Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Carol Willing <[email protected]>
  • Loading branch information
sethmlarson and willingc authored Mar 11, 2024
1 parent b32b691 commit 3588722
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions developer-workflow/sbom.rst
Original file line number Diff line number Diff line change
Expand Up @@ -113,16 +113,18 @@ Updating external dependencies (``cpython-source-deps``)

.. note::
Only core developers can push to the ``cpython-source-deps`` repository.
Pull requests are not accepted because the sources must be verified for
integrity. Contributors should create an issue requesting the updated

For this repo to maintain integrity, pull requests from contributors are not accepted. Instead of a pull request,
contributors should
create an issue requesting the updated
version and then wait for a core developer to prepare the new version
before proceeding with the next steps below.

Dependencies for Windows CPython builds are `stored in a separate repository
<https://github.com/python/cpython-source-deps>`_ and then fetched during
builds of CPython for Windows in the script :cpy-file:`PCbuild/get_externals.bat`.

In this script the libraries to fetch are designated by ``{name}-{version}``
In this :cpy-file:`PCbuild/get_externals.bat`, the libraries to fetch are designated by ``{name}-{version}``
Git refs being added to the ``libraries`` variable.
SBOM tooling in the CPython repository matches these Git refs in order
to build the :cpy-file:`Misc/externals.spdx.json` SBOM file.
Expand Down

0 comments on commit 3588722

Please sign in to comment.