• Download Selenium Manager SBOM and THIRD-PARTY notices via Bazel http_file.
• Expose SBOM/NOTICE as common Bazel targets alongside manager binaries.
• Bundle SBOM/NOTICE into Java, Python, Ruby, npm, and NuGet release artifacts.

graph TD
  ext{{"selenium_manager_artifacts release"}} --> bzl["common/selenium_manager.bzl"] --> mod["MODULE.bazel"] --> mgr["common/manager aliases"] --> java["Java jar"]
  mgr --> py["Python wheel"]
  mgr --> js["npm package"]
  mgr --> rb["Ruby gem"]
  mgr --> nuget["NuGet package"]

Loading

The following are alternative approaches to this PR:

1. Place SBOMs in ecosystem-reserved locations

• ➕ Aligns with emerging standards (e.g., wheel .dist-info/sboms/, jar META-INF/sbom/)
• ➕ Makes automated discovery by scanners more consistent
• ➖ Blocked/awkward with current packaging tooling (e.g., rules_python py_wheel limitations)
• ➖ May require changing resource lookup/layout expectations for Selenium Manager in jars

2. Generate SBOM/NOTICE per package at build time

• ➕ Avoids downloading additional artifacts; everything produced in-repo build graph
• ➕ Could tailor metadata to each package’s exact contents/layout
• ➖ Complex and slower; requires SBOM generation tooling in each build environment
• ➖ Higher risk of platform skew vs a single canonical release-generated SBOM

3. Ship SBOM/NOTICE as separate distributable artifacts only

• ➕ No package size increase for consumers that don’t need compliance metadata
• ➕ Avoids changing package contents across ecosystems
• ➖ Compliance and security scanners often expect SBOM/NOTICE bundled with the binary
• ➖ Harder for downstream redistributors to meet attribution requirements reliably

Recommendation: Current approach (download once from the Selenium Manager artifacts release and bundle next to the binary in every package) is the best near-term tradeoff: it’s consistent across ecosystems, keeps a single canonical SBOM/NOTICE, and minimizes build-time complexity. Consider a follow-up to migrate to ecosystem-reserved SBOM locations once the packaging toolchains make it feasible without layout breakage.

Other (10) +119 / -8

MODULE.bazelRegister SBOM/NOTICE artifact repos from selenium_manager extension +2/-0

Register SBOM/NOTICE artifact repos from selenium_manager extension

• Adds 'download_sm_sbom' and 'download_sm_notice' to the repos imported from the 'selenium_manager_artifacts' module extension so they can be referenced by Bazel targets.

MODULE.bazel

BUILD.bazelExpose SBOM and NOTICE as common/manager Bazel aliases +10/-0

Expose SBOM and NOTICE as common/manager Bazel aliases

• Introduces 'selenium-manager-sbom' and 'selenium-manager-notice' aliases pointing at the newly downloaded artifact files, mirroring how platform binaries are exposed.

common/manager/BUILD.bazel

selenium_manager.bzlDownload SBOM/NOTICE artifacts alongside Selenium Manager binaries +20/-7

Download SBOM/NOTICE artifacts alongside Selenium Manager binaries

• Updates the pinned Selenium Manager artifact release (URLs and sha256) and adds 'http_file' rules for the CycloneDX SBOM and third-party NOTICE file.

common/selenium_manager.bzl

BUILD.bazelInclude SBOM/NOTICE in NuGet pack inputs +2/-0

Include SBOM/NOTICE in NuGet pack inputs

• Adds SBOM and NOTICE targets to the 'nuget_pack(files=...)' mapping so they are emitted into the NuGet package output.

dotnet/src/webdriver/BUILD.bazel

Selenium.WebDriver.nuspecAdd SBOM/NOTICE entries to NuGet nuspec +3/-0

Add SBOM/NOTICE entries to NuGet nuspec

• Adds '<file>' entries so the SBOM and third-party notices are included in the final NuGet package (at package root).

dotnet/src/webdriver/Selenium.WebDriver.nuspec

BUILD.bazelBundle SBOM/NOTICE as jar resources for selenium-manager +14/-0

Bundle SBOM/NOTICE as jar resources for selenium-manager

• Copies SBOM/NOTICE into the manager resource directory and includes them in 'java_export(resources=...)' so they ship inside the jar next to the manager binaries.

java/src/org/openqa/selenium/manager/BUILD.bazel

BUILD.bazelShip SBOM/NOTICE in npm package bin/ directory +14/-0

Ship SBOM/NOTICE in npm package bin/ directory

• Adds copy rules for SBOM and NOTICE into 'bin/' and includes them in 'npm_package(srcs=...)' so they publish with the npm distribution.

javascript/selenium-webdriver/BUILD.bazel

BUILD.bazelBundle SBOM/NOTICE into Python wheel data, exclude from sdist +16/-0

Bundle SBOM/NOTICE into Python wheel data, exclude from sdist

• Copies SBOM/NOTICE into 'selenium/webdriver/common/' and includes them in the wheel’s 'py_library(data=...)'. Excludes them from the sdist 'pkg_files', matching the existing treatment for manager binaries.

py/BUILD.bazel

BUILD.bazelBundle SBOM/NOTICE into Ruby gem bin/ contents +14/-0

Bundle SBOM/NOTICE into Ruby gem bin/ contents

• Copies SBOM/NOTICE into 'bin/' and adds them to 'rb_gem_build(data=...)' so the gem ships these artifacts alongside the platform binaries.

rb/BUILD.bazel

selenium_manager.pyTeach generator script to emit SBOM/NOTICE http_file stanzas +24/-1

Teach generator script to emit SBOM/NOTICE http_file stanzas

• Adds 'print_sbom' and 'print_notice' helpers and updates the generated header text. The generator now emits 'download_sm_sbom' and 'download_sm_notice' rules using sha values from 'latest.json'.

scripts/selenium_manager.py

Description

scripts/selenium_manager.py now directly indexes sha_dict["sbom"] and sha_dict["notice"], so
regenerating common/selenium_manager.bzl will crash with a KeyError if the downloaded latest.json is
missing either key. This makes the generator brittle to upstream schema/data issues and fails
without a clear error message about what’s wrong.

Code

scripts/selenium_manager.py[R93-97]

    content = content + print_linux(base_url, sha_dict["linux"])
    content = content + print_macos(base_url, sha_dict["macos"])
    content = content + print_windows(base_url, sha_dict["windows"])
+    content = content + print_sbom(base_url, sha_dict["sbom"])
+    content = content + print_notice(base_url, sha_dict["notice"])

Evidence

The script downloads latest.json from a remote URL and uses dictionary indexing for the newly
added keys sbom and notice without any validation or fallback, which will raise KeyError if
the keys are absent.

scripts/selenium_manager.py[23-29]
scripts/selenium_manager.py[91-98]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`scripts/selenium_manager.py` fetches a remote `latest.json` and then directly indexes new keys (`sbom`, `notice`). If the response is missing these keys (schema drift, partial publish, or other upstream issue), regeneration fails with a raw `KeyError`, which is hard to diagnose.

### Issue Context
The generator already assumes `linux/macos/windows` exist; this PR extends that assumption to `sbom/notice`. Adding explicit validation will make failures actionable and easier to debug.

### Fix Focus Areas
- scripts/selenium_manager.py[23-29]
- scripts/selenium_manager.py[91-98]

### Suggested fix
- Add a required-keys validation after `sha_dict = get_sha_json()`.
- If any keys are missing, `raise RuntimeError(...)` (or `fail(...)` equivalent) with a message listing missing keys and the URL used.
- Optionally validate that the values look like SHA-256 hex strings (length/hex chars) to catch corrupted metadata early.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools