|
| 1 | +"""Embed Pillow's SBOM into each wheel's `.dist-info/sboms/` directory, |
| 2 | +as specified by PEP 770. |
| 3 | +
|
| 4 | +The SBOM (produced by `generate-sbom.py`) is injected into every `.whl` in |
| 5 | +the given directory, updating each wheel's `RECORD` so the result remains a |
| 6 | +valid, installable wheel. |
| 7 | +""" |
| 8 | + |
| 9 | +from __future__ import annotations |
| 10 | + |
| 11 | +import argparse |
| 12 | +import base64 |
| 13 | +import hashlib |
| 14 | +import zipfile |
| 15 | +from pathlib import Path |
| 16 | + |
| 17 | + |
| 18 | +def record_entry(path: str, data: bytes) -> bytes: |
| 19 | + """Build a RECORD line: `path,sha256=<base64url-nopad>,<size>`.""" |
| 20 | + digest = base64.urlsafe_b64encode(hashlib.sha256(data).digest()) |
| 21 | + return ( |
| 22 | + path.encode("utf-8") |
| 23 | + + b",sha256=" |
| 24 | + + digest.rstrip(b"=") |
| 25 | + + b"," |
| 26 | + + str(len(data)).encode() |
| 27 | + ) |
| 28 | + |
| 29 | + |
| 30 | +def embed(wheel: Path, sbom: Path) -> None: |
| 31 | + with zipfile.ZipFile(wheel) as zf: |
| 32 | + infos = zf.infolist() |
| 33 | + contents = {info.filename: zf.read(info.filename) for info in infos} |
| 34 | + |
| 35 | + record_name = next( |
| 36 | + name |
| 37 | + for name in contents |
| 38 | + if name.endswith(".dist-info/RECORD") and name.count("/") == 1 |
| 39 | + ) |
| 40 | + dist_info = record_name.split("/", 1)[0] |
| 41 | + |
| 42 | + sbom_bytes = sbom.read_bytes() |
| 43 | + sbom_path = f"{dist_info}/sboms/{sbom.name}" |
| 44 | + |
| 45 | + # Append a matching RECORD line for the SBOM (RECORD's own line has no hash). |
| 46 | + lines = contents[record_name].splitlines() |
| 47 | + lines.append(record_entry(sbom_path, sbom_bytes)) |
| 48 | + contents[record_name] = b"\n".join(lines) + b"\n" |
| 49 | + |
| 50 | + with zipfile.ZipFile(wheel, "w", zipfile.ZIP_DEFLATED) as zf: |
| 51 | + # Re-use each original ZipInfo to preserve timestamps, mode bits and |
| 52 | + # compression; only RECORD's contents change |
| 53 | + for info in infos: |
| 54 | + zf.writestr(info, contents[info.filename]) |
| 55 | + zf.writestr(sbom_path, sbom_bytes) |
| 56 | + |
| 57 | + print(f"Embedded {sbom.name} in {wheel.name}") |
| 58 | + |
| 59 | + |
| 60 | +def scan_dir(path: Path) -> Path: |
| 61 | + """If `path` is a directory, return the path of the SBOM within.""" |
| 62 | + if path.is_dir(): |
| 63 | + candidates = list(path.glob("*.cdx.json")) |
| 64 | + if len(candidates) != 1: |
| 65 | + msg = f"expected exactly one *.cdx.json in {path}, found {len(candidates)}" |
| 66 | + raise SystemExit(msg) |
| 67 | + return candidates[0] |
| 68 | + return path |
| 69 | + |
| 70 | + |
| 71 | +def main() -> None: |
| 72 | + parser = argparse.ArgumentParser( |
| 73 | + description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter |
| 74 | + ) |
| 75 | + parser.add_argument( |
| 76 | + "wheelhouse", type=Path, help="directory of wheels to embed the SBOM into" |
| 77 | + ) |
| 78 | + parser.add_argument( |
| 79 | + "sbom", |
| 80 | + type=Path, |
| 81 | + help="SBOM file, or a directory containing a single `.cdx.json`", |
| 82 | + ) |
| 83 | + args = parser.parse_args() |
| 84 | + |
| 85 | + sbom = scan_dir(args.sbom) |
| 86 | + |
| 87 | + wheels = sorted(args.wheelhouse.glob("*.whl")) |
| 88 | + if not wheels: |
| 89 | + parser.error(f"no wheels found in {args.wheelhouse}") |
| 90 | + |
| 91 | + for wheel in wheels: |
| 92 | + embed(wheel, sbom) |
| 93 | + |
| 94 | + |
| 95 | +if __name__ == "__main__": |
| 96 | + main() |
0 commit comments