Add docs for updating external dependencies

developer-workflow/sbom.rst

@@ -66,7 +66,7 @@ After gathering this information:
 
  * ``name`` for the project name.
  * ``SPDXID`` which will be ``"SPDXRef-PACKAGE-{name}"``.
- * ``licenseConcluded`` for the SPDX license identifier of the project license.
+ * ``licenseConcluded`` must be ``NOASSERTION``.
  * ``versionInfo`` for the version of the project.
  * ``downloadLocation`` should be an HTTPS URL for the project download as an archive.
  * ``checksums[0].checksumValue`` and ``.algorithm`` will be the SHA-256
@@ -107,3 +107,35 @@ When removing a dependency:
  that correct package is removed from the SBOM.
 5. Commit the changes to :cpy-file:`Misc/sbom.spdx.json` and
  :cpy-file:`Tools/build/generate_sbom.py`.
+
+Updating external dependencies (``cpython-source-deps``)
+--------------------------------------------------------
+
+ .. note::
+ Only core developers can push to the ``cpython-source-deps`` repository.
+
+ For this repo to maintain integrity, pull requests from contributors are not accepted. Instead of a pull request,
+ contributors should
+ create an issue requesting the updated
+ version and then wait for a core developer to prepare the new version
+ before proceeding with the next steps below.
+
+Dependencies for Windows CPython builds are `stored in a separate repository
+<https://github.com/python/cpython-source-deps>`_ and then fetched during
+builds of CPython for Windows in the script :cpy-file:`PCbuild/get_externals.bat`.
+
+In this :cpy-file:`PCbuild/get_externals.bat`, the libraries to fetch are designated by ``{name}-{version}``
+Git refs being added to the ``libraries`` variable.
+SBOM tooling in the CPython repository matches these Git refs in order
+to build the :cpy-file:`Misc/externals.spdx.json` SBOM file.
+
+When updating external dependencies for a CPython branch:
+
+1. Push the update to the ``cpython-source-deps`` repository and
+ create a new Git tag.
+2. Update the entry for the project in ``get_externals.bat``.
+3. Run ``make regen-sbom`` or ``PCbuild/build.bat --regen``
+ in the CPython source repository.
+4. Use ``git diff`` to verify that the metadata (like version, download location)
+ in ``externals.spdx.json`` SBOM is updated as expected.
+5. Commit the changes and have them merged together.