Add Software Bill-of-Materials for Windows source dependencies

[sethmlarson]

Proposal:

Part of #112302

An SBOM document has been added for dependencies within CPython itself. This document is kept up-to-date using tooling and CI within the CPython repository. For building the Windows there exists a repository cpython-source-deps which "mirrors" the source code of projects not in the CPython git repo.

These dependencies are pulled in optionally, I still need to investigate what combinations are possible, but I know the possible projects and versions for each CPython branch is captured currently in PCBuild/get_externals.bat.

Will be investigating what the best method for creating an SBOM for these dependencies such that release-tools can stitch it into the final SBOMs that are distributed with release artifacts. There's a chance that no work needs to be done on this repository, in that case this issue will be migrated.

cc @zooba @ned-deily @ambv

Has this already been discussed elsewhere?

See the Discourse topic

Linked PRs

• gh-112844: Add SBOM for external dependencies #115789
• [3.12] gh-112844: Add SBOM for external dependencies (GH-115789) #116128
• gh-112844: Fix xz CPE identifier #117656
• [3.12] gh-112844: Fix xz CPE identifier (GH-117656) #117951
• gh-112844: Update CPE references for external dependencies #118521
• [3.13] gh-112844: Update CPE references for external dependencies (GH-118521) #119237
• [3.12] gh-112844: Update CPE references for external dependencies (GH-118521) #119238

[ned-deily]

FTR, historically, macOS installer builds do not use cpython-source-deps and there are no plans to do so. That repo was created specifically for Windows builds and has contained patches to various upstream releases (like here) that might not apply to other platforms and doesn't contain patches that may be needed on other platforms like for the macOS installer.

[sethmlarson]

@ned-deily That's good to know that these sources are patched! Ack on macOS, I must have misremembered something else.

[zooba]

FTR, I have no concerns about that repo containing patches for other platforms. Virtually all the time those patches are taken from upstream, so they'll work everywhere.

When we patch, we add another tag with an extra version field (e.g. the 8.6.13**.1** I just tagged for Tcl and Tk). And a particular release of Python should always pull from a tag, and those are only listed in get_externals.bat (there are other references in some of the .props files, but those aren't as easy to parse out).