rgpycrumbs.locks

Consume Python lock files / SBOMs as install pins for dispatch + AUTO_DEPS.

Supported formats (auto-detected by path/content):

• PEP 751 pylock.toml / pylock.*.toml — standards-track lock

• uv.lock — uv native TOML lock ([[package]])

• CycloneDX JSON — e.g. eb-stack --sbom-out or uv export --format cyclonedx1.5

rgpycrumbs does not generate these files. When a path is provided via RGPYCRUMBS_LOCK / --lock (or the SBOM aliases), PyPI packages become name==version constraints for uv run and ensure_import.

Non-Python / non-PyPI entries (e.g. eb-stack pkg:generic/...) are skipped.

Added in version 1.9.13.

Changed in version 1.9.14: Also accept PEP 751 pylock and uv.lock (not only CycloneDX).

Attributes

tomllib
LOCK_PATH_ENV
LOCK_PATH_ENV_LEGACY
SBOM_PATH_ENV
PINS_ENV
PINS_ENV_LEGACY
SBOM_PINS_ENV
_VERSION_OPS
_PYLOCK_NAME

Classes

LockFormat

str(object='') -> str

Functions

normalize_pypi_name(→ str)	PEP 503-ish name normalization for pin lookups.
package_name_from_spec(→ str)	Return the distribution name from a pip requirement string.
_require_tomllib(→ Any)
_pin_from_purl(→ tuple[str, str] | None)	Parse pkg:pypi/name@version (optional qualifiers after ?).
detect_lock_format(→ LockFormat)	Guess lock format from filename and optional file text.
pypi_pins_from_cyclonedx(→ dict[str, str])	Extract {normalized_name: version} for PyPI components only.
pypi_pins_from_pylock(→ dict[str, str])	Extract pins from a PEP 751 pylock.toml document.
pypi_pins_from_uv_lock(→ dict[str, str])	Extract pins from a uv.lock TOML document ([[package]] tables).
load_cyclonedx(→ dict[str, Any])	Load and validate a CycloneDX JSON document from path.
load_toml_lock(→ dict[str, Any])	Load a TOML lock document (pylock or uv.lock).
load_pypi_pins(→ dict[str, str])	Load any supported lock/SBOM path and return a PyPI pin map.
pins_to_constraint_lines(→ list[str])	Render pin map as pip/uv constraint lines (name==version).
apply_pin_to_spec(→ str)	If pip_spec's package is in pins, return name==version.
pins_from_env(→ dict[str, str])	Read pin map from RGPKGS_LOCK_PINS / legacy pin envs.

Module Contents

rgpycrumbs.locks.tomllib = None

rgpycrumbs.locks.LOCK_PATH_ENV = 'RGPKGS_LOCK'

rgpycrumbs.locks.LOCK_PATH_ENV_LEGACY = 'RGPYCRUMBS_LOCK'

rgpycrumbs.locks.SBOM_PATH_ENV = 'RGPYCRUMBS_SBOM'

rgpycrumbs.locks.PINS_ENV = 'RGPKGS_LOCK_PINS'

rgpycrumbs.locks.PINS_ENV_LEGACY = 'RGPYCRUMBS_LOCK_PINS'

rgpycrumbs.locks.SBOM_PINS_ENV = 'RGPYCRUMBS_SBOM_PINS'

rgpycrumbs.locks._VERSION_OPS

rgpycrumbs.locks._PYLOCK_NAME

class rgpycrumbs.locks.LockFormat

Bases: str, enum.Enum

str(object=’’) -> str str(bytes_or_buffer[, encoding[, errors]]) -> str

Create a new string object from the given object. If encoding or errors is specified, then the object must expose a data buffer that will be decoded using the given encoding and error handler. Otherwise, returns the result of object.__str__() (if defined) or repr(object). encoding defaults to ‘utf-8’. errors defaults to ‘strict’.

PYLOCK = 'pylock'

UV_LOCK = 'uv.lock'

CYCLONEDX = 'cyclonedx'

UNKNOWN = 'unknown'

rgpycrumbs.locks.normalize_pypi_name(name: str) → str

PEP 503-ish name normalization for pin lookups.

rgpycrumbs.locks.package_name_from_spec(pip_spec: str) → str

Return the distribution name from a pip requirement string.

rgpycrumbs.locks._require_tomllib() → Any

rgpycrumbs.locks._pin_from_purl(purl: str) → tuple[str, str] | None

Parse pkg:pypi/name@version (optional qualifiers after ?).

rgpycrumbs.locks.detect_lock_format(path: str | pathlib.Path, text: str | None = None) → LockFormat

Guess lock format from filename and optional file text.

rgpycrumbs.locks.pypi_pins_from_cyclonedx(doc: dict[str, Any]) → dict[str, str]

Extract {normalized_name: version} for PyPI components only.

rgpycrumbs.locks.pypi_pins_from_pylock(doc: dict[str, Any]) → dict[str, str]

Extract pins from a PEP 751 pylock.toml document.

Uses [[packages]] entries with name + version. Packages without a version (rare) are skipped. Marker diversity is ignored for pin map purposes: last wins (constraints still force that version for installs).

rgpycrumbs.locks.pypi_pins_from_uv_lock(doc: dict[str, Any]) → dict[str, str]

Extract pins from a uv.lock TOML document ([[package]] tables).

rgpycrumbs.locks.load_cyclonedx(path: str | pathlib.Path) → dict[str, Any]

Load and validate a CycloneDX JSON document from path.

rgpycrumbs.locks.load_toml_lock(path: str | pathlib.Path) → dict[str, Any]

Load a TOML lock document (pylock or uv.lock).

rgpycrumbs.locks.load_pypi_pins(path: str | pathlib.Path) → dict[str, str]

Load any supported lock/SBOM path and return a PyPI pin map.

Raises:

FileNotFoundError: path missing ValueError: unreadable / unsupported / empty-of-python when required

rgpycrumbs.locks.pins_to_constraint_lines(pins: dict[str, str]) → list[str]

Render pin map as pip/uv constraint lines (name==version).

rgpycrumbs.locks.apply_pin_to_spec(pip_spec: str, pins: dict[str, str]) → str

If pip_spec’s package is in pins, return name==version.

rgpycrumbs.locks.pins_from_env(env: dict[str, str] | None = None) → dict[str, str]

Read pin map from RGPKGS_LOCK_PINS / legacy pin envs.