Documentation
¶
Index ¶
- Constants
- func BuildDependencyTree(params technologies.BuildInfoBomGeneratorParams, ...) (dependencyTree []*clientutils.GraphNode, uniqueDeps []string, ...)
- func DefaultPipConfPaths() []string
- func NormalizePypiName(name string) string
- func ParsePipConfigIndexUrl(paths ...string) (serverDetails *config.ServerDetails, repoName string, sourcePath string, ...)
- func ParsePipfileArtifactorySource(pipfilePath string) (*config.ServerDetails, string, error)
- func ParsePyprojectArtifactorySource() (serverDetails *config.ServerDetails, repoName string, err error)
- func ResolvePipfileArtifactorySource(pipfilePath string, configuredServer *config.ServerDetails, ...) (*config.ServerDetails, string, error)
- func ResolveVersionRange(rangeSpec string, candidates []string) string
- func SetPipVirtualEnvPath() (restoreEnv func() error, err error)
- func WrapUvCurationErr(combinedOutput string, cause error) error
- type CvsBlockedError
- type PinnedRequirement
Constants ¶
const ( PythonPackageTypeIdentifier = "pypi://" CurationPipMinimumVersion = "23.0.0" PoetryNoInteractionFlag = "--no-interaction" CurationPoetryMinimumVersion = "1.2.0" CurationPipenvMinimumVersion = "2023.7.4" )
Variables ¶
This section is empty.
Functions ¶
func BuildDependencyTree ¶
func BuildDependencyTree(params technologies.BuildInfoBomGeneratorParams, technology techutils.Technology) (dependencyTree []*clientutils.GraphNode, uniqueDeps []string, downloadUrls map[string]string, err error)
func DefaultPipConfPaths ¶ added in v1.32.0
func DefaultPipConfPaths() []string
DefaultPipConfPaths returns pip's user-level config candidates: legacy, then modern (overrides legacy), then PIP_CONFIG_FILE if set (overrides both). An existing PIP_CONFIG_FILE skips legacy/modern, matching pip.
func NormalizePypiName ¶ added in v1.31.0
func ParsePipConfigIndexUrl ¶ added in v1.32.0
func ParsePipConfigIndexUrl(paths ...string) (serverDetails *config.ServerDetails, repoName string, sourcePath string, err error)
ParsePipConfigIndexUrl extracts Artifactory server details and repo name from the [global] index-url, merging paths in order (later overrides earlier), pip-style. sourcePath is the file the winning value came from, for logging/errors.
func ParsePipfileArtifactorySource ¶ added in v1.32.0
func ParsePipfileArtifactorySource(pipfilePath string) (*config.ServerDetails, string, error)
func ParsePyprojectArtifactorySource ¶ added in v1.34.0
func ParsePyprojectArtifactorySource() (serverDetails *config.ServerDetails, repoName string, err error)
ParsePyprojectArtifactorySource scans the current directory's pyproject.toml for a [[tool.poetry.source]] entry whose url points at an Artifactory PyPI repository (e.g. https://<host>/artifactory/api/pypi/<repo>/simple), returning its server + repo name. Returns (nil, "", nil) when pyproject.toml is missing or has no such entry. Errors if more than one Artifactory-shaped entry is found (e.g. a stale entry left from a prior migration) — silently picking one could resolve against the wrong repo, so this is treated as ambiguous rather than resolved by declaration order.
func ResolvePipfileArtifactorySource ¶ added in v1.32.0
func ResolvePipfileArtifactorySource(pipfilePath string, configuredServer *config.ServerDetails, configuredRepo string, fallbackServer *config.ServerDetails) (*config.ServerDetails, string, error)
ResolvePipfileArtifactorySource derives and validates Pipenv's effective sources.
func ResolveVersionRange ¶ added in v1.31.0
ResolveVersionRange returns the newest version from candidates satisfying rangeSpec. Returns "" if no candidate matches.
func SetPipVirtualEnvPath ¶
Execute virtualenv command: "virtualenv venvdir" / "python3 -m venv venvdir" and set path
func WrapUvCurationErr ¶ added in v1.33.0
WrapUvCurationErr checks a failed `uv lock` run's output for a CVS-stripped version, wrapping it as a *CvsBlockedError so the caller can recover policy details via the metadata-API fallback. A generic download-blocked 403 (e.g. uv fetching a wheel for metadata) is NOT treated as CVS-blocked, matching pip/poetry — cause is returned unchanged, leaving the caller to decide how to present it (see classifyUvCurationLockError, which falls through to a plain "contact admin" message for that case).
Types ¶
type CvsBlockedError ¶ added in v1.31.0
type CvsBlockedError struct {
Packages []PinnedRequirement
Cause error
}
CvsBlockedError is returned when CVS hides a pinned version from the simple index. Packages lists the blockers so the curation-audit command can recover policy details via the metadata-API fallback.
func (*CvsBlockedError) Error ¶ added in v1.31.0
func (e *CvsBlockedError) Error() string
func (*CvsBlockedError) Unwrap ¶ added in v1.31.0
func (e *CvsBlockedError) Unwrap() error
type PinnedRequirement ¶ added in v1.31.0
type PinnedRequirement struct {
Name string
Version string
VersionRange string
ParentName string
ParentVersion string
// ConfirmedDirect is true when the tool's output explicitly confirms this is a
// direct dependency (e.g. uv's "your project depends on X"), even with no
// Version/VersionRange recovered. Prevents misclassifying it as transitive.
ConfirmedDirect bool
}
PinnedRequirement is a blocker extracted from pip, poetry, or uv failure output.
Source Files