csspin-python 4.1.0rc2__py3-none-any.whl → 6.0.0__py3-none-any.whl

csspin_python/_predict_wheel_filename.py

@@ -0,0 +1,68 @@
+# -*- mode: python; coding: utf-8 -*-
+#
+# Copyright (C) 2026 CONTACT Software GmbH
+# https://www.contact-software.com/
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Predict the wheel filename ``setup.py bdist_wheel`` would produce, without
+building it::
+
+    python _predict_wheel_filename.py /path/to/project NAME VERSION
+
+Must run in the subprocess environment to have setuptools in the environment and
+to have the correct Python version and platform tags that the wheel is built
+for.
+"""
+
+import io
+import os
+import sys
+import warnings
+from contextlib import redirect_stdout
+
+
+def predict_wheel_filename(project_path: str, name: str, version: str) -> str:
+    """Return the predicted wheel filename for ``project_path``."""
+    os.chdir(project_path)
+
+    # setup.py is exec'd here and free to print, so keep its chatter off the
+    # stdout the caller parses. stderr stays, so tracebacks still surface.
+    with warnings.catch_warnings(), redirect_stdout(io.StringIO()):
+        warnings.simplefilter("ignore")
+        if os.path.exists("setup.py"):
+            from distutils.core import run_setup  # pylint: disable=deprecated-module
+
+            dist = run_setup(
+                "setup.py", script_args=["bdist_wheel"], stop_after="commandline"
+            )
+        else:
+            from setuptools.dist import Distribution
+
+            dist = Distribution({"script_args": ["bdist_wheel"]})
+            dist.parse_config_files()
+
+        dist.metadata.name = name
+        dist.metadata.version = version
+
+        cmd = dist.get_command_obj("bdist_wheel")
+        cmd.ensure_finalized()
+        python_tag, abi_tag, plat_tag = cmd.get_tag()  # type: ignore[attr-defined]
+        dist_name = cmd.wheel_dist_name  # type: ignore[attr-defined]
+
+    return f"{dist_name}-{python_tag}-{abi_tag}-{plat_tag}.whl"
+
+
+if __name__ == "__main__":
+    print(predict_wheel_filename(*sys.argv[1:4]))

csspin_python/pytest.py

@@ -28,7 +28,6 @@ defaults = config(
         "--cov-reset",
         "--cov",
         "--cov-report=term",
-        "--cov-report=html",
         "--cov-report=xml:{pytest.coverage_report}",
     ],
     coverage_report="python-pytest-coverage.xml",

csspin_python/python.py

@@ -81,6 +81,8 @@ from functools import cache
 from subprocess import CalledProcessError, check_output
 from textwrap import dedent, indent
 from typing import Generator, Iterable, Type, Union
+from urllib.error import HTTPError
+from urllib.parse import urljoin, urlsplit
 
 try:
     from typing import Self  # type: ignore[attr-defined]
@@ -162,11 +164,6 @@ defaults = config(
         enabled=False,
         memo="{spin.spin_dir}/aws_auth.memo",
         key_duration=3600 * 10,  # 10 hours
-        static_oidc=False,
-        index="16.0/simple",
-        # Need to set client secret to empty string, otherwise the string "None"
-        # would be handled as secret and obfucsated in logs.
-        client_secret="",  # nosec: B106
     ),
     index_url="https://pypi.org/simple",
     skip_js_build=None,
@@ -187,11 +184,13 @@ def wheel(
 ) -> None:
     """Build a wheel of the current project and any additional wheels."""
     setenv(PIP_INDEX_URL=cfg.python.index_url)
+    if cfg.python.extra_index_urls:
+        setenv(PIP_EXTRA_INDEX_URL=" ".join(cfg.python.extra_index_urls))
     search_paths = paths or cfg.python.build_wheels
     for build_path in {Path(path).absolute() for path in search_paths}:
         try:
             echo("Building PEP 517-like wheel")
-            sh(
+            cmd = [
                 "python",
                 "-m",
                 "build",
@@ -199,20 +198,28 @@ def wheel(
                 build_path,
                 "-o",
                 "{spin.project_root}/dist",
-            )
+            ]
+            if cfg.verbosity <= Verbosity.NORMAL:
+                cmd.append("--config-setting=quiet=true")
+            sh(*cmd)
         except Abort:
             echo("Building does not seem to work, use legacy setup.py style")
             with cd(build_path):
-                sh(
+                cmd = [
                     "python",
                     "setup.py",
-                    None if cfg.verbosity > Verbosity.NORMAL else "-v" "build",
+                ]
+                if cfg.verbosity <= Verbosity.NORMAL:
+                    cmd.append("-q")
+                cmd += [
+                    "build",
                     "-b",
                     "{spin.project_root}/build",
                     "bdist_wheel",
                     "-d",
                     "{spin.project_root}/dist",
-                )
+                ]
+                sh(*cmd)
 
 
 @task()
@@ -297,8 +304,13 @@ def _check_venv(  # pylint: disable=too-many-return-statements
     cfg: ConfigTree,
 ) -> bool:
     """
-    Checks whether the venv is actually a venv compatible
-    with our configuration and not just some dir.
+    Checks whether the venv is actually a venv compatible with our configuration
+    and not just some dir.
+
+    Uses absolute interpreter paths and runs *outside* the subprocess environment
+    on purpose: it must work while inspecting an existing venv to decide whether a
+    ``python.version`` change requires rebuilding it -- i.e. before the new
+    interpreter is provisioned.
     """
     try:
         python_version = (
@@ -402,6 +414,11 @@ def configure(cfg: ConfigTree) -> None:
     if cfg.python.aws_auth.enabled:
         _check_aws_token_validity(cfg)
 
+    # Provide spin's subprocess environment (see python_env). Registered here
+    # rather than in init so it is also available to the provision and
+    # finalize_provision hooks of plugins depending on this one.
+    cfg.spin.subprocess_environment = lambda: python_env(cfg)
+
 
 def init(cfg: ConfigTree) -> None:
     """Initialize the python plugin"""
@@ -413,32 +430,85 @@ def init(cfg: ConfigTree) -> None:
                 " project. You might want to run spin with the 'provision'"
                 " task."
             )
-    venv_init(cfg)
-
-
-# We won't activate more than once.
-ACTIVATED = False
 
 
 def venv_init(cfg: ConfigTree) -> None:
     """Activate the virtual environment"""
-    global ACTIVATED  # pylint: disable=global-statement
-    if os.environ.get("VIRTUAL_ENV", "") != cfg.python.venv and not ACTIVATED:
-        activate_this = cfg.python.scriptdir / "activate_this.py"
-        if not exists(activate_this):
-            die(
-                f"{cfg.python.venv} does not exist. You may want to provision"
-                " it using 'spin provision'"
-            )
-        if sys.platform == "win32":
-            echo(f"{cfg.python.scriptdir}\\activate.ps1")
-        else:
-            echo(f". {cfg.python.scriptdir}/activate")
-        with open(activate_this, encoding="utf-8") as file:
-            exec(  # pylint: disable=exec-used # nosec
-                file.read(), {"__file__": activate_this}
-            )
-        ACTIVATED = True
+    activate_this = cfg.python.scriptdir / "activate_this.py"
+    if not exists(activate_this):
+        die(
+            f"{cfg.python.venv} does not exist. You may want to provision"
+            " it using 'spin provision'"
+        )
+    if sys.platform == "win32":
+        echo(f"{cfg.python.scriptdir}\\activate.ps1")
+    else:
+        echo(f". {cfg.python.scriptdir}/activate")
+    with open(activate_this, encoding="utf-8") as file:
+        exec(  # pylint: disable=exec-used # nosec
+            file.read(), {"__file__": activate_this}
+        )
+
+
+@contextmanager
+def python_env(cfg: ConfigTree) -> Generator:
+    """
+    Context manager to activate the subprocess/python virtual environment and
+    deactivate it once done.
+
+    Registered as ``spin.subprocess_environment`` by the plugin's
+    :py:func:`configure` hook, so ``csspin.sh`` activates the virtual environment
+    around the commands it spawns. Activation is conditional: while the virtual
+    environment has not been created yet (e.g. early during ``spin provision``)
+    this is a no-op and the command runs in spin's in-process environment; once
+    the venv exists it is activated. Saving and restoring
+    ``os.environ``, ``sys.path`` and the ``sys`` prefix attributes makes nesting
+    safe -- an explicit ``with python_env(cfg):`` block whose inner ``csspin.sh``
+    re-enters this context.
+
+    See the "The subprocess environment" section of csspin's plugin development
+    guide for the general concept.
+    """
+    if not exists(cfg.python.scriptdir / "activate_this.py"):
+        # The virtual environment has not been provisioned (yet); run the command
+        # in spin's in-process environment instead of activating.
+        yield
+    else:
+
+        def interpolate_environ_value(value: str) -> str:
+            if not value:
+                return ""
+            value = str(value)
+            keys = re.findall(r"{(?P<key>\w+?)}", value)
+            for key in keys:
+                if key in os.environ:
+                    value = value.replace(f"{{{key}}}", os.environ[key])
+            return value
+
+        missing = object()
+        old_env = os.environ.copy()
+        old_sys_path = sys.path.copy()
+        old_sys_prefix = sys.prefix
+        old_real_prefix = getattr(sys, "real_prefix", missing)
+        try:
+            for name, value in EXPORTS:
+                os.environ[name] = interpolate_environ_value(value)
+
+            venv_init(cfg)
+            yield
+        finally:
+            echo(f"deactivate {cfg.python.venv}")
+            os.environ.clear()
+            os.environ.update(old_env)
+            sys.path = old_sys_path
+            sys.prefix = old_sys_prefix
+            # activate_this.py sets sys.real_prefix on activation; restore it (or
+            # remove it) so the attribute does not leak past this context.
+            if old_real_prefix is missing:
+                if hasattr(sys, "real_prefix"):
+                    delattr(sys, "real_prefix")
+            else:
+                setattr(sys, "real_prefix", old_real_prefix)
 
 
 class ActivateScriptPatcher(abc.ABC):
@@ -721,7 +791,9 @@ class PythonActivate(ActivateScriptPatcher):
 
 
 @cache
-def get_project_metadata(project_path: str, index_url: str) -> dict:  # type: ignore[return] # pylint: disable=inconsistent-return-statements # noqa: E501
+def get_project_metadata(  # type: ignore[return] # pylint: disable=inconsistent-return-statements # noqa: E501
+    project_path: str, index_url: str, extra_index_urls: tuple[str, ...] = ()
+) -> dict:
     """
     Retrieve project metadata of ``project_path`` via ``python -m build
     --metadata``.
@@ -730,12 +802,16 @@ def get_project_metadata(project_path: str, index_url: str) -> dict:  # type: ig
     every caller within the same process.
     """
     setenv(PIP_INDEX_URL=index_url)
+    if extra_index_urls:
+        setenv(PIP_EXTRA_INDEX_URL=" ".join(extra_index_urls))
     kwargs = {}
     if CONFIG.verbosity < Verbosity.INFO:
         kwargs["stderr"] = subprocess.DEVNULL
     raw_metadata = backtick(
         "python", "-m", "build", "--metadata", project_path, **kwargs
     )
+    if extra_index_urls:
+        setenv(PIP_EXTRA_INDEX_URL=None)
     setenv(PIP_INDEX_URL=None)
 
     if raw_metadata:
@@ -975,7 +1051,6 @@ def venv_provision(  # pylint: disable=too-many-branches,missing-function-docstr
         info("Provisioning venv '{python.venv}'")
         cfg.python.provisioner.provision_venv(cfg)
 
-    # This sets PATH to the venv
     init(cfg)
 
     _configure_pipconf(cfg)
@@ -1055,21 +1130,78 @@ def _configure_pipconf(cfg: ConfigTree, update: bool = False) -> None:
         "index_url" in config_parser["global"] or "index-url" in config_parser["global"]
     ):
         config_parser["global"]["index_url"] = interpolate1(cfg.python.index_url)
+
+    # Extra index urls are only configured via 'python.extra_index_urls', not
+    # 'python.pipconf', so drop whatever the pipconf template declares rather
+    # than merging it in.
+    for key in ("extra_index_url", "extra-index-url"):
+        config_parser["global"].pop(key, None)
+
+    if cfg.python.extra_index_urls:
+        config_parser["global"]["extra_index_url"] = "\n".join(
+            interpolate1(url) for url in cfg.python.extra_index_urls
+        )
     with open(_get_pipconf(cfg), mode="w", encoding="utf-8") as fd:
         config_parser.write(fd)
 
 
 def _obfuscate_index_url(index_url: str) -> None:
-    """Add the CodeArtifact token to the secrets."""
+    """Add the credentials of an index URL to the secrets."""
 
     from csspin import secrets
 
-    secrets.add(index_url.split(":")[2].split("@")[0])  # Codeartifact token
+    if password := urlsplit(index_url).password:
+        secrets.add(password)
 
 
-def _check_aws_token_validity(  # pylint: disable=too-many-locals
-    cfg: ConfigTree,
-) -> None:
+def _merge_extra_index_urls(existing: Iterable[str], new: list[str]) -> list[str]:
+    """
+    Merge `new` extra index URLs into `existing`, preserving order and dropping
+    duplicates. Used so that a user-configured ``python.extra_index_urls``
+    survives aws_auth resolving its own CodeArtifact-backed extra indexes.
+    """
+    merged = list(existing)
+    for url in new:
+        if url not in merged:
+            merged.append(url)
+    return merged
+
+
+def _resolve_extra_index_urls(cfg: ConfigTree, index_base_url: str) -> list[str]:
+    """
+    Resolve ``python.aws_auth.extra_indexes`` into full, authenticated
+    CodeArtifact index URLs, obfuscating each token along the way.
+    """
+
+    extra_index_urls = []
+    for extra_index in cfg.python.aws_auth.extra_indexes:
+        extra_index_url = urljoin(index_base_url + "/", interpolate1(extra_index))
+        # Kinda redundant since index_url carries the same secret and is already
+        # obfuscated. So this noop here just exists to make the obfucation
+        # explicit.
+        _obfuscate_index_url(extra_index_url)
+        extra_index_urls.append(extra_index_url)
+    return extra_index_urls
+
+
+def _apply_resolved_index_urls(cfg: ConfigTree, index_base_url: str) -> None:
+    """
+    Set ``python.index_url`` and merge-resolve ``python.extra_index_urls`` from
+    `index_base_url`, the CodeArtifact domain/repository base shared by the
+    primary index and any ``aws_auth.extra_indexes``. Shared by both the
+    fresh-token and cached-token paths of ``_check_aws_token_validity``.
+    """
+
+    index_url = urljoin(index_base_url + "/", interpolate1(cfg.python.aws_auth.index))
+    cfg.python.index_url = index_url
+    _obfuscate_index_url(index_url)
+    cfg.python.extra_index_urls = _merge_extra_index_urls(
+        cfg.python.extra_index_urls,
+        _resolve_extra_index_urls(cfg, index_base_url),
+    )
+
+
+def _check_aws_token_validity(cfg: ConfigTree) -> None:
     """
     If csspin-python[aws_auth] is installed, we can use csaccess to get the
     CodeArtifact authentication token.
@@ -1085,66 +1217,39 @@ def _check_aws_token_validity(  # pylint: disable=too-many-locals
 
     import time
 
-    if not (
-        client_secret := (
-            interpolate1(cfg.python.aws_auth.client_secret)
-            or os.getenv("CS_AWS_OIDC_CLIENT_SECRET")
-        )
-    ):
-        die(
-            "Please provide a client secret for CodeArtifact access via"
-            " 'python.aws_auth.client_secret'."
-        )
-
     current_time = int(time.time())
     timestamp_key = "aws_auth_timestamp"
 
     with memoizer(cfg.python.aws_auth.memo) as memo:
-        for item in memo.items():
-            if isinstance(item, str) and item.startswith(f"{timestamp_key}:"):
-                last_time = int(item.split(":", 1)[1])
+        if memo.items() and (item := memo.items()[0]):
+            if not isinstance(item, tuple):
+                memo.clear()
+            else:
+                _, last_time, index_base_url = item
                 if current_time - last_time < int(
                     interpolate1(cfg.python.aws_auth.key_duration)
                 ):
-                    pipconf = _get_pipconf(cfg)
-                    config_parser = configparser.ConfigParser()
-                    config_parser.read(pipconf)
-                    info(f"Using existing index URL from {pipconf}.")
-
-                    if index_url := (
-                        config_parser["global"].get("index_url")
-                        or config_parser["global"].get("index-url")
-                    ):
-                        cfg.python.index_url = index_url
-                        _obfuscate_index_url(index_url)
-                    break
-                memo.items().remove(item)
-        else:
-            info("Updating Codeartifact token.")
-            from urllib.error import HTTPError
-            from urllib.parse import urljoin
-
-            opts = {
-                "client_secret": client_secret,
-                "static_oidc": interpolate1(cfg.python.aws_auth.static_oidc).lower()
-                == "true",
-            }
-            if cfg.python.aws_auth.client_id:
-                opts["client_id"] = interpolate1(cfg.python.aws_auth.client_id)
-            if cfg.python.aws_auth.role_arn:
-                opts["aws_role_arn"] = interpolate1(cfg.python.aws_auth.role_arn)
+                    info("Using cached CodeArtifact token.")
+                    _apply_resolved_index_urls(cfg, index_base_url)
+                    return
+                memo.clear()
 
-            try:
-                index_base_url = get_ca_pypi_url_programmatic(**opts)
-            except HTTPError as e:
-                die(f"Failed to establish CodeArtifact connection: {e}")
+        info("Updating Codeartifact token.")
 
-            index_url = urljoin(
-                index_base_url + "/", interpolate1(cfg.python.aws_auth.index)
-            )
-            cfg.python.index_url = index_url
-            _obfuscate_index_url(index_url)
+        opts = {}
+
+        if cfg.python.aws_auth.client_id:
+            opts["client_id"] = interpolate1(cfg.python.aws_auth.client_id)
+        if cfg.python.aws_auth.role_arn:
+            opts["aws_role_arn"] = interpolate1(cfg.python.aws_auth.role_arn)
+
+        try:
+            index_base_url = get_ca_pypi_url_programmatic(**opts)
+        except HTTPError as e:
+            die(f"Failed to establish CodeArtifact connection: {e}")
+
+        _apply_resolved_index_urls(cfg, index_base_url)
 
-            if exists(cfg.python.venv):
-                _configure_pipconf(cfg, update=True)
-            memo.add(f"{timestamp_key}:{current_time}")
+        if exists(cfg.python.venv):
+            _configure_pipconf(cfg, update=True)
+        memo.add((timestamp_key, current_time, index_base_url))

csspin_python/python_sbom.py

@@ -25,6 +25,7 @@ from importlib.metadata import metadata as _pkg_metadata
 from importlib.metadata import version as _pkg_version
 from subprocess import DEVNULL, PIPE
 from tempfile import TemporaryDirectory
+from urllib.parse import quote, urlencode, urlparse
 
 from csspin import (
     Verbosity,
@@ -40,12 +41,14 @@ from csspin import (
 )
 from csspin.tree import ConfigTree
 from packaging.requirements import Requirement
+from packaging.utils import canonicalize_name
 from path import Path
 
 defaults = config(
     cyclonedx_bom_version="7.3.0",
     project_paths=["{spin.project_root}"],
-    requires=config(spin=["csspin_python.python"]),
+    repository_url="{python.index_url}",
+    requires=config(spin=["csspin_python.python"], python=["setuptools"]),
 )
 
 
@@ -68,13 +71,26 @@ def sbom(cfg: ConfigTree) -> None:
             die(f"Project path '{project_path}' does not exist.")
 
         project_path = Path(project_path).absolute()
-        metadata = get_project_metadata(project_path, cfg.python.index_url)
+        metadata = get_project_metadata(
+            project_path, cfg.python.index_url, tuple(cfg.python.extra_index_urls)
+        )
+        project_name, project_version = metadata.get("name"), metadata.get("version")
+
+        file_name = _predict_wheel_filename(
+            project_path, project_name, project_version, cfg.python.python
+        )
         third_party_deps = _collect_thirdparty_deps(
             metadata.get("requires_dist", set()), python_version=cfg.python.version
         )
         sbom_json = json.loads(_run_cyclonedx(cfg, third_party_deps, stderr))
-        _enrich_sbom(sbom_json, metadata, third_party_deps)
-        _write_sbom(cfg, sbom_json, metadata.get("name"))
+        _enrich_sbom(
+            sbom_json,
+            metadata,
+            third_party_deps,
+            cfg.python_sbom.repository_url,
+            file_name,
+        )
+        _write_sbom(cfg, sbom_json, project_name)
 
 
 def cleanup(cfg: ConfigTree) -> None:
@@ -114,7 +130,7 @@ def _ensure_cyclonedx_venv(cfg: ConfigTree, binary_dir: str, quiet: str | None)
         )
         rmtree(venv_cdx)
 
-    sh(cfg.python.interpreter, "-m", "venv", venv_cdx)
+    sh(cfg.python.interpreter, "-m", "venv", venv_cdx, use_subprocess_environment=False)
     sh(
         interpreter_cdx,
         "-m",
@@ -124,7 +140,9 @@ def _ensure_cyclonedx_venv(cfg: ConfigTree, binary_dir: str, quiet: str | None)
         "install",
         "--index-url",
         cfg.python.index_url,
+        *[f"--extra-index-url={url}" for url in cfg.python.extra_index_urls],
         "cyclonedx-bom==" + requested_version,
+        use_subprocess_environment=False,
     )
     with memoizer(memo_file) as memo:
         memo.add(memo_key)
@@ -143,7 +161,7 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
     with TemporaryDirectory() as tmp_dir:
         venv = Path(tmp_dir) / "venv"
         interpreter = venv / binary_dir / "python" + cfg.platform.exe
-        sh(cfg.python.interpreter, "-m", "venv", venv)
+        sh(cfg.python.interpreter, "-m", "venv", venv, use_subprocess_environment=False)
         if third_party_deps:
             sh(
                 interpreter,
@@ -153,15 +171,34 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
                 "install",
                 "--index-url",
                 cfg.python.index_url,
+                *[f"--extra-index-url={url}" for url in cfg.python.extra_index_urls],
                 *[
                     f"--constraint={constraint}"
                     for constraint in cfg.python.constraints
                 ],
                 *third_party_deps,
+                use_subprocess_environment=False,
                 stderr=stderr,
             )
-        sh(interpreter, "-m", "pip", quiet, "uninstall", "-y", "pip")
-        return backtick(interpreter_cdx, "-m", "cyclonedx_py", "environment", venv, stderr=stderr)  # type: ignore[no-any-return] # noqa: E501
+        sh(
+            interpreter,
+            "-m",
+            "pip",
+            quiet,
+            "uninstall",
+            "-y",
+            "pip",
+            use_subprocess_environment=False,
+        )
+        return backtick(  # type: ignore[no-any-return]
+            interpreter_cdx,
+            "-m",
+            "cyclonedx_py",
+            "environment",
+            venv,
+            use_subprocess_environment=False,
+            stderr=stderr,
+        )
 
 
 def _write_sbom(cfg: ConfigTree, sbom_json: dict, project_name: str) -> None:
@@ -197,7 +234,52 @@ def _parse_authors(author_name: str, author_email: str) -> str:
     return ", ".join(f"{name} ({addr})" for name, addr in entries)
 
 
-def _build_primary_component(metadata: dict) -> tuple[dict, str]:
+def _repository_base_url(index_url: str) -> str:
+    """Reduce a pip index URL to the repository base URL a purl expects."""
+    parsed = urlparse(index_url)
+    segments = [segment for segment in parsed.path.split("/") if segment]
+    if segments and segments[-1] in ("simple", "+simple"):
+        segments.pop()
+    return parsed._replace(
+        netloc=parsed.netloc.rsplit("@", 1)[-1],  # drop basic-auth credentials
+        path="/".join([""] + segments),
+    ).geturl()
+
+
+def _build_purl(name: str, version: str, repository_url: str, file_name: str) -> str:
+    """Build the pypi Package URL for a project, per tn-0058.
+
+    ``repository_url`` is only added when the package isn't published to
+    public pypi.org, since type, name and version are unique there already.
+    """
+    purl = f"pkg:pypi/{canonicalize_name(name)}@{quote(version, safe=':')}"
+
+    qualifiers = {"file_name": file_name}
+    if urlparse(repository_url).hostname != "pypi.org":
+        qualifiers["repository_url"] = _repository_base_url(repository_url)
+
+    return f"{purl}?{urlencode(sorted(qualifiers.items()), safe=':')}"
+
+
+def _predict_wheel_filename(
+    project_path: str, name: str, version: str, interpreter: str
+) -> str:
+    """
+    Predict the wheel filename ``python:wheel`` will produce for
+    ``project_path``, without building it.
+
+    ``name`` and ``version`` come from :func:`get_project_metadata`.
+    ``interpreter`` must be ``project_path``'s own, since it owns the tags.
+    Cached since the prediction is identical for every caller within the same
+    process.
+    """
+    script = Path(__file__).parent / "_predict_wheel_filename.py"
+    return backtick(interpreter, script, project_path, name, version).strip()  # type: ignore[no-any-return] # noqa: E501
+
+
+def _build_primary_component(
+    metadata: dict, repository_url: str, file_name: str
+) -> tuple[dict, str]:
     """Build the CycloneDX primary component dict and its bom-ref from project metadata."""
     if not (name := metadata.get("name")):
         die("Project metadata is missing 'name'.")
@@ -206,6 +288,7 @@ def _build_primary_component(metadata: dict) -> tuple[dict, str]:
     if not (license_id := metadata.get("license")):
         die("Project metadata is missing 'license'.")
 
+    purl = _build_purl(str(name), str(version), repository_url, file_name)
     authors = _parse_authors(
         author_name=metadata.get("author", "").strip(),
         author_email=metadata.get("author_email", "").strip(),
@@ -216,6 +299,7 @@ def _build_primary_component(metadata: dict) -> tuple[dict, str]:
         "bom-ref": primary_ref,
         "licenses": [{"expression": license_id}],
         "name": name,
+        "purl": purl,
         "type": "application",
         "version": version,
     }
@@ -226,9 +310,13 @@ def _enrich_sbom(
     sbom_json: dict,
     metadata: dict,
     third_party_deps: set[str],
+    repository_url: str,
+    file_name: str,
 ) -> None:
     """Add the primary component and its dependency entry to the CycloneDX document."""
-    component, primary_ref = _build_primary_component(metadata)
+    component, primary_ref = _build_primary_component(
+        metadata, repository_url, file_name
+    )
     existing_metadata = sbom_json.get("metadata", {})
     existing_tools = existing_metadata.get("tools", {})
     existing_tool_components = (

csspin_python/python_sbom_schema.yaml

@@ -16,3 +16,8 @@ python_sbom:
             help: |
                 Version of the cyclonedx-bom package to use for generating the
                 SBOM.
+        repository_url:
+            type: str
+            help: |
+                URL of the package index used for the primary component's
+                Package URL. Defaults to 'python.index_url'.

csspin_python/python_schema.yaml

@@ -116,6 +116,13 @@ python:
                 The index url from where packages should get installed into the
                 venv. This value will also be put into cfg.python.pipconf, if
                 not already mentioned there.
+        extra_index_urls:
+            type: list
+            help: |
+                Additional package indexes to install from, alongside
+                'index_url'. If 'aws_auth.extra_indexes' is set, its
+                resolved, authenticated CodeArtifact URLs are merged into
+                this list.
         build_wheels:
             type: list
             help: |
@@ -141,22 +148,17 @@ python:
                         Time in seconds defining how long the plugin should
                         consider the authentication token as valid before
                         issuing a new one.
-                static_oidc:
-                    type: bool
-                    help: |
-                        Whether to static OIDC when authenticating with AWS
-                        CodeArtifact.
                 index:
                     type: str
-                    help: The CodeArtifact repository index (e.g. "16.0/simple").
+                    help: The CodeArtifact repository index (e.g. "2026.2/simple").
+                extra_indexes:
+                    type: list
+                    help: |
+                        Additional CodeArtifact repository indexes to
+                        authenticate against, alongside 'index'.
                 client_id:
                     type: str
                     help: The OIDC client ID to use.
-                client_secret:
-                    type: secret
-                    help: |
-                        The OIDC client secret to use, defaults to the
-                        environment variable 'CS_AWS_OIDC_CLIENT_SECRET'.
                 role_arn:
                     type: str
                     help: The role ARN to assume when authenticating.

csspin_python/uv_provisioner.py

@@ -161,16 +161,26 @@ class SimpleUvProvisioner(SimpleProvisioner):
         self._uv_cmd("pip", "install", "pip")
 
 
+def _set_extra_index_url(toml_content: dict, extra_index_urls: list[str]) -> None:
+    """Set or drop the 'extra-index-url' key in `toml_content` in place."""
+    if extra_index_urls:
+        toml_content["extra-index-url"] = extra_index_urls
+    else:
+        toml_content.pop("extra-index-url", None)
+
+
 def _configure_uv_toml(cfg: ConfigTree) -> None:
     """
     Create a config file for uv, similar to the pip.conf of
     csspin_python.python, since `uv` pip won't respect the pip.conf.
+
+    'index-url'/'extra-index-url' declared in the 'uv_provisioner.uv_toml'
+    template are ignored; 'python.index_url'/'python.extra_index_urls' are
+    the only supported way to configure these.
     """
     toml_content = tomllib.loads(cfg.uv_provisioner.uv_toml or "")
-    if "index-url" not in toml_content:
-        toml_content["index-url"] = cfg.python.index_url
-    else:
-        toml_content["index-url"] = toml_content.get("index-url", cfg.python.index_url)
+    toml_content["index-url"] = cfg.python.index_url
+    _set_extra_index_url(toml_content, cfg.python.extra_index_urls)
 
     with open(cfg.uv_provisioner.uv_toml_path, mode="wb") as fd:
         tomli_w.dump(toml_content, fd)
@@ -178,12 +188,20 @@ def _configure_uv_toml(cfg: ConfigTree) -> None:
 
 def _update_index_url_in_toml(cfg: ConfigTree) -> None:
     """
-    Update the index-url in the uv.toml in case it changed.
+    Update the index-url and extra-index-url in the uv.toml in case they
+    changed.
     """
     if (uv_toml_path := interpolate1(Path(cfg.uv_provisioner.uv_toml_path))).exists():
         with open(uv_toml_path, mode="rb") as fd:
             toml_content = tomllib.load(fd)
+        changed = False
         if toml_content.get("index-url") != cfg.python.index_url:
             toml_content["index-url"] = cfg.python.index_url
+            changed = True
+
+        if toml_content.get("extra-index-url", []) != cfg.python.extra_index_urls:
+            _set_extra_index_url(toml_content, cfg.python.extra_index_urls)
+            changed = True
+        if changed:
             with open(uv_toml_path, mode="wb") as fd:
                 tomli_w.dump(toml_content, fd)

{csspin_python-4.1.0rc2.dist-info → csspin_python-6.0.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csspin-python
-Version: 4.1.0rc2
+Version: 6.0.0
 Summary: Plugin-package for csspin providing Python related plugins
 Author-email: CONTACT Software GmbH <info@contact-software.com>
 Maintainer-email: Waleri Enns <waleri.enns@contact-software.com>, Benjamin Thomas Schwertfeger <benjaminthomas.schwertfeger@contact-software.com>, Fabian Hafer <fabian.hafer@contact-software.com>
@@ -27,7 +27,7 @@ License-File: LICENSE
 Requires-Dist: platformdirs~=4.3.8
 Requires-Dist: virtualenv
 Provides-Extra: aws-auth
-Requires-Dist: csaccess>=0.1.0; extra == "aws-auth"
+Requires-Dist: csaccess>=0.3.0; extra == "aws-auth"
 Provides-Extra: uv
 Requires-Dist: tomli; python_version < "3.11" and extra == "uv"
 Requires-Dist: tomli-w; extra == "uv"

csspin_python-6.0.0.dist-info/RECORD

@@ -0,0 +1,24 @@
+csspin_python/_predict_wheel_filename.py,sha256=sz09QpDOPQesG-QAANjH607QSkS3PFo0qxPifG1y85o,2399
+csspin_python/behave.py,sha256=iJZeyIqB7V_NzTdLTZldNY9W_GGwCWkXe6WY69wpDqs,4997
+csspin_python/behave_schema.yaml,sha256=8qoOCK-uTmwgRRW29urgK0X_kgn0zO0X34v89bvii2w,1241
+csspin_python/debugpy.py,sha256=v0ZZopv5TNoSaFf2kiePsw9OmhBpjfOBFh0u71jTcnQ,962
+csspin_python/debugpy_schema.yaml,sha256=BeH30nSirDYctkdhS9xMXUG5htj3PED_ZjmxPG5WRUc,364
+csspin_python/devpi.py,sha256=o7O06Dw-xt47y-M74TShcl9MUMaW78aFmw6i6ISYwoU,2351
+csspin_python/devpi_schema.yaml,sha256=2gPATWjVcfvCTrGZX2FK6wH8hh9KS0XzZ35JvZeJGEU,487
+csspin_python/playwright.py,sha256=oFfphLqa4AB6K9vasCUFHN0kFXu63n3ocrsqVuRp4-0,5102
+csspin_python/playwright_schema.yaml,sha256=TSeR16YHa7m7bfO59F2eMV-jXcglluTJdEpUeL16saY,1178
+csspin_python/pytest.py,sha256=vSLtmS-kNO0NPo_tszfEm5zGwJb6Yb5IGS-hA7CNguo,4544
+csspin_python/pytest_schema.yaml,sha256=tzXtdF6MvGC9v59EVRJFfLeMMHqPsXcFXy2zJtRECBI,1535
+csspin_python/python.py,sha256=uoWCm_X2_yGaOdnxAb_h2Mr8RjLd5MjuVL4cPF15E2E,41973
+csspin_python/python_sbom.py,sha256=AT_dFEKoghZTVkkTECz0cOo-w3AZAYAgROx4prhAHKw,13603
+csspin_python/python_sbom_schema.yaml,sha256=QysysjGJ6n1WEoLBqYHcdbojuEomUvL8QG4ZSWQW2_8,739
+csspin_python/python_schema.yaml,sha256=RwJgbyIRenj18-s60HmqkwWCGtd6G1acpJ9TDI9QjBQ,6448
+csspin_python/radon.py,sha256=uFqm6FEi5oWj-_XVaAm3s9cam0cUmr1_FwRf40K6xWs,1876
+csspin_python/radon_schema.yaml,sha256=rlRzXw5z4XbjOVznRiUxWGP4E9hx1Jm-gGw1iQiYzE0,548
+csspin_python/uv_provisioner.py,sha256=2M1I8PqWTCUxqaOeJI5rchmly6t-MnOPQfIx-kKzdQU,6757
+csspin_python/uv_provisioner_schema.yaml,sha256=Y8ZNC2OMnhR8Us3WUXAXK9hMjqGWAKFJB2puX4X5XNQ,727
+csspin_python-6.0.0.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
+csspin_python-6.0.0.dist-info/METADATA,sha256=a-NIDfoER1W6_3YNyaxS_RKPKLXmWp6tk-uApcS6Lr4,5254
+csspin_python-6.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+csspin_python-6.0.0.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
+csspin_python-6.0.0.dist-info/RECORD,,

{csspin_python-4.1.0rc2.dist-info → csspin_python-6.0.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (82.0.1)
+Generator: setuptools (84.0.0)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

csspin_python-4.1.0rc2.dist-info/RECORD

@@ -1,25 +0,0 @@
-csspin_python/behave.py,sha256=iJZeyIqB7V_NzTdLTZldNY9W_GGwCWkXe6WY69wpDqs,4997
-csspin_python/behave_schema.yaml,sha256=8qoOCK-uTmwgRRW29urgK0X_kgn0zO0X34v89bvii2w,1241
-csspin_python/debugpy.py,sha256=v0ZZopv5TNoSaFf2kiePsw9OmhBpjfOBFh0u71jTcnQ,962
-csspin_python/debugpy_schema.yaml,sha256=BeH30nSirDYctkdhS9xMXUG5htj3PED_ZjmxPG5WRUc,364
-csspin_python/devpi.py,sha256=o7O06Dw-xt47y-M74TShcl9MUMaW78aFmw6i6ISYwoU,2351
-csspin_python/devpi_schema.yaml,sha256=2gPATWjVcfvCTrGZX2FK6wH8hh9KS0XzZ35JvZeJGEU,487
-csspin_python/playwright.py,sha256=oFfphLqa4AB6K9vasCUFHN0kFXu63n3ocrsqVuRp4-0,5102
-csspin_python/playwright_schema.yaml,sha256=TSeR16YHa7m7bfO59F2eMV-jXcglluTJdEpUeL16saY,1178
-csspin_python/pytest.py,sha256=N9YaU_ouQab0PFPf46HLE7Vg4JeoZW4dzVD7EevqJ1U,4573
-csspin_python/pytest_schema.yaml,sha256=tzXtdF6MvGC9v59EVRJFfLeMMHqPsXcFXy2zJtRECBI,1535
-csspin_python/python.py,sha256=yqH1eG6mqRJomu-F99cB74PFaUzbSoG_dhpUjYwr1xE,37725
-csspin_python/python_sbom.py,sha256=8NVZ6uVUz7rU3VhEoXJ_wHLCdv4BIV6Zjz1ZRa9nQhc,10488
-csspin_python/python_sbom_schema.yaml,sha256=VCxY9E2AG_fS00dvIYe6Fbvz1maPjpY0zyZK1Z0wJu4,538
-csspin_python/python_schema.yaml,sha256=pgVVjByUYjxQWek7aFmjQzRwmq2ROLvHYgwGPMrT9sM,6351
-csspin_python/radon.py,sha256=uFqm6FEi5oWj-_XVaAm3s9cam0cUmr1_FwRf40K6xWs,1876
-csspin_python/radon_schema.yaml,sha256=rlRzXw5z4XbjOVznRiUxWGP4E9hx1Jm-gGw1iQiYzE0,548
-csspin_python/uv_provisioner.py,sha256=1e-_Sb39JrqNWyaUNeBX59R5tutXLJ1ZsT7urCN1U0I,6044
-csspin_python/uv_provisioner_schema.yaml,sha256=Y8ZNC2OMnhR8Us3WUXAXK9hMjqGWAKFJB2puX4X5XNQ,727
-csspin_python-4.1.0rc2.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
-csspin_python-4.1.0rc2.dist-info/METADATA,sha256=v7TeI32ffR2KghQaNg2Yi1nXefTReG2Pr6iI3D8LKM0,5257
-csspin_python-4.1.0rc2.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
-csspin_python-4.1.0rc2.dist-info/scm_file_list.json,sha256=Q47_SEZYR492yYYWq_DlPPp-64AFlvHaOz7APY0i8j0,2902
-csspin_python-4.1.0rc2.dist-info/scm_version.json,sha256=r-bmiPdloFp64jPWB2hS3VjSJvF_ljCIL5y985ukLKY,163
-csspin_python-4.1.0rc2.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
-csspin_python-4.1.0rc2.dist-info/RECORD,,

csspin_python-4.1.0rc2.dist-info/scm_file_list.json

@@ -1,78 +0,0 @@
-{
-  "files": [
-    "spinfile.yaml",
-    "README.rst",
-    ".pre-commit-config.yaml",
-    "CONTRIBUTING.md",
-    "requirements-dev.txt",
-    "LICENSE",
-    ".gitignore",
-    ".gitlab-ci.yml",
-    ".prettierrc.yaml",
-    "pyproject.toml",
-    ".readthedocs.yaml",
-    "doc/virtual_environment.rst",
-    "doc/development.rst",
-    "doc/relnotes.rst",
-    "doc/index.rst",
-    "doc/links.rst",
-    "doc/conf.py",
-    "doc/installation.rst",
-    "doc/plugins/playwright.rst",
-    "doc/plugins/uv_provisioner.rst",
-    "doc/plugins/debugpy.rst",
-    "doc/plugins/devpi.rst",
-    "doc/plugins/python.rst",
-    "doc/plugins/python_sbom.rst",
-    "doc/plugins/pytest.rst",
-    "doc/plugins/behave.rst",
-    "doc/plugins/radon.rst",
-    "tests/conftest.py",
-    "tests/unit/test_uv_provisioner.py",
-    "tests/unit/test_python_sbom.py",
-    "tests/unit/test_python.py",
-    "tests/integration/test_provisioning.py",
-    "tests/integration/conftest.py",
-    "tests/integration/fixtures/activation_script/test_env.ps1",
-    "tests/integration/fixtures/activation_script/test_env.sh",
-    "tests/integration/fixtures/activation_script/plugins/dummy.py",
-    "tests/integration/yamls/pytest.yaml",
-    "tests/integration/yamls/uv_provisioner_use.yaml",
-    "tests/integration/yamls/pytest_with_playwright.yaml",
-    "tests/integration/yamls/python_version.yaml",
-    "tests/integration/yamls/playwright.yaml",
-    "tests/integration/yamls/devpi.yaml",
-    "tests/integration/yamls/python_use.yaml",
-    "tests/integration/yamls/behave.yaml",
-    "tests/integration/yamls/radon.yaml",
-    "tests/integration/yamls/python_activation_scripts.yaml",
-    "tests/integration/yamls/uv_provisioner.yaml",
-    "tests/acceptance/test_aws_auth.py",
-    "tests/acceptance/python_sbom/spinfile.yaml",
-    "tests/acceptance/python_sbom/test_sbom.py",
-    "tests/acceptance/python_sbom/pyproject.toml",
-    "tests/acceptance/python_constraints/test_constraints.py",
-    "tests/acceptance/python_constraints/spinfile.yaml",
-    "tests/acceptance/python_constraints/constraints.txt",
-    "tests/acceptance/yamls/python_aws_auth.yaml",
-    "src/csspin_python/debugpy_schema.yaml",
-    "src/csspin_python/devpi_schema.yaml",
-    "src/csspin_python/uv_provisioner_schema.yaml",
-    "src/csspin_python/pytest.py",
-    "src/csspin_python/playwright_schema.yaml",
-    "src/csspin_python/behave.py",
-    "src/csspin_python/pytest_schema.yaml",
-    "src/csspin_python/uv_provisioner.py",
-    "src/csspin_python/radon.py",
-    "src/csspin_python/python_sbom_schema.yaml",
-    "src/csspin_python/python_sbom.py",
-    "src/csspin_python/devpi.py",
-    "src/csspin_python/debugpy.py",
-    "src/csspin_python/playwright.py",
-    "src/csspin_python/behave_schema.yaml",
-    "src/csspin_python/python.py",
-    "src/csspin_python/python_schema.yaml",
-    "src/csspin_python/radon_schema.yaml",
-    ".gitlab/merge_request_templates/default.md"
-  ]
-}

csspin_python-4.1.0rc2.dist-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "4.1.0rc2",
-  "distance": 0,
-  "node": "gcaf72582381496c091ef82854c9703c0c9583259",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-06-23"
-}