From 19aa6ab2fce4a8d09058293a27e90958ab99e150 Mon Sep 17 00:00:00 2001 From: Ajoy L Date: Sat, 31 Oct 2026 20:26:20 -0500 Subject: [PATCH] build(binary): keep brotli out of the standalone binary brotli reaches the PyInstaller bundle only through the dev-group py7zr, but urllib3 enables brotli response decoding whenever it is importable, so frozen binaries advertised Accept-Encoding: br on every remote scan. Exclude brotli/brotlicffi (py7zr works without them) and fail the build if they are bundled again. --- aisbom.spec | 2 +- scripts/build_binaries.sh | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/aisbom.spec b/aisbom.spec index 19b1ada..ad06e4f 100644 --- a/aisbom.spec +++ b/aisbom.spec @@ -21,7 +21,7 @@ a = Analysis( hookspath=[], hooksconfig={}, runtime_hooks=[], - excludes=[], + excludes=['brotli', '_brotli', 'brotlicffi'], noarchive=False, optimize=0, ) diff --git a/scripts/build_binaries.sh b/scripts/build_binaries.sh index be5f9b3..d54ff4d 100755 --- a/scripts/build_binaries.sh +++ b/scripts/build_binaries.sh @@ -27,7 +27,22 @@ poetry run pyinstaller \ --collect-all=spdx_tools \ --hidden-import=rich \ --hidden-import=requests \ + --exclude-module=brotli \ + --exclude-module=_brotli \ + --exclude-module=brotlicffi \ run_aisbom.py +# Keep brotli out of the binary. It arrives only through py7zr (used to build +# the 7z case of `bypass-scorecard`, which works fine without brotli), but +# urllib3 turns on brotli response decoding whenever brotli is importable. So +# bundling it would put a native decoder on the path of every remote scan for +# no benefit to users. Fail the build if it ever comes back. +FORBIDDEN='(^|[^A-Za-z0-9_])(_?brotli|brotlicffi)([^A-Za-z0-9_]|$)' +if poetry run pyi-archive_viewer --recursive --brief dist/aisbom | grep -E "$FORBIDDEN"; then + echo "FAIL: brotli (listed above) was bundled into dist/aisbom" >&2 + exit 1 +fi +echo "OK: brotli not bundled" + echo "Build complete. Binary is at dist/aisbom" ls -lh dist/aisbom