Conditional SBOM files specified in pyproject.toml?

[sethmlarson]

I'm curious if conditional SBOM files specified in the source tree will be necessary. My suspicion arises from projects having different dependencies depending on platform/version/something else.

Because this condition is builder-side, not installer-side, the condition will need to be based on something like platform/python/abi tags of the platform being built for?

[jkowalleck]

I'm curious if conditional SBOM files specified in the source tree will be necessary. My suspicion arises from projects having different dependencies depending on platform/version/something else.

this, and they have actually different wheels per platform and python-interpreter.
therefore, each of these wheels would have the appropriate SBOM in it.

see as example: https://pypi.org/project/numpy/#files

Built Distributions

• numpy-2.1.3-pp310-pypy310_pp73-win_amd64.whl (12.8 MB view hashes)
  Uploaded Nov 2, 2024 PyPy Windows x86-64
• numpy-2.1.3-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (16.1 MB view hashes)
  Uploaded Nov 2, 2024 PyPy manylinux: glibc 2.17+ x86-64
• numpy-2.1.3-pp310-pypy310_pp73-macosx_14_0_x86_64.whl (6.8 MB view hashes)
  Uploaded Nov 2, 2024 PyPy macOS 14.0+ x86-64
• [...]
• numpy-2.1.3-cp310-cp310-macosx_11_0_arm64.whl (13.7 MB view hashes)
  Uploaded Nov 2, 2024 CPython 3.10 macOS 11.0+ ARM64
• numpy-2.1.3-cp310-cp310-macosx_10_9_x86_64.whl (21.2 MB view hashes)
  Uploaded Nov 2, 2024 CPython 3.10 macOS 10.9+ x86-64

For source-distribution this is not the case, this one might have all possible deps or maybe even none ... the actual dependencies are unclear unless the source is actually built...

[sethmlarson]

Indeed, I want to compare the contents of different platforms and then see where those libraries get pulled in from and who does the pulling.