As OpenCV and this Python bindings heavily rely on native code either part of vendored directories or custom locations and provide a great range of configuration options, it would be great if the build process would generate suitable SBOM files.
This would greatly improve downstream license compliance handling, as the build process is the only reliable resource where this information can be generated from.
At the moment, a third-party license file is provided (which is nice), but it is not machine-readable, possibly lacks relevant details and/or includes components which are not even active in the current build, like when disabling FFmpeg or the GUI, or when we only look at a Linux-specific wheels where we should not have to care about Windows- or Apple-only dependencies.
With PEP 770, a corresponding standard has been established for shipping the SBOM files as part of the metadata directory inside wheel files.
As OpenCV and this Python bindings heavily rely on native code either part of vendored directories or custom locations and provide a great range of configuration options, it would be great if the build process would generate suitable SBOM files.
This would greatly improve downstream license compliance handling, as the build process is the only reliable resource where this information can be generated from.
At the moment, a third-party license file is provided (which is nice), but it is not machine-readable, possibly lacks relevant details and/or includes components which are not even active in the current build, like when disabling FFmpeg or the GUI, or when we only look at a Linux-specific wheels where we should not have to care about Windows- or Apple-only dependencies.
With PEP 770, a corresponding standard has been established for shipping the SBOM files as part of the metadata directory inside wheel files.