Add Registry Proxy Support for Pip Backend#1585
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
a-ovchinnikov
left a comment
a-ovchinnikov
left a comment
There was a problem hiding this comment.
A couple of small nitpicks, LGTM otherwise.
taylormadore
force-pushed
the
pip-proxy
branch
2 times, most recently
from
de31ddd to
09e2e22
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds proxy and authentication support for the Pip package manager, enabling PyPI packages to be resolved and downloaded through a proxy and recording the proxy URL in the generated SBOM components. The review feedback identifies a critical runtime issue where PyPISimple does not accept an auth parameter directly, and offers valuable improvements regarding robust configuration checks and appending rather than overwriting external references in the SBOM component.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
When a proxy URL is configured, route PyPI index queries through the proxy instead of hitting the upstream index directly. The PURL still records the canonical index URL so downstream tooling can reason about package provenance independently of the download path. Signed-off-by: Taylor Madore <tmadore@redhat.com> Assisted-by: Claude
Pass HTTP basic-auth credentials to pypi_simple and aiohttp when proxy login/password are configured Signed-off-by: Taylor Madore <tmadore@redhat.com> Assisted-by: Claude
When packages are fetched through a proxy, attach the proxy URL as a distribution ExternalReference on the SBOM component. This preserves the canonical index URL in the PURL while recording the actual download source. Signed-off-by: Taylor Madore <tmadore@redhat.com> Assisted-by: Claude
Signed-off-by: Taylor Madore <tmadore@redhat.com>
Components with repository_url are from non-canonical registries, not direct sources. Remove repository_url from _DIRECT_SOURCE_QUALIFIERS and instead skip registries that lack proxy support (e.g. JSR). Signed-off-by: Taylor Madore <tmadore@redhat.com> Assisted-by: Claude
5 participants
This PR adds support to the pip backend for fetching packages via a registry proxy and reporting them