Also publish an SBOM

This commit is contained in:
Kovid Goyal 2025-09-17 13:51:38 +05:30
parent 77fbd5beba
commit 6ab8e7b4c8
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C

View file

@ -36,8 +36,8 @@
if ap is not None: if ap is not None:
appname = ap.group(1) appname = ap.group(1)
ALL_ACTIONS = 'local_build man html build tag sdist upload website'.split() ALL_ACTIONS = 'local_build man html build tag sdist sbom upload website'.split()
NIGHTLY_ACTIONS = 'local_build man html build sdist upload_nightly'.split() NIGHTLY_ACTIONS = 'local_build man html build sdist sbom upload_nightly'.split()
def echo_cmd(cmd: Iterable[str]) -> None: def echo_cmd(cmd: Iterable[str]) -> None:
@ -207,6 +207,10 @@ def run_sdist(args: Any) -> None:
sign_file(f'{dest}.xz') sign_file(f'{dest}.xz')
def run_sbom(args: Any) -> None:
call(f'python ../bypy sbom --output build/kitty-{version}.tar.xz.spdx.json --url https://sw.kovidgoyal.net/kitty/binary kitty {version}')
class ReadFileWithProgressReporting(io.FileIO): # {{{ class ReadFileWithProgressReporting(io.FileIO): # {{{
def __init__(self, path: str): def __init__(self, path: str):
super().__init__(path, 'rb') super().__init__(path, 'rb')
@ -471,6 +475,7 @@ def files_for_upload() -> Dict[str, str]:
files[f'build/kitty-{version}.tar.xz'] = 'Source code' files[f'build/kitty-{version}.tar.xz'] = 'Source code'
files[f'build/kitty-{version}.tar.xz.sig'] = 'Source code GPG signature' files[f'build/kitty-{version}.tar.xz.sig'] = 'Source code GPG signature'
files[f'build/kitty-{version}.tar.xz.spdx.json'] = 'SBOM for kitty (all builds)'
for path, desc in signatures.items(): for path, desc in signatures.items():
sign_file(path) sign_file(path)
files[f'{path}.sig'] = desc files[f'{path}.sig'] = desc