- sbom: normalize component names (PEP 503) for canonical pkg:pypi PURLs and stable ordering
- wheel: reject any member with a '..' path segment (catches escapes that resolve back under the prefix but out of site-packages)
- cache/wheelhouse: replace file atomically across platforms (os.Rename fails on existing dest on Windows)
- project: include requirements.lock in the no-lock-found error
- tests for each
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
A no-op build's ~2-3s was almost all registry I/O:
- the base index was fetched 3x (BasePlatforms + remote.Image per platform)
- the base's top layer was downloaded once per platform every build to read
/etc/apko.json for interpreter detection (Chainguard has no PYTHON_VERSION)
Changes:
- build.BaseSet resolves the base reference once and serves per-platform child
images memoized (index fetched once; verified by TestBaseSet)
- cache the detected interpreter version by base digest in a default per-user
metadata cache (cache.GetText/PutText), so repeat builds skip the apko layer
download
- lazy wheel-cache dir creation; wheelhouse.Resolve defaults to the per-user
cache dir
Tests: TestBaseSet (index fetched once + per-platform memoized), TestCachedInterpreter
(write + cache-hit short-circuit), cache text round-trip.
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
- add internal/cache content-addressed layer store; build per-wheel layers in
parallel and reuse cached compressed blobs across rebuilds (--cache-dir)
- thread platform/python target into wheel resolution; validate --env
- add common secret patterns to the default source ignore list
- README: copy/paste-safe usage example + new flags; DESIGN status updated
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
