Embed SBOM into wheels (#9679)

Co-authored-by: Andrew Murray <radarhere@users.noreply.github.com>
Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Author: hugovk

.github/embed-sbom.py

@@ -0,0 +1,96 @@
+"""Embed Pillow's SBOM into each wheel's `.dist-info/sboms/` directory,
+as specified by PEP 770.
+
+The SBOM (produced by `generate-sbom.py`) is injected into every `.whl` in
+the given directory, updating each wheel's `RECORD` so the result remains a
+valid, installable wheel.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import zipfile
+from pathlib import Path
+
+
+def record_entry(path: str, data: bytes) -> bytes:
+    """Build a RECORD line: `path,sha256=<base64url-nopad>,<size>`."""
+    digest = base64.urlsafe_b64encode(hashlib.sha256(data).digest())
+    return (
+        path.encode("utf-8")
+        + b",sha256="
+        + digest.rstrip(b"=")
+        + b","
+        + str(len(data)).encode()
+    )
+
+
+def embed(wheel: Path, sbom: Path) -> None:
+    with zipfile.ZipFile(wheel) as zf:
+        infos = zf.infolist()
+        contents = {info.filename: zf.read(info.filename) for info in infos}
+
+    record_name = next(
+        name
+        for name in contents
+        if name.endswith(".dist-info/RECORD") and name.count("/") == 1
+    )
+    dist_info = record_name.split("/", 1)[0]
+
+    sbom_bytes = sbom.read_bytes()
+    sbom_path = f"{dist_info}/sboms/{sbom.name}"
+
+    # Append a matching RECORD line for the SBOM (RECORD's own line has no hash).
+    lines = contents[record_name].splitlines()
+    lines.append(record_entry(sbom_path, sbom_bytes))
+    contents[record_name] = b"\n".join(lines) + b"\n"
+
+    with zipfile.ZipFile(wheel, "w", zipfile.ZIP_DEFLATED) as zf:
+        # Re-use each original ZipInfo to preserve timestamps, mode bits and
+        # compression; only RECORD's contents change
+        for info in infos:
+            zf.writestr(info, contents[info.filename])
+        zf.writestr(sbom_path, sbom_bytes)
+
+    print(f"Embedded {sbom.name} in {wheel.name}")
+
+
+def scan_dir(path: Path) -> Path:
+    """If `path` is a directory, return the path of the SBOM within."""
+    if path.is_dir():
+        candidates = list(path.glob("*.cdx.json"))
+        if len(candidates) != 1:
+            msg = f"expected exactly one *.cdx.json in {path}, found {len(candidates)}"
+            raise SystemExit(msg)
+        return candidates[0]
+    return path
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument(
+        "wheelhouse", type=Path, help="directory of wheels to embed the SBOM into"
+    )
+    parser.add_argument(
+        "sbom",
+        type=Path,
+        help="SBOM file, or a directory containing a single `.cdx.json`",
+    )
+    args = parser.parse_args()
+
+    sbom = scan_dir(args.sbom)
+
+    wheels = sorted(args.wheelhouse.glob("*.whl"))
+    if not wheels:
+        parser.error(f"no wheels found in {args.wheelhouse}")
+
+    for wheel in wheels:
+        embed(wheel, sbom)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/wheels.yml

@@ -15,6 +15,7 @@ on:
       - ".ci/requirements-sbom.txt"
       - ".github/compare-dist-sizes.py"
       - ".github/dependencies.json"
+      - ".github/embed-sbom.py"
       - ".github/generate-sbom.py"
       - ".github/workflows/wheels*"
       - "pyproject.toml"
@@ -40,7 +41,35 @@ env:
   FORCE_COLOR: 1
 
 jobs:
+  sbom:
+    if: github.event_name != 'schedule' || github.event.repository.fork == false
+    runs-on: ubuntu-latest
+    name: Generate SBOM
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.x"
+
+      - name: Generate CycloneDX SBOM
+        run: python3 .github/generate-sbom.py
+
+      - name: Validate SBOM
+        run: |
+          python3 -m pip install -r .ci/requirements-sbom.txt
+          check-jsonschema --schemafile "https://raw.githubusercontent.com/CycloneDX/specification/1.7/schema/bom-1.7.schema.json" pillow-*.cdx.json
+
+      - name: Upload SBOM as workflow artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sbom
+          path: "pillow-*.cdx.json"
+
   build-native-wheels:
+    needs: sbom
     if: github.event_name != 'schedule' || github.event.repository.fork == false
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
@@ -128,12 +157,22 @@ jobs:
           CIBW_ENVIRONMENT_PASS_LINUX: FORCE_COLOR
           MACOSX_DEPLOYMENT_TARGET: ${{ matrix.macosx_deployment_target }}
 
+      - name: Download SBOM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: sbom
+          path: sbom
+
+      - name: Embed SBOM in wheels
+        run: python3 .github/embed-sbom.py wheelhouse sbom
+
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist-${{ matrix.name }}
           path: ./wheelhouse/*.whl
 
   windows:
+    needs: sbom
     if: github.event_name != 'schedule' || github.event.repository.fork == false
     name: Windows ${{ matrix.cibw_arch }}
     runs-on: ${{ matrix.os }}
@@ -207,6 +246,15 @@ jobs:
             powershell C:\pillow\.github\workflows\wheels-test.ps1 %CD%\..\venv-test'
         shell: bash
 
+      - name: Download SBOM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: sbom
+          path: sbom
+
+      - name: Embed SBOM in wheels
+        run: python3 .github/embed-sbom.py wheelhouse sbom
+
       - name: Upload wheels
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -299,33 +347,6 @@ jobs:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}
 
-  sbom:
-    if: github.event_name != 'schedule' || github.event.repository.fork == false
-    runs-on: ubuntu-latest
-    name: Generate SBOM
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.x"
-
-      - name: Generate CycloneDX SBOM
-        run: python3 .github/generate-sbom.py
-
-      - name: Upload SBOM as workflow artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: sbom
-          path: "pillow-*.cdx.json"
-
-      - name: Validate SBOM
-        run: |
-          python3 -m pip install -r .ci/requirements-sbom.txt
-          check-jsonschema --schemafile "https://raw.githubusercontent.com/CycloneDX/specification/1.7/schema/bom-1.7.schema.json" pillow-*.cdx.json
-
   sbom-publish:
     if: |
       github.event.repository.fork == false