Generate CycloneDX SBOM at release time via CI by aclark4life · Pull Request #9550 · python-pillow/Pillow

aclark4life · 2026-04-07T16:12:14Z

Includes all 8 C extension modules, 3 vendored thirdparty libraries (raqm 0.10.3, fribidi-shim, pythoncapi_compat), and 13 optional native library dependencies with encoded dependency relationships.

- Add .github/generate-sbom.py: reads the real version from src/PIL/_version.py and emits a CycloneDX 1.6 JSON SBOM covering the 8 C extension modules, 3 vendored thirdparty libraries, and 13 optional native library dependencies. - Add 'sbom' job to wheels.yml: runs on tag pushes, generates the SBOM, uploads it as a workflow artifact, and attaches it to the GitHub release via 'gh release upload'. - Remove the static pillow.cdx.json; CI now owns the generated file. Can also be run locally: python .github/generate-sbom.py Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

jkowalleck · 2026-04-07T17:04:00Z

.github/generate-sbom.py

+        for name, desc in c_extensions
+    ]
+
+    vendored_components = [


are these vendored_components untouched or are they patched somehow?

If they were modified, it would be good to know in which way -- see https://cyclonedx.org/use-cases/pedigree/

jkowalleck · 2026-04-07T17:05:08Z

.github/generate-sbom.py

+        },
+    ]
+
+    native_deps = [


I am missing the licenses of those native_deps.
I see them in https://github.com/python-pillow/Pillow/tree/main/wheels/dependency_licenses

you may add the license ID, and even the texts - https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_licenses_items_oneOf_i0_license_text

jkowalleck · 2026-04-07T17:14:36Z

.github/generate-sbom.py

+        },
+    ]
+
+    native_deps = [


some of the native_deps appear to be optional. better mark them as that.
see CycloneDX' component scope - https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_scope

jkowalleck · 2026-04-07T17:16:25Z

Once everything is flushed out, may I ask you to showcase your SBOMs in the official examples repo?
see https://github.com/CycloneDX/bom-examples/tree/master/SBOM

And when shipping the SBOM in the wheel ala PEP770, maybe give https://github.com/psf/sboms-for-python-packages a quick notice :)

jkowalleck · 2026-04-07T17:40:34Z

.github/generate-sbom.py

+    ]
+
+    vendored_components = [
+        {


maybe add a checksum in them, too?
see https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_hashes

jkowalleck · 2026-04-07T17:43:51Z

.github/generate-sbom.py

+            "description": "JPEG codec (required by default; disable with "
+            "-C jpeg=disable). Tested with libjpeg 6b/8/9-9d "
+            "and libjpeg-turbo 8.",
+            "externalReferences": [


where did you fetch them from? have a distribution url?
see https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_type

jkowalleck · 2026-04-07T18:06:32Z

.github/generate-sbom.py

+
+    return {
+        "bomFormat": "CycloneDX",
+        "specVersion": "1.6",


just go with "1.7" - the adoption in ingesting tools should be good today

jkowalleck · 2026-04-07T18:07:57Z

.github/generate-sbom.py

+        "specVersion": "1.6",
+        "serialNumber": f"urn:uuid:{serial}",
+        "version": 1,
+        "metadata": {


lets add metadata.lifecycles = [ "build" ]

see https://cyclonedx.org/docs/1.7/json/#metadata_lifecycles_items_oneOf_i0_phase

jkowalleck · 2026-04-07T18:12:44Z

.github/workflows/wheels.yml

+          name: sbom
+          path: "*.cdx.json"
+
+      - name: Attach SBOM to GitHub release


better move the job condition to here:
if: github.repository_owner == 'python-pillow' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags')

this way, you would have an SBOM artifact even for tests - which might come in handy at some point. - during review of changes and such ...
and you would not have any surprises on releases, surprises that you could have seen in regular CI runs

PS: if you have your SBOM artifact available, you might test it for validity and context.

There might be automated validators out there, like https://pypi.org/project/cyclonedx-python-lib/ can do this https://cyclonedx-python-library.readthedocs.io/en/latest/examples.html#complex-validation

To test the value, you might use visualizers like https://cyclonedx.studio/

The practical use of the SBOM would be, besides shipping it in PEP770 style, to feed the SBOM into some sort of tool that analyzes the SBOM and warns about new findings anachronously - like https://dependencytrack.org/ can do.
This way you would get alerts on shipped versions and might yank a vulnerable ones from package registries, and write the appropriate Security Advisory accordingly.

.github/workflows/wheels.yml

.github/generate-sbom.py

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

.github/workflows/wheels.yml

.github/generate-sbom.py

.github/workflows/wheels.yml

hugovk · 2026-04-08T10:28:59Z

.github/workflows/wheels.yml


+  sbom:
+    if: github.repository_owner == 'python-pillow' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    needs: count-dists


Rather than placing all of this after the count-dists bottleneck:

Let's build the SBOM beforehand, so we can inspect the results (and debug problems) without having to wait hours for all the wheels to build.

And then a job afterwards to download-artifact and attach to the release:

probably a very good idea to have the SBOM process isolated.

you are not using target-specific components , or do you?
Like on the windows build, you use this C library, and in the MacOS, you use a different one.
I mean, if you were having target-specific components, then you would need target-specific SBOMs generated on bdist's build-time (and additionally put the correct one in the respective wheel - if the bdist process would support PEP 770).

Yes, there are platform differences, like iOS disabling raqm and imagequant:

Pillow/pyproject.toml

Lines 108 to 110 in 7cf4dac

# Disable platform guessing on iOS, and disable raqm (since there won't be a

# vendor version, and we can't distribute it due to licensing)

ios.config-settings = "raqm=disable imagequant=disable platform-guessing=disable"

hugovk · 2026-04-08T10:37:57Z

It would be great to get this eventually into the wheels (PEP 770) but that likely needs extra tooling, and generating and adding to the GH release is a good first step. 👍

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

for more information, see https://pre-commit.ci

- Fix missing datetime/hashlib imports; use datetime as dt - Bump specVersion from 1.6 to 1.7 - Add metadata.lifecycles = [{"phase": "build"}] - Add SHA-256 hashes to vendored components (raqm, fribidi-shim, pythoncapi_compat) - Add pedigree notes clarifying whether vendored components are patched - Add distribution externalReferences to vendored and native dep components - Add SPDX license IDs to all native dependencies - Mark optional native dependencies with scope: optional - Split sbom job: generate early (no bottleneck), publish separately after count-dists - Add .github/generate-sbom.py to push/PR trigger paths Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

for more information, see https://pre-commit.ci

aclark4life changed the title ~~Add CycloneDX SBOM~~ Generate CycloneDX SBOM at release time via CI Apr 7, 2026

aclark4life force-pushed the sbom branch from 47c81a8 to 87f1488 Compare April 7, 2026 16:38

jkowalleck reviewed Apr 7, 2026

View reviewed changes

radarhere reviewed Apr 7, 2026

View reviewed changes

.github/workflows/wheels.yml Outdated Show resolved Hide resolved

radarhere reviewed Apr 7, 2026

View reviewed changes

.github/generate-sbom.py Outdated Show resolved Hide resolved

aclark4life added the Packaging Any mention of setup.py; some overlap with Install label label Apr 7, 2026

aclark4life and others added 3 commits April 7, 2026 19:31

Update .github/workflows/wheels.yml

123cb5b

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Update .github/generate-sbom.py

adbec65

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Set executable flag on script with shebang line

1ae1d72

radarhere reviewed Apr 8, 2026

View reviewed changes

.github/workflows/wheels.yml Outdated Show resolved Hide resolved

hugovk reviewed Apr 8, 2026

View reviewed changes

aclark4life and others added 6 commits April 8, 2026 07:34

Update .github/workflows/wheels.yml

7cebafc

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Update .github/generate-sbom.py

ba6c046

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Update .github/workflows/wheels.yml

fbf8425

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

[pre-commit.ci] auto fixes from pre-commit.com hooks

54489f3

for more information, see https://pre-commit.ci

[pre-commit.ci] auto fixes from pre-commit.com hooks

e9b4b9f

for more information, see https://pre-commit.ci

aclark4life marked this pull request as ready for review April 9, 2026 00:42

	# Disable platform guessing on iOS, and disable raqm (since there won't be a
	# vendor version, and we can't distribute it due to licensing)
	ios.config-settings = "raqm=disable imagequant=disable platform-guessing=disable"

Uh oh!

Conversation

aclark4life commented Apr 7, 2026

Uh oh!

jkowalleck Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hugovk Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hugovk Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

hugovk commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jkowalleck Apr 7, 2026 •

edited

Loading

jkowalleck Apr 7, 2026 •

edited

Loading

jkowalleck Apr 7, 2026 •

edited

Loading

jkowalleck commented Apr 7, 2026 •

edited

Loading

jkowalleck Apr 7, 2026 •

edited

Loading

jkowalleck Apr 7, 2026 •

edited

Loading

jkowalleck Apr 7, 2026 •

edited

Loading

jkowalleck Apr 8, 2026 •

edited

Loading

jkowalleck Apr 8, 2026 •

edited

Loading