[🚀 Feature]: Include SBOMs with Selenium Manager binaries

[stefan6419846]

Description

The Python packages for selenium currently bundle Rust-based binaries in their wheels:

• selenium/webdriver/common/linux/selenium-manager
• selenium/webdriver/common/macos/selenium-manager
• selenium/webdriver/common/windows/selenium-manager.exe

For these binaries, the license data is incomplete (especially regarding the used dependencies) and thus possibly violates the corresponding licenses. For this reason, I propose to at least provide corresponding SBOM files with the distributions for the bundled dependencies and possibly generate a third-party license/notice file as well.

Have you considered any alternatives or workarounds?

Use the corresponding Cargo.lock file from Git to generate the corresponding files myself.

[selenium-ci]

@stefan6419846, thank you for creating this issue. We will troubleshoot it as soon as we can.

Selenium Triage Team: remember to follow the Triage Guide

[titusfortner]

Agreed, this is something we need to address and It isn't limited to just Python, we'll want to sort it for all bindings

[cgoldberg]

@titusfortner

I looked into generating SBOMs for all of the packages we build a little while back...

I tried using bazel dependency graphs and rolling my own SBOMs, and it was pretty painful. Just using each language/ecosystem's native tooling is way easier.

Have you checked out Syft?
https://oss.anchore.com/docs/guides/sbom/

It doesn't always reconstruct dependency graphs as accurately as ecosystem-native tooling... but it might be able to handle all of the languages/packages good enough with a single tool instead of hacking the build for each asset.

[github-actions]

This issue has been automatically locked since there has not been any recent activity since it was closed. Please open a new issue for related bugs.