csspin-python 6.0.0__py3-none-any.whl → 6.1.0__py3-none-any.whl

csspin_python/pytest.py

@@ -55,6 +55,8 @@ defaults = config(
 
 def _install_playwright_browsers(cfg: ConfigTree) -> None:
     """Let playwright install the browsers"""
+    if cfg.pytest.playwright.mirror:
+        setenv(PLAYWRIGHT_DOWNLOAD_HOST=cfg.pytest.playwright.mirror)
     sh(
         f"playwright install {' '.join(cfg.pytest.playwright.browsers)}",
         env={"PLAYWRIGHT_BROWSERS_PATH": cfg.pytest.playwright.browsers_path},

csspin_python/pytest_schema.yaml

@@ -28,7 +28,7 @@ pytest:
         playwright:
             type: object
             help: |
-                Settings necessary to also run playwright tests with the pytest
+                Settings necessary to also run Playwright tests with the pytest
                 plugin.
             properties:
                 enabled:
@@ -38,9 +38,15 @@ pytest:
                         initialized.
                 browsers_path:
                     type: path
-                    help: Path for playwright to install the browsers.
+                    help: Path for Playwright to install the browsers.
                 browsers:
                     type: list
                     help: |
                         The browsers to install and to use for running the
-                        playwright tests.
+                        Playwright tests.
+                mirror:
+                    type: str
+                    help: |
+                        Host to download the Playwright browsers from. The
+                        mirror has to hold the files for the Playwright version
+                        in use.

csspin_python/python.py

@@ -68,7 +68,9 @@ point to the base installation.
 
 import abc
 import configparser
+import contextlib
 import hashlib
+import inspect
 import json
 import logging
 import os
@@ -125,6 +127,9 @@ from csspin import (
 )
 from csspin.tree import ConfigTree
 
+# csspin's plugin development guide, for warnings pointing to its sections
+_PLUGIN_GUIDE_URL = "https://csspin.readthedocs.io/en/stable/howtoplugins.html"
+
 defaults = config(
     build_wheels=["{spin.project_root}"],
     pyenv=config(
@@ -256,6 +261,8 @@ def pyenv_install(cfg: ConfigTree) -> None:
                     sh("git", "pull")
             # we should set
             setenv(PYTHON_BUILD_CACHE_PATH=mkdir(cfg.python.pyenv.cache))
+            if cfg.python.pyenv.mirror:
+                setenv(PYTHON_BUILD_MIRROR_URL=cfg.python.pyenv.mirror)
             setenv(PYTHON_CFLAGS="-DOPENSSL_NO_COMP")
             try:
                 sh(
@@ -293,6 +300,8 @@ def nuget_install(cfg: ConfigTree) -> None:
         "-mpip",
         None if cfg.verbosity > Verbosity.NORMAL else "-q",
         "install",
+        f"--index-url={cfg.python.index_url}",
+        *[f"--extra-index-url={url}" for url in cfg.python.extra_index_urls],
         "-U",
         "pip",
         "wheel",
@@ -414,14 +423,13 @@ def configure(cfg: ConfigTree) -> None:
     if cfg.python.aws_auth.enabled:
         _check_aws_token_validity(cfg)
 
-    # Provide spin's subprocess environment (see python_env). Registered here
-    # rather than in init so it is also available to the provision and
-    # finalize_provision hooks of plugins depending on this one.
-    cfg.spin.subprocess_environment = lambda: python_env(cfg)
-
 
 def init(cfg: ConfigTree) -> None:
-    """Initialize the python plugin"""
+    """Initialize the python plugin and activate the virtual environment.
+
+    Runs before spin executes tasks, and during 'spin provision' as soon as the
+    virtual environment has been created (see venv_provision).
+    """
     if not cfg.python.use:
         logging.debug("Checking for %s", cfg.python.interpreter)
         if not exists(cfg.python.interpreter):
@@ -430,6 +438,36 @@ def init(cfg: ConfigTree) -> None:
                 " project. You might want to run spin with the 'provision'"
                 " task."
             )
+    activate(cfg)
+
+
+def activate(cfg: ConfigTree) -> None:
+    """Activate the virtual environment for the processes spin starts, like its
+    'activate' script does in a shell.
+
+    This only sets environment variables. It must never change spin's own
+    sys.path or sys.prefix (e.g. by executing 'activate_this.py'): plugin code
+    must not import from the project's virtual environment, which may use
+    another Python version (see "Outer and inner interpreter" in csspin's plugin
+    development guide).
+    """
+    venv = str(cfg.python.venv)
+    if os.environ.get("VIRTUAL_ENV") == venv:
+        return
+    if not exists(cfg.python.scriptdir):
+        die(
+            f"{cfg.python.venv} does not exist. You may want to provision"
+            " it using 'spin provision'"
+        )
+    if sys.platform == "win32":
+        echo(f"{cfg.python.scriptdir}\\activate.ps1")
+    else:
+        echo(f". {cfg.python.scriptdir}/activate")
+    os.environ["PATH"] = os.pathsep.join(
+        (str(cfg.python.scriptdir), os.environ.get("PATH", ""))
+    )
+    os.environ["VIRTUAL_ENV"] = venv
+    os.environ.pop("PYTHONHOME", None)
 
 
 def venv_init(cfg: ConfigTree) -> None:
@@ -450,25 +488,46 @@ def venv_init(cfg: ConfigTree) -> None:
         )
 
 
+def _caller_location() -> str:
+    """Return 'file:line' of the innermost caller outside this module and
+    contextlib, i.e. the plugin code using one of our functions."""
+    skip = {os.path.normcase(__file__), os.path.normcase(contextlib.__file__)}
+    frame = inspect.currentframe()
+    try:
+        while frame is not None:
+            filename = frame.f_code.co_filename
+            if os.path.normcase(filename) not in skip:
+                return f"{filename}:{frame.f_lineno}"
+            frame = frame.f_back
+        return "<unknown>"
+    finally:
+        del frame
+
+
 @contextmanager
 def python_env(cfg: ConfigTree) -> Generator:
     """
-    Context manager to activate the subprocess/python virtual environment and
-    deactivate it once done.
-
-    Registered as ``spin.subprocess_environment`` by the plugin's
-    :py:func:`configure` hook, so ``csspin.sh`` activates the virtual environment
-    around the commands it spawns. Activation is conditional: while the virtual
-    environment has not been created yet (e.g. early during ``spin provision``)
-    this is a no-op and the command runs in spin's in-process environment; once
-    the venv exists it is activated. Saving and restoring
-    ``os.environ``, ``sys.path`` and the ``sys`` prefix attributes makes nesting
-    safe -- an explicit ``with python_env(cfg):`` block whose inner ``csspin.sh``
-    re-enters this context.
-
-    See the "The subprocess environment" section of csspin's plugin development
-    guide for the general concept.
+    Context manager activating the virtual environment *in spin's process*,
+    including its sys.path, and deactivating it once done.
+
+    .. deprecated::
+       Plugin code must not import from the project's virtual environment,
+       which may use another Python version than spin (see "Outer and inner
+       interpreter" in csspin's plugin development guide). The virtual
+       environment is activated for the processes spin starts by
+       :py:func:`activate` already. Make modules a plugin imports dependencies
+       of its plugin package, or run the tools from the virtual environment as
+       subprocesses. This function will be removed in a future release.
+
+    Saving and restoring ``os.environ``, ``sys.path`` and the ``sys`` prefix
+    attributes makes nesting safe.
     """
+    warn(
+        f"{_caller_location()} uses csspin_python.python.python_env(), which is"
+        " deprecated and will be removed: plugin code must not import from the"
+        " project's virtual environment."
+        f" See {_PLUGIN_GUIDE_URL}#outer-and-inner-interpreter."
+    )
     if not exists(cfg.python.scriptdir / "activate_this.py"):
         # The virtual environment has not been provisioned (yet); run the command
         # in spin's in-process environment instead of activating.
@@ -891,12 +950,17 @@ class ProvisionerProtocol:
         ]
         virtualenv = Command(*cmd)
         # do not download seeds, since we update pip later anyway
-        # add the plugins directory to the PYTHONPATH so that virtualenv will be found
+        # add the plugin packages to the PYTHONPATH so that virtualenv will be
+        # found; csspin versions without spin.plugin_site_packages install
+        # them into the plugins directory itself
+        plugin_site_packages = cfg.spin.get("plugin_site_packages") or (
+            cfg.spin.spin_dir / "plugins"
+        )
         virtualenv(
             "-p",
             cfg.python.interpreter,
             cfg.python.venv,
-            env={"PYTHONPATH": cfg.spin.spin_dir / "plugins"},
+            env={"PYTHONPATH": plugin_site_packages},
         )
 
     def prerequisites(self: Self, cfg: ConfigTree) -> None:

csspin_python/python_sbom.py

@@ -42,12 +42,14 @@ from csspin import (
 from csspin.tree import ConfigTree
 from packaging.requirements import Requirement
 from packaging.utils import canonicalize_name
+from packaging.version import Version
 from path import Path
 
 defaults = config(
-    cyclonedx_bom_version="7.3.0",
+    cyclonedx_bom_version="7.5.0",
     project_paths=["{spin.project_root}"],
     repository_url="{python.index_url}",
+    spec_version="1.7",
     requires=config(spin=["csspin_python.python"], python=["setuptools"]),
 )
 
@@ -90,6 +92,7 @@ def sbom(cfg: ConfigTree) -> None:
             cfg.python_sbom.repository_url,
             file_name,
         )
+        _mark_components_external(sbom_json)
         _write_sbom(cfg, sbom_json, project_name)
 
 
@@ -130,7 +133,7 @@ def _ensure_cyclonedx_venv(cfg: ConfigTree, binary_dir: str, quiet: str | None)
         )
         rmtree(venv_cdx)
 
-    sh(cfg.python.interpreter, "-m", "venv", venv_cdx, use_subprocess_environment=False)
+    sh(cfg.python.interpreter, "-m", "venv", venv_cdx)
     sh(
         interpreter_cdx,
         "-m",
@@ -142,7 +145,6 @@ def _ensure_cyclonedx_venv(cfg: ConfigTree, binary_dir: str, quiet: str | None)
         cfg.python.index_url,
         *[f"--extra-index-url={url}" for url in cfg.python.extra_index_urls],
         "cyclonedx-bom==" + requested_version,
-        use_subprocess_environment=False,
     )
     with memoizer(memo_file) as memo:
         memo.add(memo_key)
@@ -161,7 +163,23 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
     with TemporaryDirectory() as tmp_dir:
         venv = Path(tmp_dir) / "venv"
         interpreter = venv / binary_dir / "python" + cfg.platform.exe
-        sh(cfg.python.interpreter, "-m", "venv", venv, use_subprocess_environment=False)
+        # Run --upgrade-deps and set PIP_CONSTRAINT to force pip and setuptools
+        # to have the version from the constraint files, if they are present.
+        # Necessary as python3.11 still has setuptools in the env created by
+        # venv. PIP_INDEX_URL and PIP_EXTRA_INDEX_URL point the upgrade at the
+        # configured indexes, because venv has no index option.
+        sh(
+            cfg.python.interpreter,
+            "-m",
+            "venv",
+            "--upgrade-deps",
+            venv,
+            env={
+                "PIP_CONSTRAINT": " ".join(cfg.python.constraints),
+                "PIP_INDEX_URL": cfg.python.index_url,
+                "PIP_EXTRA_INDEX_URL": " ".join(cfg.python.extra_index_urls),
+            },
+        )
         if third_party_deps:
             sh(
                 interpreter,
@@ -177,7 +195,6 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
                     for constraint in cfg.python.constraints
                 ],
                 *third_party_deps,
-                use_subprocess_environment=False,
                 stderr=stderr,
             )
         sh(
@@ -188,15 +205,15 @@ def _run_cyclonedx(cfg: ConfigTree, third_party_deps: set[str], stderr: int) ->
             "uninstall",
             "-y",
             "pip",
-            use_subprocess_environment=False,
         )
         return backtick(  # type: ignore[no-any-return]
             interpreter_cdx,
             "-m",
             "cyclonedx_py",
             "environment",
+            "--spec-version",
+            cfg.python_sbom.spec_version,
             venv,
-            use_subprocess_environment=False,
             stderr=stderr,
         )
 
@@ -364,6 +381,16 @@ def _enrich_sbom(
     sbom_json["dependencies"] = dependencies
 
 
+def _mark_components_external(sbom_json: dict) -> None:
+    """
+    Flag the third-party components as external, for CycloneDX 1.7 and newer.
+    """
+    if Version(sbom_json["specVersion"]) < Version("1.7"):
+        return
+    for component in sbom_json.get("components", []):
+        component["isExternal"] = True
+
+
 def _collect_thirdparty_deps(requires_dist: list, python_version: str) -> set[str]:
     """Extract 'thirdparty' dependency specifiers from project metadata."""
 

csspin_python/python_sbom_schema.yaml

@@ -21,3 +21,6 @@ python_sbom:
             help: |
                 URL of the package index used for the primary component's
                 Package URL. Defaults to 'python.index_url'.
+        spec_version:
+            type: str
+            help: CycloneDX specification version of the generated SBOM.

csspin_python/python_schema.yaml

@@ -19,6 +19,12 @@ python:
                 cache:
                     type: path
                     help: Path to cache the Python sources downloaded by pyenv
+                mirror:
+                    type: str
+                    help: |
+                        Base URL of a mirror for the Python sources downloaded
+                        by pyenv. Ignored on Windows and when 'python.use' or
+                        'python.user_pyenv' is set.
                 python_build:
                     type: path
                     help: Path to the python-build builtin plugin of pyenv
@@ -114,8 +120,9 @@ python:
             type: str
             help: |
                 The index url from where packages should get installed into the
-                venv. This value will also be put into cfg.python.pipconf, if
-                not already mentioned there.
+                project's subprocess environment (i.e., 'python.venv'). This
+                value will also be put into 'python.pipconf', if not already
+                mentioned there.
         extra_index_urls:
             type: list
             help: |

csspin_python/uv_provisioner.py

@@ -145,6 +145,11 @@ class SimpleUvProvisioner(SimpleProvisioner):
             cfg.python.version,
             "--no-bin",
             "--no-registry",
+            (
+                f"--mirror={cfg.uv_provisioner.python_mirror}"
+                if cfg.uv_provisioner.python_mirror
+                else None
+            ),
         )
         cfg.python.interpreter = _get_uv_python(cfg)
         info(f"Using '{cfg.python.interpreter}' as interpreter")
@@ -158,7 +163,10 @@ class SimpleUvProvisioner(SimpleProvisioner):
         )
 
     def prerequisites(self, cfg: ConfigTree) -> None:
-        self._uv_cmd("pip", "install", "pip")
+        # venv_provision runs the venv_hook only after the prerequisites, but
+        # installing pip already needs the uv.toml.
+        _configure_uv_toml(cfg)
+        self._install_command(f"--config-file={cfg.uv_provisioner.uv_toml_path}", "pip")
 
 
 def _set_extra_index_url(toml_content: dict, extra_index_urls: list[str]) -> None:

csspin_python/uv_provisioner_schema.yaml

@@ -22,3 +22,10 @@ uv_provisioner:
         uv_toml:
             type: str
             help: Content for uv's config file
+        python_mirror:
+            type: str
+            help: |
+                Passed to 'uv python install' as '--mirror' when uv provisions
+                the Python interpreter. The mirror has to hold the files for
+                the uv version in use. Ignored when 'python.use' is set.
+            default: ''

{csspin_python-6.0.0.dist-info → csspin_python-6.1.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csspin-python
-Version: 6.0.0
+Version: 6.1.0
 Summary: Plugin-package for csspin providing Python related plugins
 Author-email: CONTACT Software GmbH <info@contact-software.com>
 Maintainer-email: Waleri Enns <waleri.enns@contact-software.com>, Benjamin Thomas Schwertfeger <benjaminthomas.schwertfeger@contact-software.com>, Fabian Hafer <fabian.hafer@contact-software.com>

csspin_python-6.1.0.dist-info/RECORD

@@ -0,0 +1,24 @@
+csspin_python/_predict_wheel_filename.py,sha256=sz09QpDOPQesG-QAANjH607QSkS3PFo0qxPifG1y85o,2399
+csspin_python/behave.py,sha256=iJZeyIqB7V_NzTdLTZldNY9W_GGwCWkXe6WY69wpDqs,4997
+csspin_python/behave_schema.yaml,sha256=8qoOCK-uTmwgRRW29urgK0X_kgn0zO0X34v89bvii2w,1241
+csspin_python/debugpy.py,sha256=v0ZZopv5TNoSaFf2kiePsw9OmhBpjfOBFh0u71jTcnQ,962
+csspin_python/debugpy_schema.yaml,sha256=BeH30nSirDYctkdhS9xMXUG5htj3PED_ZjmxPG5WRUc,364
+csspin_python/devpi.py,sha256=o7O06Dw-xt47y-M74TShcl9MUMaW78aFmw6i6ISYwoU,2351
+csspin_python/devpi_schema.yaml,sha256=2gPATWjVcfvCTrGZX2FK6wH8hh9KS0XzZ35JvZeJGEU,487
+csspin_python/playwright.py,sha256=oFfphLqa4AB6K9vasCUFHN0kFXu63n3ocrsqVuRp4-0,5102
+csspin_python/playwright_schema.yaml,sha256=TSeR16YHa7m7bfO59F2eMV-jXcglluTJdEpUeL16saY,1178
+csspin_python/pytest.py,sha256=wnQLHz5kmZKwv0acPt3d3gx91xVxI2qHCOOivl1Oq-Y,4651
+csspin_python/pytest_schema.yaml,sha256=YsJ_O6wjaZARhfx0AU-Ska55qNpfkHtShrKUxgh3UiI,1804
+csspin_python/python.py,sha256=XDl2c5dyu0IU8qAoRAvBRVPFMgb6RVjnuGCyTpJlf5E,44456
+csspin_python/python_sbom.py,sha256=_DyH3dd9jdBxdP74RFb2L5hNPjNLWnRvFlotL4DFUqA,14550
+csspin_python/python_sbom_schema.yaml,sha256=kxz5TJdUmUkDwG6ZD9ORi7xj-yF_BjeMhjmsj6labgM,856
+csspin_python/python_schema.yaml,sha256=jAo2pX5ZqyUol-rn0x4ctIJAVU-Ni1jnn44TJmZVe_0,6803
+csspin_python/radon.py,sha256=uFqm6FEi5oWj-_XVaAm3s9cam0cUmr1_FwRf40K6xWs,1876
+csspin_python/radon_schema.yaml,sha256=rlRzXw5z4XbjOVznRiUxWGP4E9hx1Jm-gGw1iQiYzE0,548
+csspin_python/uv_provisioner.py,sha256=jMdhoJDnpxALXliHNIDdrYFXOxlLJY1YMsssJlVhR_0,7132
+csspin_python/uv_provisioner_schema.yaml,sha256=uvrkC1Ct4NDMzGSpwC2fmX_6MvoQtk59hIeRtAmcsKg,1045
+csspin_python-6.1.0.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
+csspin_python-6.1.0.dist-info/METADATA,sha256=JweD4VDTWLzmH4iHtr2WwSmQvvYoqPF9b_raU1K1_60,5254
+csspin_python-6.1.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+csspin_python-6.1.0.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
+csspin_python-6.1.0.dist-info/RECORD,,

{csspin_python-6.0.0.dist-info → csspin_python-6.1.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (84.0.0)
+Generator: setuptools (84.2.1)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

csspin_python-6.0.0.dist-info/RECORD

@@ -1,24 +0,0 @@
-csspin_python/_predict_wheel_filename.py,sha256=sz09QpDOPQesG-QAANjH607QSkS3PFo0qxPifG1y85o,2399
-csspin_python/behave.py,sha256=iJZeyIqB7V_NzTdLTZldNY9W_GGwCWkXe6WY69wpDqs,4997
-csspin_python/behave_schema.yaml,sha256=8qoOCK-uTmwgRRW29urgK0X_kgn0zO0X34v89bvii2w,1241
-csspin_python/debugpy.py,sha256=v0ZZopv5TNoSaFf2kiePsw9OmhBpjfOBFh0u71jTcnQ,962
-csspin_python/debugpy_schema.yaml,sha256=BeH30nSirDYctkdhS9xMXUG5htj3PED_ZjmxPG5WRUc,364
-csspin_python/devpi.py,sha256=o7O06Dw-xt47y-M74TShcl9MUMaW78aFmw6i6ISYwoU,2351
-csspin_python/devpi_schema.yaml,sha256=2gPATWjVcfvCTrGZX2FK6wH8hh9KS0XzZ35JvZeJGEU,487
-csspin_python/playwright.py,sha256=oFfphLqa4AB6K9vasCUFHN0kFXu63n3ocrsqVuRp4-0,5102
-csspin_python/playwright_schema.yaml,sha256=TSeR16YHa7m7bfO59F2eMV-jXcglluTJdEpUeL16saY,1178
-csspin_python/pytest.py,sha256=vSLtmS-kNO0NPo_tszfEm5zGwJb6Yb5IGS-hA7CNguo,4544
-csspin_python/pytest_schema.yaml,sha256=tzXtdF6MvGC9v59EVRJFfLeMMHqPsXcFXy2zJtRECBI,1535
-csspin_python/python.py,sha256=uoWCm_X2_yGaOdnxAb_h2Mr8RjLd5MjuVL4cPF15E2E,41973
-csspin_python/python_sbom.py,sha256=AT_dFEKoghZTVkkTECz0cOo-w3AZAYAgROx4prhAHKw,13603
-csspin_python/python_sbom_schema.yaml,sha256=QysysjGJ6n1WEoLBqYHcdbojuEomUvL8QG4ZSWQW2_8,739
-csspin_python/python_schema.yaml,sha256=RwJgbyIRenj18-s60HmqkwWCGtd6G1acpJ9TDI9QjBQ,6448
-csspin_python/radon.py,sha256=uFqm6FEi5oWj-_XVaAm3s9cam0cUmr1_FwRf40K6xWs,1876
-csspin_python/radon_schema.yaml,sha256=rlRzXw5z4XbjOVznRiUxWGP4E9hx1Jm-gGw1iQiYzE0,548
-csspin_python/uv_provisioner.py,sha256=2M1I8PqWTCUxqaOeJI5rchmly6t-MnOPQfIx-kKzdQU,6757
-csspin_python/uv_provisioner_schema.yaml,sha256=Y8ZNC2OMnhR8Us3WUXAXK9hMjqGWAKFJB2puX4X5XNQ,727
-csspin_python-6.0.0.dist-info/licenses/LICENSE,sha256=4MAecetnRTQw5DlHtiikDSzKWO1xVLwzM5_DsPMYlnE,10172
-csspin_python-6.0.0.dist-info/METADATA,sha256=a-NIDfoER1W6_3YNyaxS_RKPKLXmWp6tk-uApcS6Lr4,5254
-csspin_python-6.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-csspin_python-6.0.0.dist-info/top_level.txt,sha256=QSeglMEGbFu1z4L6MCQYwo01NgL0KojWvC4rzgMQ8gU,14
-csspin_python-6.0.0.dist-info/RECORD,,