python-sbom 0.1.1__tar.gz

python_sbom-0.1.1/.git_archival.txt

@@ -0,0 +1,3 @@
+node: $Format:%H$
+node-date: $Format:%cI$
+describe-name: $Format:%(describe:tags=true,match=*[0-9]*)$

python_sbom-0.1.1/.gitattributes

@@ -0,0 +1,3 @@
+.git_archival.txt export-subst
+tests/_generate/pinned/** -text
+src/python_sbom/_validate/schemas/** -text

python_sbom-0.1.1/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @gaborbernat

python_sbom-0.1.1/.github/CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Contributing
+
+Add a `docs/changelog.d/+short-name.<type>.rst` fragment for a change that affects package users. Choose a unique short
+name; the release workflow links the fragment to its merged squash pull request and credits the human author. A pull
+request number is not needed in the filename.
+
+Use `feature` for Added, `change` for Changes, `bugfix` for Fixed, and `doc` for Documentation. Use `breaking`,
+`security`, `performance`, `deprecation`, `removal`, or `packaging` only when the change affects users in that way. A
+supported Python version added or removed is a `feature` and results in a minor release.
+
+Use `skip news` for internal maintenance without a user-facing change. The label may be added after opening the pull
+request. Dependabot and maintenance bot pull requests without a fragment receive it automatically; a bot pull request
+with a fragment still needs the news check to pass. For a change written by more than one person, put all human authors
+in a `by` credit. Do not list bots or reviewers.
+
+The documentation preview shows fragments under Unreleased. The versioned `docs/changelog.rst` changes only during
+release preparation. The release workflow chooses a version from the fragment types, runs `prek` on the assembled
+changelog, and publishes GitHub notes from the tagged changelog after PyPI succeeds.

python_sbom-0.1.1/.github/FUNDING.yaml

@@ -0,0 +1,2 @@
+github: gaborbernat
+thanks_dev: u/gh/gaborbernat

python_sbom-0.1.1/.github/SECURITY.md

@@ -0,0 +1,47 @@
+# Security policy
+
+python-sbom writes a CycloneDX SBOM into wheels, from a hatchling build hook or from `python-sbom embed`, which rewrites
+a wheel another build backend built. `python-sbom archive` describes another zip archive a project publishes, such as a
+zipapp, and `python-sbom spdx` and `validate` render or check an SBOM. This policy says how to report a security problem
+and how we decide whether a report is one.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** Use
+[GitHub's private vulnerability reporting](https://github.com/tox-dev/python-sbom/security/advisories/new). If neither
+works for you, email [gaborjbernat@gmail.com](mailto:gaborjbernat@gmail.com).
+
+Include what the attacker controls and what they gain, the steps or a proof of concept, and the versions and platform
+you tested. Write the report yourself; unreviewed tool or model output takes longer to triage.
+
+## What to expect
+
+Volunteers maintain python-sbom, with no on-call rotation. We aim to acknowledge a report within **5 working days** and
+assess it within **15 working days**. Fixes are developed in a private fork attached to the draft advisory, ship in a
+new release, and the advisory, with a CVE requested through GitHub, goes out with that release. The default embargo is
+**90 days** from the report; we agree any change with the reporter. We credit reporters in the advisory under the name
+they choose, or not at all. There is no bug bounty.
+
+## Supported versions
+
+Only the latest release receives fixes. Confirm the problem reproduces on it before reporting.
+
+## Vulnerability or bug
+
+A report is a vulnerability when an attacker who controls only an input that the [threat model](THREAT_MODEL.md) lists
+as untrusted breaks a guarantee python-sbom makes. A report that first needs control of something the threat model
+trusts, such as the project source, its `pyproject.toml` or the build environment, is a bug: we fix it in the open and
+publish no advisory. Classify by who supplies the dangerous input, not by how bad the outcome sounds.
+
+**In scope**
+
+- A wheel bundled in a wheel or in an archive given to `python-sbom archive`, or an SBOM given to `python-sbom spdx` or
+  `validate`, that makes python-sbom write outside its output file or the wheel or archive it rewrites, or run code.
+- An SBOM that misstates what a wheel holds in a way its inputs cannot explain, such as a wrong hash.
+
+**Out of scope**
+
+- Anything hatchling's own build trusts.
+- Vulnerabilities in the packages an SBOM lists; report those to their projects.
+
+If you cannot tell which side a finding falls on, report it privately and we will decide.

python_sbom-0.1.1/.github/THREAT_MODEL.md

@@ -0,0 +1,78 @@
+# Threat model
+
+This model says what python-sbom trusts, where untrusted input enters, and which guarantees hold at each boundary, so a
+report can be classified as a vulnerability or a bug. [SECURITY.md](SECURITY.md) covers reporting; if the two disagree,
+SECURITY.md wins and we fix this file.
+
+## How python-sbom works
+
+The build hook runs inside a hatchling wheel build. It reads the wheel's core metadata, the project's license files, the
+wheels the project bundles and the installed distributions of the build environment, and writes a CycloneDX document
+that it writes into the built wheel. `python-sbom embed` does the same for a wheel another backend built,
+`python-sbom archive` describes another zip archive such as a zipapp, and `python-sbom spdx` and `validate` read
+CycloneDX documents and write or check them.
+
+```mermaid
+flowchart LR
+    project[("Project source, pyproject.toml<br/>(trusted)")] --> hook["python-sbom"]
+    env[("Build environment<br/>(trusted)")] --> hook
+    bundled[("Bundled wheels<br/>(third-party content)")] -->|"metadata, RECORD, vendor list"| hook
+    sbom[("SBOM files given to spdx, validate")] -->|"untrusted JSON"| hook
+    hook --> wheel[("Wheel")]
+    classDef trusted fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
+    classDef boundary fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
+    class project,env,hook,wheel trusted;
+    class bundled,sbom boundary;
+```
+
+## Trusted
+
+An attacker who controls any of these already has what python-sbom could give them:
+
+- The project source, its `pyproject.toml`, the build hook script, and the module the `content-provider` option or
+  `--content-provider` names: python-sbom imports that module from the project directory, so `embed` and `archive` run
+  code from `--root`.
+- The git checkout that tracks the project, whose `HEAD` python-sbom reads. A repository that merely contains the
+  project directory is not trusted: git is used only when it tracks the project, and runs with `core.fsmonitor` off.
+- The build environment and the build backend.
+- The wheel handed to `python-sbom embed` and the archive handed to `python-sbom archive`, which the project's own build
+  produced.
+
+## Untrusted inputs
+
+| Input                                   | Comes from                | What python-sbom guarantees                                                                                                                                                                                                                                 |
+| --------------------------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Metadata and `RECORD` of bundled wheels | Upstream projects         | Read as text with capped sizes, copied as JSON strings; every member is checked against its `RECORD` row, duplicate members are refused, nothing is executed.                                                                                               |
+| `_vendor/vendor.txt` of bundled wheels  | Upstream projects         | Each line must pin one exact version, or the build fails.                                                                                                                                                                                                   |
+| SBOM files given to `spdx`, `validate`  | Whoever produced the file | Parsed as JSON only, with sizes capped by the component cap; `validate` refuses nesting past 128 levels and reports problems instead of raising them; `spdx` reports input too deep to parse as an error and writes the one file named on the command line. |
+
+## Threats and controls
+
+| STRIDE                 | Threat                                                     | Control                                                       |
+| ---------------------- | ---------------------------------------------------------- | ------------------------------------------------------------- |
+| Tampering              | A bundled wheel's metadata injects JSON into the document. | The document is serialized with `json.dumps`.                 |
+| Tampering              | A bundled wheel changes and the SBOM still lists it.       | Each bundled wheel is hashed from its bytes at build time.    |
+| Elevation of privilege | A bundled wheel runs code during the build.                | Wheels are read as zip archives; nothing in them is imported. |
+
+## Release chain
+
+Releases run on the shared [tox-dev/github-workflows](https://github.com/tox-dev/github-workflows) pipeline. A release
+App, not a person, pushes the release commit and tag; the build installs its tools from a hash-checked `pylock.toml`
+resolved with a seven-day upload cooldown by default; PyPI receives the files through
+[trusted publishing](https://docs.pypi.org/trusted-publishers/) with attestations, and the GitHub Release is immutable.
+Every workflow pins third-party actions to a commit SHA.
+
+## Severity
+
+- **High:** a bundled wheel or SBOM file that makes python-sbom run code or write outside its output.
+- **Medium:** an SBOM that misstates a hash, a license or the contents of a wheel.
+- **Low:** a crash on a malformed bundled wheel or SBOM file instead of a clean error.
+
+## Accepted risks
+
+- The SBOM reports what the build environment holds; it does not check that environment against a lock.
+
+## Keeping this current
+
+Revisit this model when python-sbom gains a new input, a new way to run code, or a new place it writes to, and whenever
+an advisory is published.

python_sbom-0.1.1/.github/dependabot.yaml

@@ -0,0 +1,30 @@
+version: 2
+multi-ecosystem-groups:
+  dependencies:
+    schedule:
+      interval: weekly
+      day: tuesday
+    labels:
+      - dependencies
+      - skip news
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    patterns:
+      - '*'
+    multi-ecosystem-group: dependencies
+    labels:
+      - dependencies
+      - skip news
+    cooldown:
+      default-days: 7
+  - package-ecosystem: pre-commit
+    directory: /
+    patterns:
+      - '*'
+    multi-ecosystem-group: dependencies
+    labels:
+      - dependencies
+      - skip news
+    cooldown:
+      default-days: 7

python_sbom-0.1.1/.github/release.yaml

@@ -0,0 +1,5 @@
+changelog:
+  exclude:
+    authors:
+      - dependabot[bot]
+      - pre-commit-ci[bot]

python_sbom-0.1.1/.github/workflows/check.yaml

@@ -0,0 +1,62 @@
+name: 🧪 check
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: "27 8 * * *"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  test:
+    name: 🧪 test
+    if: github.event_name != 'schedule' || github.repository == 'tox-dev/python-sbom'
+    uses: tox-dev/github-workflows/.github/workflows/check.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+    with:
+      include: |
+        [
+          {"env": "3.15", "python": "3.15"},
+          {"env": "3.14", "python": "3.14"},
+          {"env": "3.13", "python": "3.13"},
+          {"env": "3.12", "python": "3.12"},
+          {"env": "3.11", "python": "3.11"},
+          {"env": "3.15", "python": "3.15", "os": "windows-2025"},
+          {"env": "3.11", "python": "3.11", "os": "windows-2025"},
+          {"env": "3.15", "python": "3.15", "os": "macos-26"},
+          {"env": "dev"},
+          {"env": "docs"},
+          {"env": "fix"},
+          {"env": "type"},
+          {"env": "pkg_meta"}
+        ]
+  release:
+    name: 🏷️ Release dry run
+    uses: $/.github/workflows/prepare-release.yaml
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      dry-run: true
+  hooks:
+    name: 🧹 Hooks under the cooldown
+    uses: tox-dev/github-workflows/.github/workflows/cooled-hooks.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+  gate:
+    name: 🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
+    if: ${{ !cancelled() }} # codespell:ignore cancelled
+    needs: [test, release, hooks]
+    runs-on: ubuntu-26.04
+    permissions: {}
+    steps:
+      - name: 🚦 Require all needed jobs to pass
+        uses: tox-dev/github-workflows/required-checks@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+        with:
+          needs: ${{ toJSON(needs) }}

python_sbom-0.1.1/.github/workflows/codeql.yaml

@@ -0,0 +1,22 @@
+name: 🛡️ CodeQL
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "35 8 * * 2"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analyze:
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      languages: '["actions","python"]'
+      paths-ignore: '["tests"]'

python_sbom-0.1.1/.github/workflows/news.yaml

@@ -0,0 +1,30 @@
+name: Changelog
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  changelog:
+    name: 📝 News fragment
+    runs-on: ubuntu-26.04
+    steps:
+      - name: 📥 Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: 🐍 Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          version: latest-known
+          python-version: "3.15"
+          enable-cache: false
+      - name: 📦 Install locked release tools
+        uses: tox-dev/github-workflows/install-locked-tools@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+        with:
+          groups: release-news
+          venv: ${{ runner.temp }}/release-tools
+      - name: 🔍 Validate changelog fragments
+        uses: tox-dev/github-workflows/validate-news@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2

python_sbom-0.1.1/.github/workflows/prepare-release.yaml

@@ -0,0 +1,34 @@
+name: Prepare release
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Version bump strategy
+        required: true
+        type: choice
+        options:
+          - auto
+          - major
+          - minor
+          - patch
+        default: auto
+  workflow_call:
+    inputs:
+      dry-run:
+        description: Assemble the release without pushing, for the pull request gate
+        type: boolean
+        required: true
+permissions: {}
+jobs:
+  prepare:
+    name: 🏷️ Prepare Towncrier release
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      bump: ${{ inputs.bump || 'auto' }}
+      dry-run: ${{ inputs.dry-run == true }}
+      release-auth-deployment: false
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

python_sbom-0.1.1/.github/workflows/release.yaml

@@ -0,0 +1,56 @@
+name: Release to PyPI
+on:
+  push:
+    tags: ["*"]
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  build:
+    name: 🏗️ Build
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+  notes:
+    name: 📝 Render GitHub Release notes
+    uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+    with:
+      tag: ${{ github.ref_name }}
+      changelog: docs/changelog.rst
+      artifact-url: https://pypi.org/project/python-sbom/${{ github.ref_name }}/
+  publish:
+    name: 🚀 Publish to PyPI
+    needs: [build, notes]
+    runs-on: ubuntu-26.04
+    environment:
+      name: release
+      url: https://pypi.org/project/python-sbom/${{ github.ref_name }}
+    permissions:
+      id-token: write
+    steps:
+      - name: 📩 Download distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
+          path: dist/
+      - name: 🚀 Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          attestations: true
+          packages-dir: dist
+  release:
+    name: 🚀 Publish GitHub Release
+    needs: [build, publish, notes]
+    uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: write
+    with:
+      project: python-sbom
+      version: ${{ github.ref_name }}
+      tag: ${{ github.ref_name }}
+      artifact-pattern: python-package-distributions
+      notes-artifact-id: ${{ needs.notes.outputs.artifact-id }}

python_sbom-0.1.1/.github/workflows/scorecard.yaml

@@ -0,0 +1,26 @@
+name: 🛡️ scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "43 8 * * 2"
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analysis:
+    name: 🛡️ Scorecard analysis
+    if: github.repository == 'tox-dev/python-sbom'
+    permissions:
+      actions: read # read workflow runs for the Packaging check
+      checks: read # read check runs for the CI-Tests and SAST checks
+      contents: read # check out and scan the repository
+      id-token: write # authenticate the results published to the scorecard API
+      issues: read # read issue activity for the Maintained check
+      pull-requests: read # read reviews for the Code-Review check
+      security-events: write # upload the SARIF results to code scanning
+      statuses: read # read commit statuses for the CI-Tests check
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2

python_sbom-0.1.1/.github/workflows/upgrade-release-tools.yaml

@@ -0,0 +1,17 @@
+name: Upgrade release tools
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "51 8 * * 2"
+permissions: {}
+concurrency:
+  group: upgrade-release-tools
+  cancel-in-progress: false
+jobs:
+  upgrade:
+    name: 🔀 Upgrade release tools
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@0c4cffd63033d38196319524d101caae1eef925b # 6.7.2
+    permissions:
+      contents: read
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

python_sbom-0.1.1/.gitignore

@@ -0,0 +1,6 @@
+*.pyc
+*.egg-info
+dist/
+.tox/
+/src/python_sbom/version.py
+/uv.lock

python_sbom-0.1.1/.pre-commit-config.yaml

@@ -0,0 +1,88 @@
+# prek runs lower priorities first and equal ones concurrently, so hooks sharing a priority never write the same file;
+# pre-commit ignores the key and runs hooks in file order.
+ci:
+  autoupdate_schedule: quarterly
+default_language_version:
+  python: python3.15
+# the CycloneDX schema files ship byte for byte as upstream released them
+exclude: ^src/python_sbom/_validate/schemas/
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+        priority: 0
+      - id: trailing-whitespace
+        priority: 1
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: a76b92851fc9eede9f9bc4073eb55202f34eb0df # frozen: 0.39.0
+    hooks:
+      - id: check-github-workflows
+        priority: 6
+        args: ["--verbose"]
+  - repo: https://github.com/codespell-project/codespell
+    rev: 57b21406f092110c18776e39b0bda50d37c945c8 # frozen: v2.4.3
+    hooks:
+      - id: codespell
+        priority: 6
+  - repo: https://github.com/tox-dev/tox-toml-fmt
+    rev: "5125f601c3e134347288c3d42f3b34298b7cf1be" # frozen: v1.11.1
+    hooks:
+      - id: tox-toml-fmt
+        priority: 2
+  - repo: https://github.com/tox-dev/pyproject-fmt
+    rev: "50e0f3aee9dc5747a5f173f79a7417403c18dda6" # frozen: v2.30.3
+    hooks:
+      - id: pyproject-fmt
+        priority: 2
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: "25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c" # frozen: v0.17.3
+    hooks:
+      - id: ruff-check
+        priority: 3
+        args: ["--fix", "--unsafe-fixes", "--exit-non-zero-on-fix"]
+  - repo: https://github.com/gaborbernat/simplint-pre-commit
+    rev: "c8719dca99c13381570bc69f8955c9448fc271b7" # frozen: v0.7.1
+    hooks:
+      - id: simplint
+        priority: 4
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: "25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c" # frozen: v0.17.3
+    hooks:
+      - id: ruff-format
+        priority: 5
+  - repo: https://github.com/google/yamlfmt
+    rev: "21ca5323a9c87ee37a434e0ca908efc0a89daa07" # frozen: v0.21.0
+    hooks:
+      - id: yamlfmt
+        priority: 2
+  - repo: https://github.com/executablebooks/mdformat
+    rev: 82912cdaea4fb830f751504486a7879c70526547 # frozen: 1.0.0
+    hooks:
+      - id: mdformat
+        priority: 2
+        args: ["--wrap", "120"]
+        additional_dependencies:
+          - mdformat-gfm==1.0.0
+          - mdformat-ruff==0.1.3
+  - repo: https://github.com/LilSpazJoekp/docstrfmt
+    rev: c1813841673cdcd6cf602dde1edb78a5d5e45235 # frozen: v2.2.1
+    hooks:
+      - id: docstrfmt
+        priority: 2
+        files: ^docs/(changelog|contributing)[.]rst$
+        args: ["-l", "120", "--preserve-adornments"]
+        additional_dependencies:
+          - "sphinx==9.2.0"
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # frozen: v1.31.1
+    hooks:
+      - id: zizmor
+        priority: 6
+        args: ["--min-severity", "high"]
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+        priority: 6
+      - id: check-useless-excludes
+        priority: 6

python_sbom-0.1.1/.python-sbom-revision

@@ -0,0 +1 @@
+node: 0880f77d5e60335f23d569ad6a85e4b626990d84

python_sbom-0.1.1/.readthedocs.yaml

@@ -0,0 +1,8 @@
+version: 2
+build:
+  os: ubuntu-lts-latest
+  tools: {}
+  commands:
+    - curl -LsSf https://astral.sh/uv/install.sh | sh
+    - ~/.local/bin/uv tool install tox --with tox-uv -p 3.15 --managed-python
+    - ~/.local/bin/tox run -e docs

python_sbom-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Contributing
+
+## Tests
+
+Add a test for every new feature and bug fix. A change without a test needs a reason in the pull request description.

python_sbom-0.1.1/LICENSE

@@ -0,0 +1,18 @@
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.