Bug 2514458

Summary:	Implement Changes/Adopt_PURL_Metadata for Python
Product:	[Fedora] Fedora	Reporter:	Maxwell G <maxwell>
Component:	python-rpm-generators	Assignee:	Miro Hrončok <mhroncok>
Status:	POST ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	cstratak, decathorpe, lbalhar, maxwell, mhroncok, ngompa13, python-maint, python-packagers-sig, torsava
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2494983

Description Maxwell G 2026-08-12 01:00:14 UTC

Description of problem:

The Python dependency generator should generate `purl(pkg:pypi/$NAME@$VERSION)` Provides alongside the existing `python*dist($NAME) = $RPM_VERSION` Provides. NAME is the normalized package name (https://packageurl.org/docs/purl-spec/types/definitions/pypi-definition#name-definition) and VERSION is the Python version (_not_ the RPM-compatible version). There should be a macro that can be defined or undefine to disable generating the purl() Provides for packages that don't exist on PyPI and thus shouldn't have a `pkg:pypi` purl.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Build a package includes a Python package with dist-info
2. rpm -qp --provides ./python3-*.rpm | grep purl

Actual results:


Expected results:
"purl(pkg:pypi/flit-core.2)"

Additional info:
https://fedoraproject.org/wiki/Changes/Adopt_PURL_Metadata
https://discussion.fedoraproject.org/t/f45-change-proposal-adopt-purl-metadata-system-wide/192435/

Comment 1 Miro Hrončok 2026-08-12 08:47:40 UTC

I was actually already thinking about this. The bit that needs to be designed is the opt-out mechanism. I'll ask in the discussion: https://discussion.fedoraproject.org/t/f45-change-proposal-adopt-purl-metadata-system-wide/192435/50

(This feature can be drafted even before that.)

Comment 2 Miro Hrončok 2026-08-12 10:20:47 UTC

Note: VERSION is the **normalized** Python version

Comment 3 Miro Hrončok 2026-08-12 11:14:15 UTC

https://github.com/package-url/purl-spec/blob/fe214b861021ff32ad495627e3031d370c319b9e/docs/types/definitions/pypi-definition.md?plain=1#L32

> Replace dot . with underscore _ when used in distribution (sdist, wheel) names

I don't really understand this rule. But it appears we cannot just use PEP 503 normalization.

Comment 4 Miro Hrončok 2026-08-12 11:25:15 UTC

(In reply to Miro Hrončok from comment #2)
> Note: VERSION is the **normalized** Python version

But maybe it isn't :D

The standard is not very clear.