ppkarwasz commented on issue #44688: URL: https://github.com/apache/arrow/issues/44688#issuecomment-6079242972
I think producing an SBOM and distributing it with the wheels via [PEP 770](https://peps.python.org/pep-0770/) (in `.dist-info/sboms/`) should be the **priority**. The `pyarrow` wheel contains both dynamically and statically linked libraries. The statically linked ones in particular will hardly be found by any scanner, which only sees the `.so` files. It is much easier to record that information at build time, even with a small Python script. See the Groovy script in apache/hadoop#8707, which does this for shaded dependencies and records the original artifact as a `pedigree` ancestor. For example, `pyarrow` 26.0.0 contains OpenSSL 3.6.2 in three shared libraries (`libarrow`, `libarrow_flight` and `libarrow_s3`). Since upstream OpenSSL has no PURL for now, it can be identified by its CPE. A CycloneDX component entry for `libarrow` could look like this, with the same nested component repeated under the other two libraries: ```json { "type": "library", "bom-ref": "pyarrow/libarrow.so.2600", "name": "libarrow.so.2600", "version": "26.0.0", "hashes": [ { "alg": "SHA-256", "content": "e1a8b86b6bf2ad5710fbab814b8cfccbbf72b6774b7a9774ed6a0d6c9709fb77" } ], "evidence": { "occurrences": [ { "location": "pyarrow/libarrow.so.2600" } ] }, "components": [ { "type": "library", "name": "openssl", "version": "3.6.2", "cpe": "cpe:2.3:a:openssl:openssl:3.6.2:*:*:*:*:*:*:*", "pedigree": { "ancestors": [ { "type": "library", "name": "openssl", "version": "3.6.2", "cpe": "cpe:2.3:a:openssl:openssl:3.6.2:*:*:*:*:*:*:*" } ], "notes": "Statically linked into libarrow.so.2600. Built from the upstream OpenSSL 3.6.2 release." } } ] } ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
