trustcheck 2.2.1__tar.gz → 2.2.2__tar.gz

{trustcheck-2.2.1/src/trustcheck.egg-info → trustcheck-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.2.1
+Version: 2.2.2
 Summary: Package trust and provenance verification for PyPI consumers.
 License-Expression: LicenseRef-Trustcheck-Personal-Use
 Project-URL: Repository, https://github.com/Halfblood-Prince/trustcheck

{trustcheck-2.2.1 → trustcheck-2.2.2}/scripts/export_homebrew_tap.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import argparse
+import http.client
 import json
 import re
 import shutil
@@ -10,8 +11,6 @@ from dataclasses import asdict, dataclass
 from pathlib import Path
 from urllib.parse import quote
 
-import urllib3
-
 PACKAGE_LINE = re.compile(
     r"^(?P<name>[A-Za-z0-9_.-]+)==(?P<version>[^\\\s;]+)(?:\s*;[^\\]+)?(?:\s*\\)?$"
 )
@@ -103,33 +102,39 @@ def parse_checksums(path: Path) -> dict[str, str]:
 def read_pypi_json(project: str, version: str) -> Mapping[str, object]:
     encoded_project = quote(project, safe="")
     encoded_version = quote(version, safe="")
-    url = f"https://pypi.org/pypi/{encoded_project}/{encoded_version}/json"
-    pool = urllib3.PoolManager()
+    path = f"/pypi/{encoded_project}/{encoded_version}/json"
     last_error: Exception | None = None
     for attempt in range(1, 7):
+        connection: http.client.HTTPSConnection | None = None
         try:
-            response = pool.request(
+            # PyPI host is fixed, and Python 3.12+ verifies TLS certificates by default.
+            # nosemgrep
+            connection = http.client.HTTPSConnection("pypi.org", timeout=30)
+            connection.request(
                 "GET",
-                url,
+                path,
                 headers={
                     "Accept": "application/json",
                     "User-Agent": "trustcheck-homebrew-tap-exporter",
                 },
-                retries=False,
-                timeout=urllib3.Timeout(total=30),
             )
+            response = connection.getresponse()
+            response_data = response.read()
             if response.status >= 400:
                 raise ValueError(
                     f"{project}=={version}: PyPI returned HTTP {response.status}"
                 )
-            payload = json.loads(response.data)
+            payload = json.loads(response_data.decode("utf-8"))
             if not isinstance(payload, dict):
                 raise ValueError(f"{project}=={version}: PyPI returned non-object JSON")
             return payload
-        except (urllib3.exceptions.HTTPError, ValueError) as exc:
+        except (OSError, http.client.HTTPException, ValueError) as exc:
             last_error = exc
             if attempt < 6:
                 time.sleep(10)
+        finally:
+            if connection is not None:
+                connection.close()
     raise ValueError(f"Unable to read PyPI metadata for {project}=={version}") from last_error
 
 

{trustcheck-2.2.1 → trustcheck-2.2.2}/src/trustcheck/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = 'v2.2.1'
-__version_tuple__ = version_tuple = (2, 2, 1)
+__version__ = version = 'v2.2.2'
+__version_tuple__ = version_tuple = (2, 2, 2)
 
 __commit_id__ = commit_id = None

{trustcheck-2.2.1 → trustcheck-2.2.2/src/trustcheck.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.2.1
+Version: 2.2.2
 Summary: Package trust and provenance verification for PyPI consumers.
 License-Expression: LicenseRef-Trustcheck-Personal-Use
 Project-URL: Repository, https://github.com/Halfblood-Prince/trustcheck

{trustcheck-2.2.1 → trustcheck-2.2.2}/tests/test_homebrew_tap_export.py

@@ -5,6 +5,7 @@ import tempfile
 import unittest
 from collections.abc import Mapping
 from pathlib import Path
+from unittest.mock import patch
 
 from scripts import export_homebrew_tap
 
@@ -34,6 +35,55 @@ def _pypi_payload(name: str, version: str, sha256: str) -> dict[str, object]:
 
 
 class HomebrewTapExportTests(unittest.TestCase):
+    def test_read_pypi_json_uses_stdlib_https_connection(self) -> None:
+        class FakeResponse:
+            status = 200
+
+            def read(self) -> bytes:
+                return json.dumps({"urls": []}).encode("utf-8")
+
+        class FakeConnection:
+            instances: list[FakeConnection] = []
+
+            def __init__(self, host: str, *, timeout: int) -> None:
+                self.host = host
+                self.timeout = timeout
+                self.request_args: tuple[str, str] | None = None
+                self.request_headers: dict[str, str] | None = None
+                self.closed = False
+                self.instances.append(self)
+
+            def request(
+                self,
+                method: str,
+                path: str,
+                *,
+                headers: dict[str, str],
+            ) -> None:
+                self.request_args = (method, path)
+                self.request_headers = headers
+
+            def getresponse(self) -> FakeResponse:
+                return FakeResponse()
+
+            def close(self) -> None:
+                self.closed = True
+
+        with patch.object(
+            export_homebrew_tap.http.client,
+            "HTTPSConnection",
+            FakeConnection,
+        ):
+            payload = export_homebrew_tap.read_pypi_json("demo-package", "1.2.3")
+
+        self.assertEqual(payload, {"urls": []})
+        [connection] = FakeConnection.instances
+        self.assertEqual(connection.host, "pypi.org")
+        self.assertEqual(connection.timeout, 30)
+        self.assertEqual(connection.request_args, ("GET", "/pypi/demo-package/1.2.3/json"))
+        self.assertEqual(connection.request_headers["Accept"], "application/json")
+        self.assertTrue(connection.closed)
+
     def test_parse_lockfile_reads_pinned_packages_and_hashes(self) -> None:
         with tempfile.TemporaryDirectory() as tmpdir:
             lockfile = Path(tmpdir) / "runtime.lock"