Merge branch 'main' into automation/dependencies/update-from-metadata

Author: sgaist

.pre-commit-config.yaml

@@ -31,3 +31,9 @@ repos:
       - id: go-imports
       - id: no-go-testing
       - id: golangci-lint
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.2
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format

dependency/actions/compile/constraints.py

@@ -0,0 +1,25 @@
+# Copyright (c) 2013-Present CloudFoundry.org Foundation, Inc. All Rights Reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import sys
+from subprocess import check_call
+
+import tomllib
+
+file_path = sys.argv[1]
+
+with open(file_path, "rb") as f:
+    data = tomllib.load(f)
+    for entry in data["build-system"]["requires"]:
+        name, constraints = entry.split(" ")
+        check_call(
+            [
+                "pip3",
+                "--cache-dir=/tmp-cache/",
+                "download",
+                "--no-binary",
+                ":all:",
+                f"{name}{constraints}",
+            ]
+        )

dependency/actions/compile/entrypoint

@@ -61,25 +61,23 @@ function main() {
   echo "target=${target}"
   echo "download_dir=${download_dir}"
 
-  pip3 --version
-  # "pip download pip" with older pips have seen failures that say "has inconsistent name: filename has 'pip', but metadata has 'unknown'"
-  pip3 install --upgrade pip
   pip3 --version
   python3 --version
 
   pushd "${download_dir}" > /dev/null
     mkdir -p /tmp/pip-cache/
     pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: pip=="${version}"
-    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: wheel
-    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: setuptools
-    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: flit_core
 
     # Use globbing to detect the pip tarball
     # https://github.com/paketo-buildpacks/pip/issues/334
     tar --extract \
       --strip-components=1 \
       --file pip-*.tar.gz
 
+    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: wheel
+    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: setuptools
+    python3 /constraints.py pyproject.toml
+
     tar --create \
       --gunzip \
       --verbose \

dependency/actions/compile/noarch.Dockerfile

@@ -1,14 +1,14 @@
+FROM ubuntu:noble
 # Copyright (c) 2013-Present CloudFoundry.org Foundation, Inc. All Rights Reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM ubuntu:jammy
-
-ENV DEBIAN_FRONTEND noninteractive
-ENV LC_CTYPE = 'en_US.UTF'
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LC_CTYPE='en_US.UTF'
 
 RUN apt-get update && apt install python3-pip -y
 
 COPY entrypoint /entrypoint
+COPY constraints.py /constraints.py
 
 ENTRYPOINT ["/entrypoint"]

dependency/retrieval/go.mod

@@ -1,16 +1,18 @@
 module github.com/paketo-buildpacks/python-package-managers-install/retrieval
 
-go 1.26.3
+go 1.26.5
 
 // This is required because of a breaking change in a newer version
 replace github.com/ekzhu/minhash-lsh => github.com/ekzhu/minhash-lsh v0.0.0-20171225071031-5c06ee8586a1
 
+replace github.com/go-enry/go-license-detector/v4 => github.com/go-enry/go-license-detector/v4 v4.3.0
+
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/google/go-github/v81 v81.0.0
 	github.com/joshuatcasey/libdependency v0.25.0
 	github.com/nfx/go-htmltable v0.4.0
-	github.com/paketo-buildpacks/packit/v2 v2.25.6
+	github.com/paketo-buildpacks/packit/v2 v2.25.7
 )
 
 require (
@@ -19,26 +21,26 @@ require (
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/anchore/packageurl-go v0.2.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/cloudflare/circl v1.6.5 // indirect
+	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/dgryski/go-minhash v0.0.0-20190315135803-ad340ca03076 // indirect
 	github.com/ekzhu/minhash-lsh v0.0.0-20190924033628-faac2c6342f8 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
-	github.com/go-enry/go-license-detector/v4 v4.3.1 // indirect
+	github.com/go-enry/go-license-detector/v4 v4.3.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.1 // indirect
+	github.com/go-git/go-billy/v5 v5.9.1 // indirect
+	github.com/go-git/go-git/v5 v5.19.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/hhatto/gorst v0.0.0-20181029133204-ca9f730cac5b // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jdkato/prose v1.2.1 // indirect
 	github.com/joshuatcasey/collections v0.5.0 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/moby/sys/mount v0.3.4 // indirect
-	github.com/montanaflynn/stats v0.7.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
+	github.com/moby/sys/mount v0.3.5 // indirect
+	github.com/montanaflynn/stats v0.12.2 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect