opencv / opencv/opencv-python

Provide PEP 770 SBOM files in generated wheels

Open
#1,266 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5.4k
Forks
1k
Avg merge
22h 17m
Merged PRs (30d)
3

Description

As OpenCV and this Python bindings heavily rely on native code either part of vendored directories or custom locations and provide a great range of configuration options, it would be great if the build process would generate suitable SBOM files.

This would greatly improve downstream license compliance handling, as the build process is the only reliable resource where this information can be generated from.

At the moment, a third-party license file is provided (which is nice), but it is not machine-readable, possibly lacks relevant details and/or includes components which are not even active in the current build, like when disabling FFmpeg or the GUI, or when we only look at a Linux-specific wheels where we should not have to care about Windows- or Apple-only dependencies.

With PEP 770, a corresponding standard has been established for shipping the SBOM files as part of the metadata directory inside wheel files.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No specific files or tests are named. Start by reading PEP 770 and tracing the wheel-generation build process; done means generated wheels contain machine-readable SBOM files in their metadata directory that reflect the active build and platform dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system, release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.