git-getpkg 0.1.0__py3-none-any.whl

git_getpkg/source.py

@@ -0,0 +1,161 @@
+from __future__ import annotations
+
+import contextlib
+import os
+import re
+import shutil
+import tempfile
+from pathlib import Path
+from urllib.parse import urlparse
+
+from git_getpkg.command import CommandError, run
+from git_getpkg.models import SourceInfo
+
+MAX_REMOTE_CHECKOUT_BYTES = 512 * 1024 * 1024
+
+
+def _remote_parts(value: str) -> tuple[str | None, str | None, str | None, str | None]:
+    """Return repository name, namespace, repository URL, and namespace URL when derivable."""
+    normalized = value
+    if re.match(r"^[^/@:]+@[^:]+:.+", value):
+        user_host, path = value.split(":", 1)
+        host = user_host.split("@", 1)[1]
+        normalized = f"https://{host}/{path}"
+    parsed = urlparse(normalized)
+    path = parsed.path.strip("/")
+    parts = path.removesuffix(".git").split("/") if path else []
+    if not parts:
+        return None, None, value, None
+    repo = parts[-1]
+    namespace = "/".join(parts[:-1]) or None
+    base = f"{parsed.scheme}://{parsed.netloc}" if parsed.scheme and parsed.netloc else None
+    repo_url = f"{base}/{'/'.join(parts)}" if base else value
+    namespace_url = f"{base}/{namespace}" if base and namespace else None
+    return repo, namespace, repo_url, namespace_url
+
+
+def _git_metadata(root: Path) -> tuple[str | None, str | None]:
+    commit = run(["git", "-C", str(root), "rev-parse", "HEAD"], check=False)
+    branch = run(["git", "-C", str(root), "branch", "--show-current"], check=False)
+    return (
+        commit.stdout.strip() if commit.returncode == 0 else None,
+        branch.stdout.strip() if branch.returncode == 0 else None,
+    )
+
+
+def _default_branch(url: str) -> str:
+    result = run(["git", "-c", "protocol.ext.allow=never", "ls-remote", "--symref", url, "HEAD"], timeout=45)
+    for line in result.stdout.splitlines():
+        if line.startswith("ref:") and line.endswith("\tHEAD"):
+            ref = line.split()[1]
+            return ref.removeprefix("refs/heads/")
+    raise CommandError("Could not determine the remote repository's default branch.")
+
+
+def _validate_remote_url(value: str) -> None:
+    if re.match(r"^[^/@:\\s]+@[^:\\s]+:.+", value):
+        return  # Standard Git SSH shorthand: git@example.com:team/repository.git
+    parsed = urlparse(value)
+    if parsed.scheme not in {"https", "ssh", "file"}:
+        raise ValueError("Remote source must use https://, ssh://, file://, or standard SSH Git syntax.")
+
+
+def _is_github_remote(value: str) -> bool:
+    if re.match(r"^[^/@:\s]+@github\.com:[^\s]+", value):
+        return True
+    return urlparse(value).hostname == "github.com"
+
+
+def _github_access_guidance(value: str, error: CommandError) -> CommandError:
+    """Add an actionable, opt-in recovery path for private GitHub repositories."""
+    authentication_markers = (
+        "authentication",
+        "authorization",
+        "permission denied",
+        "repository not found",
+        "could not read username",
+        "http 401",
+        "http 403",
+        "sso",
+    )
+    if not _is_github_remote(value) or not any(marker in str(error).lower() for marker in authentication_markers):
+        return error
+    if not shutil.which("gh"):
+        message = (
+            f"{error}\n\n"
+            "GitHub authentication may be required to access this repository. "
+            "GitHub CLI (`gh`) was not found. Install it, run `gh auth login`, then try again."
+        )
+    else:
+        message = (
+            f"{error}\n\n"
+            "GitHub authentication may be required to access this repository. "
+            "Run `gh auth login` and then `gh auth setup-git`, then try again."
+        )
+    return CommandError(message)
+
+
+def _directory_size(root: Path) -> int:
+    size = 0
+    for directory, _, filenames in os.walk(root, followlinks=False):
+        for filename in filenames:
+            path = Path(directory, filename)
+            try:
+                size += path.lstat().st_size
+            except OSError:
+                continue
+    return size
+
+
+@contextlib.contextmanager
+def open_source(value: str, *, clone_timeout: float = 300):
+    path = Path(value).expanduser()
+    if path.exists():
+        root = path.resolve()
+        if not root.is_dir():
+            raise ValueError(f"Local source is not a directory: {root}")
+        commit, branch = _git_metadata(root)
+        yield SourceInfo(value, root, False, commit, branch, None, root.name, None, None)
+        return
+
+    temp_root = Path(tempfile.mkdtemp(prefix="git-getpkg-"))
+    try:
+        _validate_remote_url(value)
+        try:
+            branch = _default_branch(value)
+        except CommandError as error:
+            raise _github_access_guidance(value, error) from error
+        checkout = temp_root / "source"
+        try:
+            run(
+                [
+                    "git",
+                    "-c",
+                    "protocol.ext.allow=never",
+                    "clone",
+                    "--depth",
+                    "1",
+                    "--single-branch",
+                    "--branch",
+                    branch,
+                    value,
+                    str(checkout),
+                ],
+                timeout=clone_timeout,
+            )
+        except CommandError as error:
+            raise _github_access_guidance(value, error) from error
+        size = _directory_size(checkout)
+        if size > MAX_REMOTE_CHECKOUT_BYTES:
+            remote_mib = size / 1024 / 1024
+            max_mib = MAX_REMOTE_CHECKOUT_BYTES / 1024 / 1024
+            raise ValueError(
+                f"Remote checkout is {remote_mib:.0f} MiB, above the {max_mib:.0f} MiB safety limit."
+            )
+        commit, _ = _git_metadata(checkout)
+        repo, namespace, repo_url, namespace_url = _remote_parts(value)
+        yield SourceInfo(
+            value, checkout, True, commit, branch, repo_url, repo or checkout.name, namespace, namespace_url
+        )
+    finally:
+        shutil.rmtree(temp_root, ignore_errors=True)

git_getpkg/trust.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+
+from git_getpkg.command import run
+from git_getpkg.models import Package, PackageReport, SourceInfo
+
+
+def _last_touched(source: SourceInfo, package: Package) -> tuple[str | None, str | None, str | None]:
+    if not source.commit:
+        return None, None, None
+    result = run(
+        ["git", "-C", str(source.root), "log", "-1", "--format=%cn%x00%cI%x00%an", "--", package.relative_path],
+        check=False,
+    )
+    if result.returncode or not result.stdout.strip():
+        return None, None, None
+    committer, date, author = result.stdout.rstrip("\n").split("\x00", 2)
+    return committer, date, author
+
+
+def source_signals(source: SourceInfo) -> list[str]:
+    findings: list[str] = []
+    if source.commit:
+        findings.append(f"Pinned to commit {source.commit[:12]}")
+        signature = run(["git", "-C", str(source.root), "verify-commit", source.commit], check=False)
+        findings.append(
+            "Commit signature verified locally"
+            if signature.returncode == 0
+            else "Commit signature not verified locally"
+        )
+    else:
+        findings.append("No Git commit could be resolved")
+    return findings
+
+
+def assess(
+    source: SourceInfo,
+    package: Package,
+    repository_signals: list[str] | None = None,
+    base_signals: list[str] | None = None,
+) -> PackageReport:
+    findings: list[str] = []
+    committer, date, author = _last_touched(source, package)
+    findings.extend(base_signals if base_signals is not None else source_signals(source))
+    if package.install_warning:
+        findings.append(package.install_warning)
+    findings.extend(package.metadata_signals)
+    display_committer = committer
+    if committer and committer.casefold() == "github" and author and author != committer:
+        display_committer = f"{author} via GitHub"
+        findings.append("Committed by GitHub")
+    elif author and author != committer:
+        findings.append(f"Authored by {author}")
+    if date:
+        try:
+            touched = datetime.fromisoformat(date.replace("Z", "+00:00"))
+            if touched < datetime.now(timezone.utc) - timedelta(days=730):
+                findings.append("Package has not changed in over two years")
+        except ValueError:
+            pass
+    if not package.installable:
+        findings.append("Installation is not supported in v1")
+    if (source.root / "SECURITY.md").is_file():
+        findings.append("Security policy present")
+    if (source.root / ".gitmodules").is_file():
+        findings.append("Submodules detected (not initialized)")
+    findings.extend(repository_signals or [])
+    return PackageReport(package=package, last_touched_by=display_committer, last_touched_at=date, signals=findings)

git_getpkg-0.1.0.dist-info/METADATA

@@ -0,0 +1,78 @@
+Metadata-Version: 2.4
+Name: git-getpkg
+Version: 0.1.0
+Summary: Discover and easily install packages from Git repositories
+Author: mergefriends
+License: MIT License
+        
+        Copyright (c) 2026 mergefriends
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: bandit[toml]>=1.8
+Requires-Dist: pip-audit>=2.10
+Requires-Dist: rich<14,>=13.5.2
+Requires-Dist: tomli>=2.0; python_version < "3.11"
+Dynamic: license-file
+
+# git-getpkg
+
+`git getpkg` discovers packages in a local directory or Git repository,
+then installs selected Python packages into isolated managed environments.
+
+## Install
+
+```bash
+brew install pipx && pipx ensurepath && pipx install git+https://github.com/mergefriends/git-getpkg.git
+```
+
+## Usage
+Find all packages in a repo
+```bash
+git getpkg list https://github.com/psf/black
+```
+Find all packages in an organization
+```bash
+git getpkg list https://github.com/psf
+```
+Install all packages in a repo
+```bash
+git getpkg https://github.com/psf/black
+```
+Install a single package from a repo
+```bash
+git getpkg https://github.com/psf/black black
+```
+
+## Development
+
+```bash
+python3 -m unittest discover -s tests -v
+PYTHONPATH=src python3 -m git_getpkg list .
+```

git_getpkg-0.1.0.dist-info/RECORD

@@ -0,0 +1,17 @@
+git_getpkg/__init__.py,sha256=ugvHV1fz-7Qrp2UA8RYzzYOMhTz57RLs58vtv2VdBUE,53
+git_getpkg/__main__.py,sha256=y0M2kGtoQvnELnQhRP2POE_CzWedD-Bdhltsi-qQ92g,58
+git_getpkg/cli.py,sha256=qqeH0tX2l8Y-skvX1yjnNM2vVBbdlMstNuDAcOPDweE,21171
+git_getpkg/command.py,sha256=vFTVJeUaJHNhQwKf5lzYM9sCrNAnSTrbO6sCbx623fk,745
+git_getpkg/discovery.py,sha256=A0hQbbkIwl5irJPPO7N4URzhN-r5gr_08v24mphWToU,8272
+git_getpkg/github.py,sha256=CVY6BUDwf-ZbHPrwmekBgBHnZci7XMMeBRO5lr0F_OU,4778
+git_getpkg/installer.py,sha256=eQVIM94NPYE152hVR7KxW74r5DNxT6kufdi7Oyj0JNA,6408
+git_getpkg/models.py,sha256=pWs5TA9gbV_b8phjI9WeN-CkESU_xg_Qm3EE5SByabU,1489
+git_getpkg/security.py,sha256=I8TdAX5fZPoxzMsWVk8Z9_JgL10-ZzTPIgKPPBwPqw8,2768
+git_getpkg/source.py,sha256=oEg6FzjIwzlTfsU7U4PVKQ41P9C9e4r-PjNUqT9UXBI,5954
+git_getpkg/trust.py,sha256=ADmP5lFCJ0xLBYrEmLWs-wIrkM23L-iV6Jf8xsGOwAc,2805
+git_getpkg-0.1.0.dist-info/licenses/LICENSE,sha256=1HxqertAHH8VOGBgy9w8W1e7pXD7X6JctF9-gPVF5B4,1069
+git_getpkg-0.1.0.dist-info/METADATA,sha256=vUzz-NUxM84hA-eSn3tgnx66LGO_7Jckyp4ZKcA6790,2742
+git_getpkg-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+git_getpkg-0.1.0.dist-info/entry_points.txt,sha256=kEA6sj9v6wWo19hNYUT91R95cqPp6hweB7JeCCF0EfE,51
+git_getpkg-0.1.0.dist-info/top_level.txt,sha256=3dRJiig2HahCLTV9QopqFSQ0sRWpsrbYFMbMV95bhdw,11
+git_getpkg-0.1.0.dist-info/RECORD,,

git_getpkg-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

git_getpkg-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+git-getpkg = git_getpkg.cli:main

git_getpkg-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mergefriends
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

git_getpkg-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+git_getpkg