fix: Use purl.bzl for a better api, add module package_metadata

BUILD.bazel

@@ -13,6 +13,9 @@
 # limitations under the License.
 
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("@package_metadata//licenses/rules:license.bzl", "license")
+load("@package_metadata//purl:purl.bzl", "purl")
+load("@package_metadata//rules:package_metadata.bzl", "package_metadata")
 
 # Resolve rules_cc Starlark libraries to their correct targets
 # gazelle:resolve starlark @rules_cc//cc/common:cc_info.bzl @rules_cc//cc/common:common
@@ -53,6 +56,24 @@ package(default_visibility = ["//visibility:public"])
 
 licenses(["notice"])
 
+package_metadata(
+    name = "package_metadata",
+    attributes = [
+        ":license",
+    ],
+    purl = purl.bazel(
+        module_name() or "rules_python",
+        module_version(),
+    ),
+    visibility = ["//visibility:public"],
+)
+
+license(
+    name = "license",
+    kind = "@package_metadata//licenses/spdx:Apache-2.0",
+    text = ":LICENSE",
+)
+
 exports_files([
     "LICENSE",
     "version.bzl",

MODULE.bazel

@@ -6,7 +6,7 @@ module(
 
 bazel_dep(name = "bazel_features", version = "1.21.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
-bazel_dep(name = "package_metadata", version = "0.0.7")
+bazel_dep(name = "package_metadata", version = "0.0.13")
 bazel_dep(name = "platforms", version = "0.0.11")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "toml.bzl", version = "0.4.1")

REPO.bazel

@@ -0,0 +1,7 @@
+"""File declaring metadata applying to all packages and targets in the Bazel module."""
+
+repo(
+    default_package_metadata = [
+        "//:package_metadata",
+    ],
+)

WORKSPACE

@@ -17,6 +17,17 @@ workspace(name = "rules_python")
 # Everything below this line is used only for developing rules_python. Users
 # should not copy it to their WORKSPACE.
 
+# REPO.bazel's default_package_metadata makes every package in this repo depend
+# on @package_metadata, so it must be defined before any other load.
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "package_metadata",
+    sha256 = "755bd6c8a3751982e2555d96c913ec070954ca9d01f935563392255da4ebad72",
+    strip_prefix = "package_metadata-0.0.13/metadata",
+    url = "https://github.com/bazel-contrib/supply-chain/releases/download/package_metadata-0.0.13/package_metadata-0.0.13.tar.gz",
+)
+
 # Workaround for Bazel 9 duplicate name issue in Gazelle.
 load("//:workspace_bazel9.bzl", "bazel_9_workaround")
 
@@ -77,8 +88,6 @@ python_register_multi_toolchains(
     python_versions = PYTHON_VERSIONS,
 )
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
 # Used for Bazel CI
 http_archive(
     name = "bazelci_rules",

python/private/py_repositories.bzl

@@ -80,9 +80,9 @@ def py_repositories(transition_settings = []):
     )
     http_archive(
         name = "package_metadata",
-        sha256 = "8f27dc7393e3f3bdc793bdc4ba36d67a63c22cc9d38cc65d3204654974ea4563",
-        strip_prefix = "supply-chain-0.0.7/metadata",
-        url = "https://github.com/bazel-contrib/supply-chain/releases/download/v0.0.7/supply-chain-v0.0.7.tar.gz",
+        sha256 = "755bd6c8a3751982e2555d96c913ec070954ca9d01f935563392255da4ebad72",
+        strip_prefix = "package_metadata-0.0.13/metadata",
+        url = "https://github.com/bazel-contrib/supply-chain/releases/download/package_metadata-0.0.13/package_metadata-0.0.13.tar.gz",
     )
 
     # Needed by rules_cc, triggered by @rules_java_prebuilt in Bazel by using @rules_cc//cc:defs.bzl

python/private/pypi/BUILD.bazel

@@ -584,6 +584,7 @@ bzl_library(
         ":whl_metadata",
         "//python/private:normalize_name",
         "//python/private:repo_utils",
+        "@package_metadata//purl:srcs",
     ],
 )
 

python/private/pypi/patch_and_extract_whl.bzl

@@ -1,5 +1,6 @@
 ""
 
+load("@package_metadata//purl:purl.bzl", "purl")
 load("//python/private:normalize_name.bzl", "normalize_name")
 load("//python/private:repo_utils.bzl", "repo_utils")
 load(":generate_whl_library_build_bazel.bzl", "generate_whl_library_build_bazel")
@@ -49,13 +50,13 @@ def _to_purl(*, index, metadata, filename):
     # https://github.com/package-url/purl-spec/blob/main/types-doc/pypi-definition.md#name-definition
     name = normalize_name(metadata.name).replace("_", "-")
 
-    qualifiers = {}
+    builder = purl.builder().type("pypi").name(name).version(metadata.version)
     if index:
-        qualifiers["repository_url"] = index
+        builder.add_qualifier("repository_url", index)
     if filename:
-        qualifiers["file_name"] = filename
+        builder.add_qualifier("file_name", filename)
 
-    return "pkg:pypi/{}@{}?{}".format(name, metadata.version, "&".join(["{}={}".format(key, val) for key, val in qualifiers.items()]))
+    return builder.build()
 
 def _remove_files(rctx, *basenames):
     paths = list(rctx.path(".").readdir())

tests/integration/whl_library/MODULE.bazel

@@ -1,6 +1,6 @@
 module(name = "integration_test")
 
-bazel_dep(name = "package_metadata", version = "0.0.7")
+bazel_dep(name = "package_metadata", version = "0.0.13")
 bazel_dep(name = "rules_python", version = "0.0.0")
 local_path_override(
     module_name = "rules_python",