✨ feat(build): make the embedded SBOM exhaustive

[gaborbernat]

The SBOM that ships in the wheel today lists the bundled pip and setuptools wheels and little else, and validating it against the CycloneDX 1.6 JSON schema with cyclonedx-python-lib fails: the metadata.tools entry added in #3269 carries a vendor key, which was a field of the deprecated flat tools array and is not legal on a component. The hand-rolled field checks in tasks/validate_sbom.py had no way to catch that. 🔍 Measured against CISA's 2024 baseline attributes, the document also lacked an SBOM author, a lifecycle phase, supplier, relationship completeness, and the license and copyright of the primary component. PEP 770 names the build tools and environment as what a third party needs to verify build reproducibility, and the document recorded none of that.

The document now carries everything the build can state as fact. The root component comes from the project metadata and LICENSE: description, SPDX license expression, copyright line, maintainers, classifiers, keywords, [project.urls] mapped to reference types with the same label table cyclonedx-py uses, plus PyPI, the PyPI attestation location, changelog, security policy and advisories links, and the source revision from GITHUB_SHA or git rev-parse. The hook describes each bundled wheel from its own METADATA and RECORD: license, authors, summary, project URLs, Requires-Dist, Requires-Python, classifiers, the wheel's SHA-256, every file inside it with its hash and size, identity evidence stating how it was identified, and which Python versions receive it, from BUNDLE_SUPPORT. The declared runtime dependencies appear with their specifier and marker, without a version since they resolve at install time, and a compositions entry declares the root's dependency list incomplete for that reason. metadata.tools enumerates every distribution in the isolated build environment via importlib.metadata with the same fields and file listings, with the dependency graph between them derived from Requires-Dist, alongside the interpreter (implementation, compiler, build) and the OS (kernel, machine, os-release on Linux). A formulation workflow ties the tools to the produced wheel, and when the build runs in GitHub Actions it records the run URL, commit, ref and runner from an allowlist of variable names; the hook reads nothing else from the environment. The document also declares its own license and a build lifecycle phase. 🧾

Two accuracy problems surfaced along the way. codespell had rewritten the CycloneDX acknowledgement key to American spelling after the last schema validation ran, which the schema rejects; the key is now on codespell's ignore list. The timestamp fell back to hatchling's fixed 2020 value whenever SOURCE_DATE_EPOCH was unset, so the SBOM in the released 21.8.1 wheel claims a creation date of 2020-02-02; the hook now honors SOURCE_DATE_EPOCH and otherwise records the real time, and release.yaml pins SOURCE_DATE_EPOCH to the release commit so release artifacts become reproducible. The serial number is a uuid5 over the document body, so two builds with the same SOURCE_DATE_EPOCH and build environment produce a byte-identical file, which I confirmed by building twice and comparing. The build tool file listings skip console-script launchers since their shebang embeds the build environment's path, which made consecutive builds differ.

tasks/validate_sbom.py now validates the document with cyclonedx-python-lib's strict 1.6 schema validator, added to the pkg-meta group, and checks that every bom-ref is unique, including nested file components, and that every reference in dependencies and the workflow resolves. I confirmed it rejects a copy of the wheel with the vendor key re-injected. The document is about 1.3 MB uncompressed and 142 KB inside the wheel; the file listings for the four bundled wheels and the build environment account for most of it.