Native Support For SBOMs In Python (PEP-770) Is A Reality — But Not Risk-Free

The report explains Python’s PEP-770, a new standard for packaging SBOMs with Python distributions to improve measurability and compliance, while allowing flexible formats like CycloneDX or SPDX. It outlines benefits for consumers and researchers, but warns that SBOMs are optional, may be inaccurate or intentionally misleading, and can introduce attack vectors through ingestion tooling (e.g., deserialization/XXE). The guidance recommends careful validation, appropriate assurance, possible signing, and ongoing maintenance to safely consume or distribute SBOMs.