pypi

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 16, 2025 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

The full specification for this API endpoint can be found at: https://warehouse.pypa.io/api-reference/json.html#project

Index

Examples

Constants

View Source
const Host = "pypi.org"

Variables

View Source
var ErrMissingReleases = errors.New("no releases for this project's version")

Functions

This section is empty.

Types

type Attestation

type Attestation struct {
	Version               int                   `json:"version"`
	Envelope              Envelope              `json:"envelope"`
	VerificationMaterials VerificationMaterials `json:"verification_material"`
}

type AttestationBundle

type AttestationBundle struct {
	Attestations []Attestation `json:"attestations"`
	Publisher    Publisher     `json:"publisher"`
}

type Client

type Client struct {
	HTTP *http.Client
}

func (*Client) GetProject

func (c *Client) GetProject(ctx context.Context, name string) (*Project, error)

func (*Client) GetProvenance

func (c *Client) GetProvenance(ctx context.Context, name, version, filename string) (*Provenance, error)

type Digests

type Digests struct {
	Blake2B256 string `json:"blake2b_256"`
	Md5        string `json:"md5"`
	Sha256     string `json:"sha256"`
}

type Downloads

type Downloads struct {
	LastDay   int `json:"last_day"`
	LastMonth int `json:"last_month"`
	LastWeek  int `json:"last_week"`
}

type Envelope

type Envelope struct {
	Signature string `json:"signature"`
	Statement string `json:"statement"`
}

type Info

type Info struct {
	Author                 string      `json:"author"`
	AuthorEmail            string      `json:"author_email"`
	BugtrackURL            string      `json:"bugtrack_url"`
	Classifiers            []string    `json:"classifiers"`
	Description            string      `json:"description"`
	DescriptionContentType string      `json:"description_content_type"`
	DocsURL                string      `json:"docs_url"`
	DownloadURL            string      `json:"download_url"`
	Downloads              Downloads   `json:"downloads"`
	HomePage               string      `json:"home_page"`
	Keywords               string      `json:"keywords"`
	License                string      `json:"license"`
	Maintainer             string      `json:"maintainer"`
	MaintainerEmail        string      `json:"maintainer_email"`
	Name                   string      `json:"name"`
	PackageURL             string      `json:"package_url"`
	Platform               string      `json:"platform"`
	ProjectURL             string      `json:"project_url"`
	ProjectUrls            ProjectUrls `json:"project_urls"`
	ReleaseURL             string      `json:"release_url"`
	RequiresDist           []string    `json:"requires_dist"`
	RequiresPython         string      `json:"requires_python"`
	Summary                string      `json:"summary"`
	Version                string      `json:"version"`
	Yanked                 bool        `json:"yanked"`
	YankedReason           string      `json:"yanked_reason"`
}

type Project

type Project struct {
	Info            Info                 `json:"info"`
	LastSerial      int                  `json:"last_serial"`
	Releases        map[string][]Release `json:"releases"`
	Urls            []Release            `json:"urls"`
	Vulnerabilities []Vulnerability      `json:"vulnerabilities"`
}

type ProjectUrls

type ProjectUrls struct {
	BugReports string `json:"Bug Reports"`
	Funding    string `json:"Funding"`
	Homepage   string `json:"Homepage"`
	SayThanks  string `json:"Say Thanks!"`
	Source     string `json:"Source"`
}

type Provenance

type Provenance struct {
	Version            int                 `json:"version"`
	AttestationBundles []AttestationBundle `json:"attestation_bundles"`
}

PyPI seems to use a slightly custom AttestationBundle format documented at https://docs.pypi.org/api/integrity/

type Publisher

type Publisher struct {
	Environment string `json:"environment"`
	Kind        string `json:"kind"`
	Repository  string `json:"repository"`
	Workflow    string `json:"workflow"`
}

type Release

type Release struct {
	CommentText       string    `json:"comment_text"`
	Digests           Digests   `json:"digests"`
	Downloads         int       `json:"downloads"`
	Filename          string    `json:"filename"`
	HasSig            bool      `json:"has_sig"`
	Md5Digest         string    `json:"md5_digest"`
	Packagetype       string    `json:"packagetype"`
	PythonVersion     string    `json:"python_version"`
	RequiresPython    string    `json:"requires_python"`
	Size              int       `json:"size"`
	UploadTime        string    `json:"upload_time"`
	UploadTimeIso8601 time.Time `json:"upload_time_iso_8601"`
	URL               string    `json:"url"`
	Yanked            bool      `json:"yanked"`
	YankedReason      string    `json:"yanked_reason"`
}

type VerificationMaterials

type VerificationMaterials struct {
	Certificate         string                        `json:"certificate"`
	TransparencyEntries []*rekor.TransparencyLogEntry `json:"transparency_entries"`
}

func (*VerificationMaterials) UnmarshalJSON

func (v *VerificationMaterials) UnmarshalJSON(bytes []byte) error

This is required as PyPI returns JSON serialized protobuf transparency entries.

type VerificationStatus

type VerificationStatus struct {
	URL            string
	SHA256         string
	InferredIssuer string
	HasAttestation bool
	Attestation    *verify.VerificationResult
	Error          error
}

type Verifier

type Verifier struct {
	PyPI     *Client
	SigStore *verify.Verifier
}

func NewVerifier

func NewVerifier(pypi *Client) (*Verifier, error)

func (*Verifier) Verify

func (v *Verifier) Verify(ctx context.Context, project *Project, version string) ([]*VerificationStatus, error)
Example
package main

import (
	"context"
	"log"

	"github.com/DataDog/go-attestations-verifier/internal/httputil"
	"github.com/DataDog/go-attestations-verifier/pkg/pypi"
)

func main() {
	ctx := context.Background()

	pypiClient := &pypi.Client{HTTP: httputil.DefaultClient()}

	project, err := pypiClient.GetProject(ctx, "sampleproject")
	if err != nil {
		log.Fatal(err)
	}

	verifier, err := pypi.NewVerifier(pypiClient)
	if err != nil {
		log.Fatal(err)
	}

	status, err := verifier.Verify(ctx, project, "4.0.0")
	if err != nil {
		log.Fatal(err)
	}

	log.Print(status)
}

type Vulnerability

type Vulnerability struct {
	Aliases   []string  `json:"aliases"`
	Details   string    `json:"details"`
	Summary   string    `json:"summary"`
	FixedIn   []string  `json:"fixed_in"`
	ID        string    `json:"id"`
	Link      string    `json:"link"`
	Source    string    `json:"source"`
	Withdrawn time.Time `json:"withdrawn"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL