@@ -154,7 +154,7 @@ not guaranteed that tools won't break on new metadata versions and fields.
154154
155155To avoid this delay, simplify overall how to include SBOMs, and to give
156156flexibility to build backends and tools, this PEP proposes a new top-level table
157- in ``pyproject.toml ``, ``[additional- files] ``, to safely add data to a Python
157+ in ``pyproject.toml ``, ``[dist-info. files] ``, to safely add data to a Python
158158package through a registry of reserved names that
159159avoids the need for new metadata fields and versions. This mechanism allows
160160build backends and tools to begin using the features described in this PEP
@@ -165,6 +165,30 @@ A new top-level table was chosen over using the ``[project]`` table because,
165165as described in :pep: `621 `, the ``[project] `` table is used for storing core
166166metadata and this mechanism doesn't use core metadata.
167167
168+ Storing files in the ``.dist-info `` or ``.data `` directory
169+ ----------------------------------------------------------
170+
171+ There are two top-level directories in binary distributions where files beyond
172+ the software itself can be stored: ``.dist-info `` and ``.data ``.
173+ This specification chose to use the ``.dist-info `` directory for storing
174+ subdirectories and files from the new ``[dist-info.files] `` top-level table
175+ for two reasons:
176+
177+ Firstly, the ``.data `` directory has no corresponding location in the installed
178+ package, compared to ``.dist-info `` which does preserve the link between the
179+ binary distribution to the installed package in an environment. The ``.data ``
180+ directory instead has all its contents merged between all installed packages in
181+ an environment which can lead to collisions between similarly named files.
182+
183+ Secondly, subdirectories under the ``.data `` directory require new definitions
184+ to the Python `sysconfig <https://docs.python.org/3/library/sysconfig.html >`__
185+ module. This means defining additional directories require waiting for a change
186+ to Python and *using * the directory requires waiting for adoption of the new
187+ Python version by users. Subdirectories under ``.dist-info `` don't have these
188+ requirements, they can be used by any user, build backend, and installer
189+ immediately after a new subdirectory name is registered regardless of Python
190+ or metadata version.
191+
168192What are the differences between PEP 770 and PEP 725?
169193-----------------------------------------------------
170194
@@ -209,9 +233,9 @@ The changes necessary to implement this PEP include:
209233
210234* Explicitly reserving all subdirectory names in the ``.dist-info `` directory.
211235* A new registry of reserved subdirectory names in the ``.dist-info `` directory.
212- * An optional top-level table, ``[additional- files] ``, added to
236+ * An optional top-level table, ``[dist-info. files] ``, added to
213237 `project source metadata <770-spec-project-source-metadata _>`_,
214- * An optional ``sboms `` key in the new ``[additional- files] `` table,
238+ * An optional ``sboms `` key in the new ``[dist-info. files] `` table,
215239* `Additions <770-spec-project-formats _>`_ to the built distribution (wheel),
216240 and installed project specifications
217241
@@ -264,12 +288,12 @@ Project source metadata
264288This PEP specifies changes to the project's source metadata
265289in the ``pyproject.toml `` file:
266290
267- Add new ``[additional- files] `` table
268- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
291+ Add new ``[dist-info. files] `` table
292+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
269293
270- A new optional ``[additional- files] `` table is added for specifying paths
294+ A new optional ``[dist-info. files] `` table is added for specifying paths
271295in the project source tree relative to ``pyproject.toml `` to file(s) which
272- should be included in the built project to a defined directory .
296+ should be included in the built project to a subdirectory of `` .dist-info `` .
273297
274298This new table has only one defined optional key: ``sboms ``. The value of the
275299``sboms `` key MUST be an array of valid glob patterns, as specified below:
@@ -308,31 +332,31 @@ Examples of valid SBOM files declarations:
308332
309333.. code-block :: toml
310334
311- [additional- files]
335+ [dist-info. files]
312336 sboms = ["bom.json"]
313337
314- [additional- files]
338+ [dist-info. files]
315339 sboms = ["sboms/openssl.cdx.json", "sboms/openssl.spdx.json"]
316340
317- [additional- files]
341+ [dist-info. files]
318342 sboms = ["sboms/*"]
319343
320- [additional- files]
344+ [dist-info. files]
321345 sboms = []
322346
323347 Examples of invalid SBOM files declarations:
324348
325349.. code-block :: toml
326350
327- [additional- files]
351+ [dist-info. files]
328352 sboms = ["..\bom.json"]
329353
330354 Reason: ``.. `` must not be used. ``\\ `` is an invalid path delimiter, ``/ ``
331355must be used.
332356
333357.. code-block :: toml
334358
335- [additional- files]
359+ [dist-info. files]
336360 sboms = ["bom{.json*"]
337361
338362 Reason: ``bom{.json* `` is not a valid glob.
@@ -347,11 +371,10 @@ A few additions will be made to the existing specifications.
347371:term: `Project source trees <Project source tree> `
348372 Per :ref: `770-spec-project-source-metadata ` section, the
349373 `Declaring Project Metadata specification <pyprojecttoml _>`__
350- will be updated to add the ``[additional- files] `` table
374+ will be updated to add the ``[dist-info. files] `` table
351375 and optional ``sboms `` key.
352376
353377:term: `Built distributions <Built distribution> ` (:term: `wheels <wheel> `)
354-
355378 The wheel specification will be updated to add the new registry of reserved
356379 directory names and to reflect that if the ``.dist-info/sboms `` subdirectory
357380 is specified that the directory contains SBOM files.
@@ -504,7 +527,7 @@ and then include those files using ``pyproject.toml``:
504527
505528.. code-block :: toml
506529
507- [additional- files]
530+ [dist-info. files]
508531 sboms = [
509532 "sboms/bom.cdx.json"
510533 ]
@@ -622,7 +645,7 @@ are almost always static.
622645
623646The 639-style approach was ultimately dropped in favor of defining SBOMs simply
624647by their presence in the ``.dist-info/sboms `` directory and using a new table in
625- ``pyproject.toml `` called ``[additional- files] `` to define SBOMs in source
648+ ``pyproject.toml `` called ``[dist-info. files] `` to define SBOMs in source
626649distributions. This approach allows users to specify static SBOM files while
627650still empowering build backends and tools to add their own SBOM data without the
628651static/dynamic conflict.
@@ -664,7 +687,7 @@ Acknowledgements
664687
665688Thanks to Karolina Surma for authoring and leading :pep: `639 ` to acceptance.
666689This PEP's initial design was heavily inspired by :pep: `639 ` and the new
667- "additional files" mechanism generalizes 639's approach of using a subdirectory
690+ "dist-info. files" mechanism generalizes 639's approach of using a subdirectory
668691under ``.dist-info ``.
669692
670693Copyright
0 commit comments