cdx.json`` for CycloneDX and
86+
* Files installed under ``<name>-<version>.dist-info/<subdir>/`` must
87+
have unique basenames within their subdirectory. ``meson-python``
88+
raises a ``BuildError`` at build time if two files would write to
89+
the same path, including collisions between files routed through
90+
this mechanism and files written from ``project.license-files``.
91+
* The ``<name>-<version>.dist-info`` directory name is matched
92+
canonically, so hyphens and underscores in the user's project name
93+
do not break routing.
94+
* Recommended file extensions are ``.cdx.json`` for CycloneDX and
10095
``.spdx.json`` for SPDX, per the PSF
10196
`SBOMs for Python packages`_ proposal.
10297

@@ -105,10 +100,8 @@ File naming and validation
105100
Editable installs
106101
=================
107102

108-
Files staged via this mechanism are placed in the wheel when
109-
``meson-python`` builds a regular wheel (``pip install .`` or
110-
``python -m build``). They are **not** included in editable wheels
111-
(``pip install -e .``), because editable wheels redirect imports to the
112-
build directory rather than carrying project files. SBOMs are intended
113-
for distribution artefacts, so this limitation generally does not
114-
affect development workflows.
103+
Files staged via this mechanism are only placed in non-editable wheels
104+
(``pip install .`` or ``python -m build``). Editable wheels
105+
(``pip install -e .``) redirect imports to the build directory and do
106+
not carry dist-info-bound payloads. Since SBOMs are distribution
107+
artifacts, this limitation does not affect development workflows.

mesonpy/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ def _map_to_wheel(
174174

175175
# Files staged under {py_purelib}/<our-distinfo>/... or
176176
# {py_platlib}/<our-distinfo>/... are routed into the wheel's
177-
# .dist-info/ at pack time. Both roots are recognised because a
177+
# .dist-info/ at pack time. Both roots are recognized because a
178178
# project built with pure: false installs into platlib (pandas,
179179
# numpy, scipy) while a pure-Python project uses purelib.
180180
# Authority for the distinfo dir name is the PEP 621 metadata;

0 commit comments

Comments
 (0)