Add support for generating an SBOM

[sethmlarson]

Adds a new sbom-file option to the config where a CycloneDX SBOM will be generated for the vendored packages. Closes #64

This PR depends on #65

[pradyunsg]

Hmm... @sethmlarson Would you be interested in investigating how to make the CI green here?

[sethmlarson]

@pradyunsg Yep! I rebased on main and now the tests and pre-commit are passing. Please take a look :)

[sethmlarson]

@pradyunsg Alright this PR is green now, I had to upgrade the pre-commit action to v3.0.1 (which doesn't have any relevant breaking changes for this project).

[ogrisel]

@pradyunsg the scikit-learn project is considering using vendoring to generate SBOM metadata files for its vendored dependencies: scikit-learn/scikit-learn#31343

However, vendoring has now been officially released in years. I understand that it's primarily meant as a slow moving maintenance utility for pip itself and not much for other projects, and I guess that might explain why you don't feel the need to publish official releases.

Still, I am wondering if you plan to make cut a new release at some point to include SBOM generation. Otherwise, I guess we (scikit-learn maintainers) can pip install a pinned commit hash instead.

[pradyunsg]

I can cut a release soon -- not today though. It'll depend on when I find time in the coming days (I'm traveling for PyCon US, so idk what free time is gonna look like for me).

If I haven't done so by 20th, could I ask you to keep me honest and @-mention me here? 😅

[sethmlarson]

@pradyunsg I know we wanted to get to it at PyCon US, but giving you your requested ping 💜 Thanks for the merge!