[kocaemre]

Pull Request Description

What

• Keep wheel-only name, type, namespace, and global purl type settings out of the default upstream SBOM purl; explicit purl.upstream still takes precedence.
• Cover the four affected settings with SPDX-validating regressions and document the migration for non-PyPI sources.
• Clarify that SbomSettings.purl_type applies to wheel package entries.

Why

Closes #1383. Previously the GENERATED_FROM entry could identify a downstream-renamed wheel rather than the resolved PyPI source. This changes existing SBOM output for users overriding purl type/name/namespace without purl.upstream; set that field explicitly for a different source.

Verification

• RED: uvx --from hatch hatch run test:test tests/test_sbom.py::test_generate_sbom_upstream_ignores_wheel_purl_overrides -q --no-cov --tb=short → 4 expected upstream identity assertion failures (original test-first cycle).
• Follow-up RED: deterministic docstring assertion failed while SbomSettings.purl_type said “all packages”; GREEN: same check passed after making it wheel-only.
• GREEN: uvx --from hatch hatch run test:test tests/test_sbom.py tests/test_packagesettings.py -q --no-cov --tb=short → 112 passed.
• uvx --from hatch hatch run lint:check → passed; uvx --from hatch hatch run mypy:check src/fromager/sbom.py src/fromager/packagesettings/_models.py tests/test_sbom.py → 77 source, 51 test, 7 e2e files checked, no issues.
• uvx --from hatch hatch run docs:build → build succeeded; git diff --check HEAD~1..HEAD → passed. Full suite/e2e not run locally (repo guidance favors file-scoped tests for small changes). The original two signed-off commits, including the Sphinx heading correction, were squashed into one signed-off commit at maintainer request; CI is rerunning for the new head.

Significant AI assistance: Hermes Agent co-authored the patch; test failures and passing checks were run locally.

• PR follows CONTRIBUTING.md guidelines

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: python-wheel-build/fromager/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2f9e0c3c-0247-496d-9924-f2e4b110c5d7

📥 Commits

Reviewing files that changed from the base of the PR and between 02f3852 and dba98b3.

📒 Files selected for processing: 2

• docs/reference/config-reference.rst
• src/fromager/packagesettings/_models.py

🚧 Files skipped from review as they are similar to previous changes: 2

• docs/reference/config-reference.rst
• src/fromager/packagesettings/_models.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

When purl.upstream is absent, the upstream SBOM entry uses the resolved package name and version in a PyPI PURL. Per-package wheel PURL settings and global sbom.purl_type no longer affect that upstream entry. Documentation describes this behavior and directs users with non-PyPI sources to set purl.upstream. Tests cover name, type, namespace, and global type overrides.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to dba98

No actionable issue is identified that would prevent merging after normal checks.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Linked Issues check		The implementation satisfies the main #1383 behavior. _build_upstream_purl now uses the resolved PyPI name and version, and explicit purl.upstream remains authoritative. Tests cover name, type, na…	Add a release-note entry for #1383. State that wheel-only purl overrides and global sbom.purl_type no longer change the default upstream purl. Tell users with non-PyPI sources or different source coordinates to set purl.upstream explici…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: preventing wheel PURL settings from affecting upstream SBOM identity.
Out of Scope Changes check		The changed SBOM code, package-setting documentation, configuration reference, and regression tests directly implement or verify #1383. The supplied whole-PR summary shows no unrelated changes.
Description check		The pull request description directly explains the SBOM upstream PURL changes, affected settings, documentation updates, tests, and verification results.

Full details: Linked Issues check

Explanation

The implementation satisfies the main #1383 behavior. _build_upstream_purl now uses the resolved PyPI name and version, and explicit purl.upstream remains authoritative. Tests cover name, type, namespace, global type, combined overrides, explicit upstream values, and SPDX validation. The configuration documentation explains the migration for non-PyPI sources. The reviewed change summary shows no release-note entry, although #1383 requires the behavior change to be documented in the release notes.

Resolution

Add a release-note entry for #1383. State that wheel-only purl overrides and global sbom.purl_type no longer change the default upstream purl. Tell users with non-PyPI sources or different source coordinates to set purl.upstream explicitly.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mprpic]

Validated with the following test data:

All scenarios use this overrides/settings.yaml, with per-package settings in overrides/settings/test-pkg.yaml, for test-pkg==0.5.5:

sbom:
  supplier: "Organization: ExampleCo"
  namespace: "https://sbom.example"

Scenario	Settings	Wheel purl (same before and after)	Upstream purl on main	Upstream purl on #1386
None	(no package file)	pkg:pypi/[email protected]	pkg:pypi/[email protected]	unchanged
Name	purl: {name: "test-pkg-corp"}	pkg:pypi/[email protected]	pkg:pypi/[email protected]	pkg:pypi/[email protected]
Type	purl: {type: "generic"}	pkg:generic/[email protected]	pkg:generic/[email protected]	pkg:pypi/[email protected]
Namespace	purl: {namespace: "acme"}	pkg:pypi/acme/[email protected]	pkg:pypi/acme/[email protected]	pkg:pypi/[email protected]
Global type	sbom: {purl_type: "generic"} in settings.yaml	pkg:generic/[email protected]	pkg:generic/[email protected]	pkg:pypi/[email protected]
Combined	purl: {name: "test-pkg-corp", version: "0.5.5+local.1", repository_url: "https://pkgs.example/simple/"}	pkg:pypi/[email protected]%2Blocal.1?repository_url=https://pkgs.example/simple/	pkg:pypi/[email protected]	pkg:pypi/[email protected]
Upstream set	purl: {type: "generic", upstream: "pkg:github/acme/[email protected]"}	pkg:generic/[email protected]	pkg:github/acme/[email protected]	unchanged

One small nit: the SbomSettings.purl_type docstring (src/fromager/packagesettings/_models.py:118) still says "Default purl type for all packages". With this change it only applies to the wheel entry, so it would be good to say that.

[mprpic]

Can you also please squash both of the commits since the second one just fixes the indentation of the header?

[kocaemre]

Thanks for checking the scenarios. I changed SbomSettings.purl_type to describe wheel package entries only and squashed the header fix into the signed-off commit (dba98b3). Local verification: uvx --from hatch hatch run test:test tests/test_sbom.py tests/test_packagesettings.py -q --no-cov --tb=short (112 passed); uvx --from hatch hatch run lint:check, uvx --from hatch hatch run mypy:check src/fromager/sbom.py src/fromager/packagesettings/_models.py tests/test_sbom.py, uvx --from hatch hatch run docs:build, and git diff --check HEAD~1..HEAD passed. CI is rerunning after the squash.