Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 18 additions & 7 deletions peps/pep-0770.rst
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,24 @@ is not constrained to select a single SBOM standard by its consumers and thus
can allow tools creating SBOM documents for inclusion in Python packages to
choose which SBOM standard works best for their use-case.

Rejected Ideas
==============

Selecting a single SBOM standard
--------------------------------

There is no universally accepted SBOM standard and this area is still
rapidly evolving (for example, SPDX released a new major version of their
standard in April 2024). To avoid locking the Python ecosystem into a specific
standard ahead of when a clear winner emerges this PEP treats SBOM documents
as opaque and only makes recommendations to promote compatibility with
downstream consumers of SBOM document data.

None of the decisions in this PEP restrict a future PEP to select
a single SBOM standard. Tools that use SBOM data today already need to support
multiple formats to handle this situation, so a future standard that updates to
require only one standard would have no effect on downstream SBOM tools.

Open Issues
===========

Expand All @@ -417,13 +435,6 @@ Conditional project source SBOM files

How can a project specify an SBOM file that is conditional? Under what circumstances would an SBOM document be conditional?

Selecting a single SBOM standard
--------------------------------

Should this PEP select a single SBOM standard instead of supporting any
SBOM standard? Selecting a single standard would potentially limit the
evolution of SBOM standards which is an active area of development.

References
==========

Expand Down
Loading