# SBOMs for Python packages project

**URL:** <https://discuss.python.org/t/sboms-for-python-packages-project/70261>\
**Category:** Packaging\
**Created:** [November 5, 2024, 6:02pm UTC](https://discuss.python.org/t/sboms-for-python-packages-project/70261 "2024-11-05T18:02:08Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![h-vetinari](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/h-vetinari/32/1220_2.png) [@h-vetinari](https://discuss.python.org/u/h-vetinari)\
**Post date:** [November 6, 2024, 12:40am UTC](https://discuss.python.org/t/sboms-for-python-packages-project/70261/2 "2024-11-06T00:40:40Z")

</div>

> [@sethmlarson](#):
>
> Solve the “[phantom dependency](https://github.com/sethmlarson/sboms-for-python-packages?tab=readme-ov-file#phantom-dependencies)” problem

Is this going to build help push [PEP 725](https://peps.python.org/pep-0725/) or a are you planning a completely different approach (e.g. separate metadata or somehow inspecting wheel contents)?

I see PURLs appearing in the readme already, but no mention about that PEP. IMO it would be much more beneficial to tackle this problem at the source (packaging metadata that’s used for building; generate SBOM from that), rather than create a separate set of sbom-related metadata that needs to be kept in sync.

---

_[View the full topic](https://discuss.python.org/t/sboms-for-python-packages-project/70261)._