Repository navigation
Bug: Windows upload skips SBOM sidecars named after the full artifact #399
Description
sbom.py writes Windows SBOM files beside each artifact using the full artifact
filename plus .spdx.json. For example:
python-3.14.0-amd64.exe.spdx.json
windows-release/merge-and-upload.py currently searches with
Path.with_suffix(".spdx.json"), which maps that artifact to:
python-3.14.0-amd64.spdx.json
As a result, the upload step can skip the SBOM file that was generated for the
artifact.
Expected behavior
The Windows upload step should look for <artifact>.spdx.json and upload that
file next to the artifact.
Activity
sethmlarson commentedon Jun 2, 2026
FYI @zooba, related to Windows release process.
zooba commentedon Jun 2, 2026
merge_and_upload.pyis only for the PyManager packages, it doesn't do anything with the legacy ones.e-q commentedon Jun 17, 2026
@zooba Would you agree that there is still a bug here for the PyManager package ZIP path?
The PyManager layout step creates SBOMs for package ZIPs as
<artifact>.spdx.json, whilemerge-and-upload.pyappears to look forsrc.with_suffix(".spdx.json"), which would mappython-...-amd64.ziptopython-...-amd64.spdx.jsoninstead ofpython-...-amd64.zip.spdx.json.If that interpretation is right, I can update #404 so the example/test is PyManager-specific rather than using a legacy installer example.
zooba commentedon Jun 17, 2026
Oh I see, it's removing the
.zipwhen it shouldn't be.Just replace the
.with_suffix(".spdx.json")with.with_name(f"{src.name}.spdx.json")and skip the test. This script changes so infrequently and is single-purpose, so it isn't going to benefit from a bigger harness or any refactoring. Let's just make it correct.