Add filename qualifier to pypi.

[MarkLodato]

This allows the PURL to specify the exact file that was used.

Fixes #90.

[MarkLodato]

@iamwillbar friendly ping :) I think this is ready to be merged if you agree with the changes.

[MarkLodato]

Friendly ping. Any chance this can get merged?

[stevespringett]

@pombredanne there are likely other purl types that could benefit from the filename qualifier. Is this something we want to include as a global qualifier in the next purl spec?

[pombredanne]

@stevespringett you wrote:

There are likely other purl types that could benefit from the filename qualifier. Is this something we want to include as a global qualifier in the next purl spec?

@MarkLodato : @adaaaam and @johnmhoran just pointed to me that we have had a file_name in the spec for a very long time cdf28ff#diff-7b3ed02bc73dc06b7db906cf97aa91dec2b2eb21f2d92bc5caa761df5bbc168fR656 🤦 🤦 🤦 🤦 🤦 🤦 🤦 🤦 🤯

See

purl-spec/PURL-SPECIFICATION.rst

Line 457 in 33d772d

- ``file_name`` is an extra file name of a package archive.

I also pondered using a more specific qualifier for PyPI, as we still have a small problem to consider with a file_name.

• If I go to PyPI I can know the filename of a sourec distribution or wheel, for instance for numpy: https://pypi.org/project/numpy/#files , we would have this downloadable wheel out of many:

... https://files.pythonhosted.org/packages/05/db/5d9c91b2e1e2e72be1369278f696356d44975befcae830daf2e667dcb54f/numpy-2.1.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

... with this file_name: numpy-2.1.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

... which is for a combination of tags, as specified here: https://packaging.python.org/en/latest/specifications/platform-compatibility-tags/

BUT if I have an installed nupmy wheel, I do not have direct access to the file_name unless I look the installed extracted wheel in site-packages, specifically in the the WHEEL metadata file, for instance at site-packages/numpy-2.1.3.dist-info/WHEEL in an installed numpy environment.

This WHEEL file has these tags:

Tag: cp310-cp310-manylinux_2_17_x86_64
Tag: cp310-cp310-manylinux2014_x86_64

And I would need process the package, version, and these tags to reconstruct a file_name as explained at:

• https://packaging.python.org/en/latest/specifications/platform-compatibility-tags/#compressed-tag-sets
• https://peps.python.org/pep-0425/#compressed-tag-sets
• https://github.com/pypa/packaging.python.org/blob/3dc5d16186e047d267333d3fcb6012cbfe1db2f5/source/specifications/platform-compatibility-tags.rst#L247

@MarkLodato So to recap, I think we can use the existing file_name qualifier as-is, but we would need to provide guidance on how a tool can reconstruct this from an installed distribution. Can you update this PR along these lines, using file_name and providing some guidance on its usage, including pointers on how to reconstruct a filename from an installed PyPI wheel? This would be wonderful! (Sorry for it taking so long!)

Some examples of these PURLs would be:

• pkg:pypi/[email protected]?file_name=numpy-2.1.3.tar.gz
• pkg:pypi/[email protected]?file_name=numpy-2.1.3-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

[MarkLodato]

@pombredanne Thanks for the suggestions! Please take a look at the latest version.

[pombredanne]

@MarkLodato Thanks! merging.
I also created #349 as a follow up to provide extra guidance for tools authors.