SBOM location is not compliant to PEP 770

Description

Recent pip versions ship a SBOM for their vendored dependencies, which is appreciated for proper supply chain research.

Unfortunately, this package is shipped as pip/_vendor/bom.cdx.json (https://github.com/pypa/pip/blob/main/src/pip/_vendor/bom.cdx.json), which contradicts with PEP 770 and the follow-up packaging specification: https://packaging.python.org/en/latest/specifications/binary-distribution-format/#the-dist-info-sboms-directory

With pip being the de-facto official installer for Python packages, I would have expected it to follow the official specification. Compliance tooling tends to rely on the official specification for discovering such SBOM files, thus currently not seeing the corresponding file for pip.

Expected behavior

The file is shipped as pip-26.2.1.dist-info/sboms/bom.cdx.json or similar, but in the sboms directory of the .dist-info directory.

pip version

26.2.1

Python version

irrelevant

OS

irrelevant

How to Reproduce

1. Review contents of the current wheel file: https://inspector.pypi.io/project/pip/26.2.1/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl/
2. Use <kbd>Ctrl + F</kbd> in the web browser and enter /sboms/ to search for the corresponding directory.

Output

No results found.

Code of Conduct

• I agree to follow the PSF Code of Conduct.