Add support PEP 770 (SBOMs)

[fangchenli]

closes #763

[rgommers]

Thanks @fangchenli, this looks pretty comprehensive. I'll have to think about this a bit longer, in particular whether the targeting of the .dist-info directory is foolproof. The way you did this now is more general than adding a [tool.meson-python.sboms] setting that was also discussed in gh-763 I think, since it also deals with the "generate SBOM files on the fly with a script". It's just a little more verbose for the package author, but if you need it then it's hard to see a more ergonomic alternative.

I'll cross-link mesonbuild/meson#15738 for the idea of adding a custom Meson install tag, which is still in the commit history here but you dropped (and that decision looks correct to me).

[rgommers]

I'll also explicitly cross-link this comment from @eli-schwartz ("It may be separately interesting to teach meson about SBOM files, ...". That does make sense, but nothing in this PR is dependent on that or adds something public that would need removing if Meson adds SBOM support in the future.

[dnicolodi]

I had a quick look at this.

First, please squash the commits into a set of logical changes, we are not interested in how we arrived at the current form of the code and separate commits in a PR should only be used to separate changes in self contained bites easier to review.

Second, I am not sure I like the shape of this. The main objection is that this works for when producing a wheel. However, there are many projects that use meson (without meson-python) to directly install. In this case there would be an undesirable .dist-info folder installed alongside the Python package. The only way for the users to get rid of it would be to make the installation of these files conditional on a user build option and to pass that option when building the wheel. This does not seem a very ergonomic interface to me.

A better solution that comes to mind is to have a pyptoject.toml setting

[project]
name = 'foo'

[tool.meson-python]
sboms = ['{datadir}/foo/sboms/*']

which mimics project.license-files. This would then pick any file matching the specified pattern (in the example anything installed in {datadir}/foo/sboms/) and place it in .dist-info/sboms/. The default for tool.meson-python.sboms can be {datadir}/{package-name}/sboms/* but keeping the setting allow to deactivate special handling for the files contained in that directory. Using {datadir} has the advantage that the files installed there would not look odd when installed on a system when the meson project is used outside a wheel. If there is a convention for installing SBOMs system wide, we should use that instead. Another advantage is that this scheme can be extended to be used with license files declared in meson.build.

This scheme can maybe further extended to pick files from the source directory when the glob pattern specified in tool.meson-python.sboms does not contain an installation directory anchor.

[dnicolodi]

Maybe the setting name should be tool.meson-python.sbom-files to mirror project.license-files.

[eli-schwartz]

The only way for the users to get rid of it would be to make the installation of these files conditional on a user build option and to pass that option when building the wheel. This does not seem a very ergonomic interface to me.

Well, this does remind me that there are several projects which produce C libraries and also (optionally?) python bindings, and not the ctypes variety.

For wheels, it's potentially desirable to statically link and/or not waste time building stuff that won't ever go into a wheel. I added a -Dwheel-only=true option to https://github.com/dgibson/dtc/blob/main/pyproject.toml#L24