Commit 944666592 for imagemagick.org

commit 9446665929668bf0ccef8dbb4be510cf51c248df
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Fri Oct 30 13:44:51 2026 +0100

    Updated setting the values of the SBOM.

diff --git a/.github/build/windows/create-sbom.py b/.github/build/windows/create-sbom.py
index ab1d3ea3c..098f3e97b 100644
--- a/.github/build/windows/create-sbom.py
+++ b/.github/build/windows/create-sbom.py
@@ -1,4 +1,3 @@
-import json
 import os
 import sys
 import uuid
@@ -8,17 +7,25 @@ if len(sys.argv) != 2:
     sys.exit(1)

 output_file = sys.argv[1]
-version = os.environ["VERSION"]
-timestamp = os.environ["TIMESTAMP"]
+commit = os.environ["MAGICK_COMMIT"]
+timestamp = os.environ["MAGICK_TIMESTAMP"]
+version = os.environ["MAGICK_VERSION"]

-with open("Artifacts/sbom.json", "r") as f:
-    sbom = json.load(f)
+with open("Artifacts/sbom.json", "r", encoding="utf-8", newline="") as f:
+    sbom = f.read()

-sbom["serialNumber"] = "urn:uuid:" + str(uuid.uuid4())
-sbom["metadata"]["timestamp"] = timestamp
-sbom["metadata"]["component"]["version"] = version
+replacements = {
+    "[MAGICK_SERIAL]": "urn:uuid:" + str(uuid.uuid4()),
+    "[MAGICK_TIMESTAMP]": timestamp,
+    "[MAGICK_VERSION]": version,
+    "[MAGICK_COMMIT]": commit,
+}
+for marker, value in replacements.items():
+    if marker not in sbom:
+        sys.exit(f"Missing SBOM marker: {marker}")
+    sbom = sbom.replace(marker, value)

-with open(output_file, "w") as f:
-    json.dump(sbom, f, indent=2)
+with open(output_file, "w", encoding="utf-8", newline="") as f:
+    f.write(sbom)

 print(f"SBOM created: {output_file}")
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b0c443307..0ad75387c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -212,8 +212,9 @@ jobs:
       - name: Create SBOM
         shell: cmd
         env:
-          VERSION: ${{needs.version.outputs.version}}
-          TIMESTAMP: ${{needs.version.outputs.timestamp}}
+          MAGICK_COMMIT: ${{github.sha}}
+          MAGICK_TIMESTAMP: ${{needs.version.outputs.timestamp}}
+          MAGICK_VERSION: ${{needs.version.outputs.version}}
           FILENAME: ImageMagick-${{needs.version.outputs.version}}-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}-${{matrix.typeName}}.cdx.json
         run: |
           python ImageMagick\.github\build\windows\create-sbom.py Configure\Installer\Inno\Artifacts\%FILENAME%
@@ -357,8 +358,9 @@ jobs:
       - name: Create SBOM
         shell: cmd
         env:
-          VERSION: ${{needs.version.outputs.version}}
-          TIMESTAMP: ${{needs.version.outputs.timestamp}}
+          MAGICK_COMMIT: ${{github.sha}}
+          MAGICK_TIMESTAMP: ${{needs.version.outputs.timestamp}}
+          MAGICK_VERSION: ${{needs.version.outputs.version}}
           FILENAME: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.cdx.json
         run: |
           python ImageMagick\.github\build\windows\create-sbom.py %FILENAME%