csspin-python 5.0.0__py3-none-any.whl → 6.0.0__py3-none-any.whl

csspin_python/python.py

@@ -81,6 +81,8 @@ from functools import cache
 from subprocess import CalledProcessError, check_output
 from textwrap import dedent, indent
 from typing import Generator, Iterable, Type, Union
+from urllib.error import HTTPError
+from urllib.parse import urljoin, urlsplit
 
 try:
     from typing import Self  # type: ignore[attr-defined]
@@ -162,11 +164,6 @@ defaults = config(
         enabled=False,
         memo="{spin.spin_dir}/aws_auth.memo",
         key_duration=3600 * 10,  # 10 hours
-        static_oidc=False,
-        index="16.0/simple",
-        # Need to set client secret to empty string, otherwise the string "None"
-        # would be handled as secret and obfucsated in logs.
-        client_secret="",  # nosec: B106
     ),
     index_url="https://pypi.org/simple",
     skip_js_build=None,
@@ -187,6 +184,8 @@ def wheel(
 ) -> None:
     """Build a wheel of the current project and any additional wheels."""
     setenv(PIP_INDEX_URL=cfg.python.index_url)
+    if cfg.python.extra_index_urls:
+        setenv(PIP_EXTRA_INDEX_URL=" ".join(cfg.python.extra_index_urls))
     search_paths = paths or cfg.python.build_wheels
     for build_path in {Path(path).absolute() for path in search_paths}:
         try:
@@ -792,7 +791,9 @@ class PythonActivate(ActivateScriptPatcher):
 
 
 @cache
-def get_project_metadata(project_path: str, index_url: str) -> dict:  # type: ignore[return] # pylint: disable=inconsistent-return-statements # noqa: E501
+def get_project_metadata(  # type: ignore[return] # pylint: disable=inconsistent-return-statements # noqa: E501
+    project_path: str, index_url: str, extra_index_urls: tuple[str, ...] = ()
+) -> dict:
     """
     Retrieve project metadata of ``project_path`` via ``python -m build
     --metadata``.
@@ -801,12 +802,16 @@ def get_project_metadata(project_path: str, index_url: str) -> dict:  # type: ig
     every caller within the same process.
     """
     setenv(PIP_INDEX_URL=index_url)
+    if extra_index_urls:
+        setenv(PIP_EXTRA_INDEX_URL=" ".join(extra_index_urls))
     kwargs = {}
     if CONFIG.verbosity < Verbosity.INFO:
         kwargs["stderr"] = subprocess.DEVNULL
     raw_metadata = backtick(
         "python", "-m", "build", "--metadata", project_path, **kwargs
     )
+    if extra_index_urls:
+        setenv(PIP_EXTRA_INDEX_URL=None)
     setenv(PIP_INDEX_URL=None)
 
     if raw_metadata:
@@ -1125,21 +1130,78 @@ def _configure_pipconf(cfg: ConfigTree, update: bool = False) -> None:
         "index_url" in config_parser["global"] or "index-url" in config_parser["global"]
     ):
         config_parser["global"]["index_url"] = interpolate1(cfg.python.index_url)
+
+    # Extra index urls are only configured via 'python.extra_index_urls', not
+    # 'python.pipconf', so drop whatever the pipconf template declares rather
+    # than merging it in.
+    for key in ("extra_index_url", "extra-index-url"):
+        config_parser["global"].pop(key, None)
+
+    if cfg.python.extra_index_urls:
+        config_parser["global"]["extra_index_url"] = "\n".join(
+            interpolate1(url) for url in cfg.python.extra_index_urls
+        )
     with open(_get_pipconf(cfg), mode="w", encoding="utf-8") as fd:
         config_parser.write(fd)
 
 
 def _obfuscate_index_url(index_url: str) -> None:
-    """Add the CodeArtifact token to the secrets."""
+    """Add the credentials of an index URL to the secrets."""
 
     from csspin import secrets
 
-    secrets.add(index_url.split(":")[2].split("@")[0])  # Codeartifact token
+    if password := urlsplit(index_url).password:
+        secrets.add(password)
 
 
-def _check_aws_token_validity(  # pylint: disable=too-many-locals
-    cfg: ConfigTree,
-) -> None:
+def _merge_extra_index_urls(existing: Iterable[str], new: list[str]) -> list[str]:
+    """
+    Merge `new` extra index URLs into `existing`, preserving order and dropping
+    duplicates. Used so that a user-configured ``python.extra_index_urls``
+    survives aws_auth resolving its own CodeArtifact-backed extra indexes.
+    """
+    merged = list(existing)
+    for url in new:
+        if url not in merged:
+            merged.append(url)
+    return merged
+
+
+def _resolve_extra_index_urls(cfg: ConfigTree, index_base_url: str) -> list[str]:
+    """
+    Resolve ``python.aws_auth.extra_indexes`` into full, authenticated
+    CodeArtifact index URLs, obfuscating each token along the way.
+    """
+
+    extra_index_urls = []
+    for extra_index in cfg.python.aws_auth.extra_indexes:
+        extra_index_url = urljoin(index_base_url + "/", interpolate1(extra_index))
+        # Kinda redundant since index_url carries the same secret and is already
+        # obfuscated. So this noop here just exists to make the obfucation
+        # explicit.
+        _obfuscate_index_url(extra_index_url)
+        extra_index_urls.append(extra_index_url)
+    return extra_index_urls
+
+
+def _apply_resolved_index_urls(cfg: ConfigTree, index_base_url: str) -> None:
+    """
+    Set ``python.index_url`` and merge-resolve ``python.extra_index_urls`` from
+    `index_base_url`, the CodeArtifact domain/repository base shared by the
+    primary index and any ``aws_auth.extra_indexes``. Shared by both the
+    fresh-token and cached-token paths of ``_check_aws_token_validity``.
+    """
+
+    index_url = urljoin(index_base_url + "/", interpolate1(cfg.python.aws_auth.index))
+    cfg.python.index_url = index_url
+    _obfuscate_index_url(index_url)
+    cfg.python.extra_index_urls = _merge_extra_index_urls(
+        cfg.python.extra_index_urls,
+        _resolve_extra_index_urls(cfg, index_base_url),
+    )
+
+
+def _check_aws_token_validity(cfg: ConfigTree) -> None:
     """
     If csspin-python[aws_auth] is installed, we can use csaccess to get the
     CodeArtifact authentication token.
@@ -1155,65 +1217,39 @@ def _check_aws_token_validity(  # pylint: disable=too-many-locals
 
     import time
 
-    client_secret = interpolate1(cfg.python.aws_auth.client_secret) or os.getenv(
-        "CS_AWS_OIDC_CLIENT_SECRET"
-    )
-    static_oidc = interpolate1(cfg.python.aws_auth.static_oidc).lower() == "true"
-
-    if static_oidc and not client_secret:
-        die(
-            "Please provide a client secret for CodeArtifact access via"
-            " 'python.aws_auth.client_secret' when using static OIDC."
-        )
-
     current_time = int(time.time())
     timestamp_key = "aws_auth_timestamp"
 
     with memoizer(cfg.python.aws_auth.memo) as memo:
-        for item in memo.items():
-            if isinstance(item, str) and item.startswith(f"{timestamp_key}:"):
-                last_time = int(item.split(":", 1)[1])
+        if memo.items() and (item := memo.items()[0]):
+            if not isinstance(item, tuple):
+                memo.clear()
+            else:
+                _, last_time, index_base_url = item
                 if current_time - last_time < int(
                     interpolate1(cfg.python.aws_auth.key_duration)
                 ):
-                    pipconf = _get_pipconf(cfg)
-                    config_parser = configparser.ConfigParser()
-                    config_parser.read(pipconf)
-                    info(f"Using existing index URL from {pipconf}.")
-
-                    if index_url := (
-                        config_parser["global"].get("index_url")
-                        or config_parser["global"].get("index-url")
-                    ):
-                        cfg.python.index_url = index_url
-                        _obfuscate_index_url(index_url)
-                    break
-                memo.items().remove(item)
-        else:
-            info("Updating Codeartifact token.")
-            from urllib.error import HTTPError
-            from urllib.parse import urljoin
-
-            opts = {
-                "client_secret": client_secret,
-                "static_oidc": static_oidc,
-            }
-            if cfg.python.aws_auth.client_id:
-                opts["client_id"] = interpolate1(cfg.python.aws_auth.client_id)
-            if cfg.python.aws_auth.role_arn:
-                opts["aws_role_arn"] = interpolate1(cfg.python.aws_auth.role_arn)
+                    info("Using cached CodeArtifact token.")
+                    _apply_resolved_index_urls(cfg, index_base_url)
+                    return
+                memo.clear()
 
-            try:
-                index_base_url = get_ca_pypi_url_programmatic(**opts)
-            except HTTPError as e:
-                die(f"Failed to establish CodeArtifact connection: {e}")
+        info("Updating Codeartifact token.")
 
-            index_url = urljoin(
-                index_base_url + "/", interpolate1(cfg.python.aws_auth.index)
-            )
-            cfg.python.index_url = index_url
-            _obfuscate_index_url(index_url)
+        opts = {}
+
+        if cfg.python.aws_auth.client_id:
+            opts["client_id"] = interpolate1(cfg.python.aws_auth.client_id)
+        if cfg.python.aws_auth.role_arn:
+            opts["aws_role_arn"] = interpolate1(cfg.python.aws_auth.role_arn)
+
+        try:
+            index_base_url = get_ca_pypi_url_programmatic(**opts)
+        except HTTPError as e:
+            die(f"Failed to establish CodeArtifact connection: {e}")
+
+        _apply_resolved_index_urls(cfg, index_base_url)
 
-            if exists(cfg.python.venv):
-                _configure_pipconf(cfg, update=True)
-            memo.add(f"{timestamp_key}:{current_time}")
+        if exists(cfg.python.venv):
+            _configure_pipconf(cfg, update=True)
+        memo.add((timestamp_key, current_time, index_base_url))

csspin_python/python_sbom.py

@@ -71,7 +71,9 @@ def sbom(cfg: ConfigTree) -> None:
             die(f"Project path '{project_path}' does not exist.")
 
         project_path = Path(project_path).absolute()
-        metadata = get_project_metadata(project_path, cfg.python.index_url)
+        metadata = get_project_metadata(
+            project_path, cfg.python.index_url, tuple(cfg.python.extra_index_urls)
+        )
         project_name, project_version = metadata.get("name"), metadata.get("version")
 
         file_name = _predict_wheel_filename(
@@ -138,6 +140,7 @@ def _ensure_cyclonedx_venv(cfg: ConfigTree, binary_dir: str, quiet: str | None)
         "install",
         "--index-url",
         cfg.python.index_url,
+        *[f"--extra-index-url={url}" for url in cfg.python.extra_index_urls],
         "cyclonedx-bom==" + requested_version,
         use_subprocess_environment=False,
     )
@@ -168,6 +171,7 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
                 "install",
                 "--index-url",
                 cfg.python.index_url,
+                *[f"--extra-index-url={url}" for url in cfg.python.extra_index_urls],
                 *[
                     f"--constraint={constraint}"
                     for constraint in cfg.python.constraints

csspin_python/python_schema.yaml

@@ -116,6 +116,13 @@ python:
                 The index url from where packages should get installed into the
                 venv. This value will also be put into cfg.python.pipconf, if
                 not already mentioned there.
+        extra_index_urls:
+            type: list
+            help: |
+                Additional package indexes to install from, alongside
+                'index_url'. If 'aws_auth.extra_indexes' is set, its
+                resolved, authenticated CodeArtifact URLs are merged into
+                this list.
         build_wheels:
             type: list
             help: |
@@ -141,22 +148,17 @@ python:
                         Time in seconds defining how long the plugin should
                         consider the authentication token as valid before
                         issuing a new one.
-                static_oidc:
-                    type: bool
-                    help: |
-                        Whether to static OIDC when authenticating with AWS
-                        CodeArtifact.
                 index:
                     type: str
-                    help: The CodeArtifact repository index (e.g. "16.0/simple").
+                    help: The CodeArtifact repository index (e.g. "2026.2/simple").
+                extra_indexes:
+                    type: list
+                    help: |
+                        Additional CodeArtifact repository indexes to
+                        authenticate against, alongside 'index'.
                 client_id:
                     type: str
                     help: The OIDC client ID to use.
-                client_secret:
-                    type: secret
-                    help: |
-                        The OIDC client secret to use, defaults to the
-                        environment variable 'CS_AWS_OIDC_CLIENT_SECRET'.
                 role_arn:
                     type: str
                     help: The role ARN to assume when authenticating.

csspin_python/uv_provisioner.py

@@ -161,16 +161,26 @@ class SimpleUvProvisioner(SimpleProvisioner):
         self._uv_cmd("pip", "install", "pip")
 
 
+def _set_extra_index_url(toml_content: dict, extra_index_urls: list[str]) -> None:
+    """Set or drop the 'extra-index-url' key in `toml_content` in place."""
+    if extra_index_urls:
+        toml_content["extra-index-url"] = extra_index_urls
+    else:
+        toml_content.pop("extra-index-url", None)
+
+
 def _configure_uv_toml(cfg: ConfigTree) -> None:
     """
     Create a config file for uv, similar to the pip.conf of
     csspin_python.python, since `uv` pip won't respect the pip.conf.
+
+    'index-url'/'extra-index-url' declared in the 'uv_provisioner.uv_toml'
+    template are ignored; 'python.index_url'/'python.extra_index_urls' are
+    the only supported way to configure these.
     """
     toml_content = tomllib.loads(cfg.uv_provisioner.uv_toml or "")
-    if "index-url" not in toml_content:
-        toml_content["index-url"] = cfg.python.index_url
-    else:
-        toml_content["index-url"] = toml_content.get("index-url", cfg.python.index_url)
+    toml_content["index-url"] = cfg.python.index_url
+    _set_extra_index_url(toml_content, cfg.python.extra_index_urls)
 
     with open(cfg.uv_provisioner.uv_toml_path, mode="wb") as fd:
         tomli_w.dump(toml_content, fd)
@@ -178,12 +188,20 @@ def _configure_uv_toml(cfg: ConfigTree) -> None:
 
 def _update_index_url_in_toml(cfg: ConfigTree) -> None:
     """
-    Update the index-url in the uv.toml in case it changed.
+    Update the index-url and extra-index-url in the uv.toml in case they
+    changed.
     """
     if (uv_toml_path := interpolate1(Path(cfg.uv_provisioner.uv_toml_path))).exists():
         with open(uv_toml_path, mode="rb") as fd:
             toml_content = tomllib.load(fd)
+        changed = False
         if toml_content.get("index-url") != cfg.python.index_url:
             toml_content["index-url"] = cfg.python.index_url
+            changed = True
+
+        if toml_content.get("extra-index-url", []) != cfg.python.extra_index_urls:
+            _set_extra_index_url(toml_content, cfg.python.extra_index_urls)
+            changed = True
+        if changed:
             with open(uv_toml_path, mode="wb") as fd:
                 tomli_w.dump(toml_content, fd)

{csspin_python-5.0.0.dist-info → csspin_python-6.0.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csspin-python
-Version: 5.0.0
+Version: 6.0.0
 Summary: Plugin-package for csspin providing Python related plugins
 Author-email: CONTACT Software GmbH <info@contact-software.com>
 Maintainer-email: Waleri Enns <waleri.enns@contact-software.com>, Benjamin Thomas Schwertfeger <benjaminthomas.schwertfeger@contact-software.com>, Fabian Hafer <fabian.hafer@contact-software.com>
@@ -27,7 +27,7 @@ License-File: LICENSE
 Requires-Dist: platformdirs~=4.3.8
 Requires-Dist: virtualenv
 Provides-Extra: aws-auth
-Requires-Dist: csaccess>=0.1.0; extra == "aws-auth"
+Requires-Dist: csaccess>=0.3.0; extra == "aws-auth"
 Provides-Extra: uv
 Requires-Dist: tomli; python_version < "3.11" and extra == "uv"
 Requires-Dist: tomli-w; extra == "uv"

{csspin_python-5.0.0.dist-info → csspin_python-6.0.0.dist-info}/RECORD

@@ -9,16 +9,16 @@ csspin_python/playwright.py,sha256=oFfphLqa4AB6K9vasCUFHN0kFXu63n3ocrsqVuRp4-0,5
 csspin_python/playwright_schema.yaml,sha256=TSeR16YHa7m7bfO59F2eMV-jXcglluTJdEpUeL16saY,1178
 csspin_python/pytest.py,sha256=vSLtmS-kNO0NPo_tszfEm5zGwJb6Yb5IGS-hA7CNguo,4544
 csspin_python/pytest_schema.yaml,sha256=tzXtdF6MvGC9v59EVRJFfLeMMHqPsXcFXy2zJtRECBI,1535
-csspin_python/python.py,sha256=SO5RkNdpZPcux7KnuDHVTaNIVQAmU9xjwTtJG4v97NE,40725
-csspin_python/python_sbom.py,sha256=FYx9DMDSeooB4lXuIisUsMwBMEj1Hl-QVl1AlDdTmZk,13381
+csspin_python/python.py,sha256=uoWCm_X2_yGaOdnxAb_h2Mr8RjLd5MjuVL4cPF15E2E,41973
+csspin_python/python_sbom.py,sha256=AT_dFEKoghZTVkkTECz0cOo-w3AZAYAgROx4prhAHKw,13603
 csspin_python/python_sbom_schema.yaml,sha256=QysysjGJ6n1WEoLBqYHcdbojuEomUvL8QG4ZSWQW2_8,739
-csspin_python/python_schema.yaml,sha256=pgVVjByUYjxQWek7aFmjQzRwmq2ROLvHYgwGPMrT9sM,6351
+csspin_python/python_schema.yaml,sha256=RwJgbyIRenj18-s60HmqkwWCGtd6G1acpJ9TDI9QjBQ,6448
 csspin_python/radon.py,sha256=uFqm6FEi5oWj-_XVaAm3s9cam0cUmr1_FwRf40K6xWs,1876
 csspin_python/radon_schema.yaml,sha256=rlRzXw5z4XbjOVznRiUxWGP4E9hx1Jm-gGw1iQiYzE0,548
-csspin_python/uv_provisioner.py,sha256=1e-_Sb39JrqNWyaUNeBX59R5tutXLJ1ZsT7urCN1U0I,6044
+csspin_python/uv_provisioner.py,sha256=2M1I8PqWTCUxqaOeJI5rchmly6t-MnOPQfIx-kKzdQU,6757
 csspin_python/uv_provisioner_schema.yaml,sha256=Y8ZNC2OMnhR8Us3WUXAXK9hMjqGWAKFJB2puX4X5XNQ,727
-csspin_python-5.0.0.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
-csspin_python-5.0.0.dist-info/METADATA,sha256=a4GiqeHydRsKdxlj_uH-B9bAfoCfbQBSowJJrnCMaJI,5254
-csspin_python-5.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-csspin_python-5.0.0.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
-csspin_python-5.0.0.dist-info/RECORD,,
+csspin_python-6.0.0.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
+csspin_python-6.0.0.dist-info/METADATA,sha256=a-NIDfoER1W6_3YNyaxS_RKPKLXmWp6tk-uApcS6Lr4,5254
+csspin_python-6.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+csspin_python-6.0.0.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
+csspin_python-6.0.0.dist-info/RECORD,,