Python packages; cannot determine Publish Date.

[brodie.mclennan_5777]

Re: SBOM/RMetadata support for pypi feed type

This was actually missed in the original post, is it currently known that it cannot determine Publish Date?

This causes some warnings on our builds, yet when looking at the stored package it appears to be compliant.

Thanks.

[stevedennis]

Hi @brodie.mclennan_5777 ,

Are you sure the issue is related to publish date? If you do an analysis and look at detailed logs, you should see issue.

I haven't had any luck reproducing this. I did this:

1. Created PyPi feed with a pypi.org connector
2. Navigated to aiofiles 25.1.0
3. Downloaded aiofiles-25.1.0-py3-none-any.whl
4. Verified file was local (Packages > "Cached")
5. Uploaded a minimalist SBOM file (see below)
6. Analyzed the build with detailed results

SBOM File:

<?xml version="1.0" encoding="utf-8"?>
<bom xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://cyclonedx.org/schema/bom/1.7">
  <metadata>
    <timestamp>2026-10-16T19:45:59.6109575Z</timestamp>
    <tools>
      <components>
        <component type="application">
          <manufacturer>
            <name>Inedo</name>
          </manufacturer>
          <name>ProGet</name>
          <version>26.0.0.0</version>
        </component>
      </components>
    </tools>
    <component type="Null">
      <name>snakey</name>
      <version>1</version>
    </component>
  </metadata>
  <components>
    <component type="library">
      <name>aiofiles</name>
      <version>25.1.0</version>
      <purl>pkg:pypi/aiofiles@25.1.0</purl>
      <externalReferences>
        <reference type="website">
          <url>http://localhost:8624/packages/from-purl?purl=pkg%3apypi%2faiofiles%4025.1.0</url>
        </reference>
      </externalReferences>
    </component>
  </components>
</bom>

Results:

Found 0 licenses on pkg:pypi/aiofiles@25.1.0?file=aiofiles-25.1.0-py3-none-any.whl:
Analyzing compliance for aiofiles 25.1.0...
Beginning license rule analysis...
Default rules: undectableLicense=Warn, unspecifiedLicense=Compliant
No licenses detected on package; applying undectableLicense rule (Warn)
License rule analysis complete.
No policies define a aged or recently published rule, so the published date will not be checked
Policy "Global" considers recently published (30 days) Noncompliant
No policies define a latest patch, so latest patch will not be checked.
Analysis resulted in a Warn result.
aiofiles 25.1.0 is Warn No license detected

I do get a Warn result, because it's an embedded file license.

Thanks,
Steve