Repository navigation
Bug: Windows upload skips SBOM sidecars named after the full artifact #399
Description
Activity
FYI @zooba, related to Windows release process.
merge_and_upload.pyis only for the PyManager packages, it doesn't do anything with the legacy ones.@zooba Would you agree that there is still a bug here for the PyManager package ZIP path?
The PyManager layout step creates SBOMs for package ZIPs as
<artifact>.spdx.json, whilemerge-and-upload.pyappears to look forsrc.with_suffix(".spdx.json"), which would mappython-...-amd64.ziptopython-...-amd64.spdx.jsoninstead ofpython-...-amd64.zip.spdx.json.If that interpretation is right, I can update #404 so the example/test is PyManager-specific rather than using a legacy installer example.
Oh I see, it's removing the
.zipwhen it shouldn't be.Just replace the
.with_suffix(".spdx.json")with.with_name(f"{src.name}.spdx.json")and skip the test. This script changes so infrequently and is single-purpose, so it isn't going to benefit from a bigger harness or any refactoring. Let's just make it correct.
sbom.pywrites Windows SBOM files beside each artifact using the full artifactfilename plus
.spdx.json. For example:windows-release/merge-and-upload.pycurrently searches withPath.with_suffix(".spdx.json"), which maps that artifact to:As a result, the upload step can skip the SBOM file that was generated for the
artifact.
Expected behavior
The Windows upload step should look for
<artifact>.spdx.jsonand upload thatfile next to the artifact.