{% extends "base.html" %}

{% block title %}SBOM for {{ name }} {{ version }} — pypi-tea{% endblock %}

{% block meta %}
  <meta name="description" content="Download {{ formats|join(', ') }} SBOM for {{ name }} {{ version }}.{% if has_attestation %} Verified with PEP 740 digital attestation.{% endif %}{% if summary %} {{ summary }}{% endif %}">
  <meta name="keywords" content="SBOM, {{ name }}, {{ version }}, {% for f in formats %}{{ f }}, {% endfor %}Software Bill of Materials, PyPI, Python, supply chain security{% if has_attestation %}, PEP 740, attestation, Sigstore{% endif %}">
  <link rel="canonical" href="{{ canonical_url }}">

  <!-- Open Graph -->
  <meta property="og:title" content="SBOM for {{ name }} {{ version }}">
  <meta property="og:description" content="Download {{ formats|join(', ') }} SBOM for the {{ name }} Python package (version {{ version }}).{% if has_attestation %} Verified with PEP 740 digital attestation.{% endif %}{% if summary %} {{ summary }}{% endif %}">
  <meta property="og:type" content="article">
  <meta property="og:url" content="{{ canonical_url }}">
  <meta property="og:site_name" content="pypi-tea">

  <!-- Twitter Card -->
  <meta name="twitter:card" content="summary">
  <meta name="twitter:title" content="SBOM for {{ name }} {{ version }}">
  <meta name="twitter:description" content="Download {{ formats|join(', ') }} SBOM for {{ name }} {{ version }}.{% if has_attestation %} PEP 740 verified.{% endif %} Python supply chain transparency via TEA.">

  <script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "SoftwareSourceCode",
    "name": "{{ name }}",
    "version": "{{ version }}",
    {% if summary %}"description": {{ summary | tojson }},{% endif %}
    "programmingLanguage": "Python",
    "codeRepository": "https://pypi.org/project/{{ name }}/{{ version }}/",
    "runtimePlatform": "Python{% if requires_python %} {{ requires_python }}{% endif %}",
    "maintainer": {
      "@type": "Organization",
      "name": "sbomify",
      "url": "https://sbomify.com"
    },
    {% if has_attestation %}"additionalProperty": [
      {
        "@type": "PropertyValue",
        "name": "attestation",
        "value": "PEP 740 verified"
      }{% for wheel in wheels %}{% if wheel.attestation and wheel.attestation.status == "verified" and wheel.attestation.repository %},
      {
        "@type": "PropertyValue",
        "name": "sourceRepository",
        "value": {{ wheel.attestation.repository | tojson }}
      }{% endif %}{% endfor %}
    ],
    {% endif %}"hasPart": [
      {% set all_sboms = [] %}{% for wheel in wheels %}{% for sbom in wheel.sboms %}{% if all_sboms.append(sbom) %}{% endif %}{% endfor %}{% endfor %}
      {% for sbom in all_sboms %}{
        "@type": "DigitalDocument",
        "name": {{ sbom.path | tojson }},
        "encodingFormat": {{ sbom.media_type | tojson }},
        "url": "{{ server_root_url }}{{ sbom.download_url }}"
      }{% if not loop.last %},{% endif %}
      {% endfor %}
    ]
  }
  </script>
{% endblock %}

{% block content %}
  {% set check_icon %}<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 13l4 4L19 7"/></svg>{% endset %}
  {% set cross_icon %}<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6 18L18 6M6 6l12 12"/></svg>{% endset %}
  <article class="wrap">
    <header class="page-head">
      <nav class="breadcrumbs" aria-label="Breadcrumb">
        <a href="/packages">Packages</a>
        <span aria-hidden="true">/</span>
        <span aria-current="page">{{ name }} {{ version }}</span>
      </nav>
      <h1>SBOM for {{ name }} <span class="version">{{ version }}</span></h1>
      {% if summary %}
      <p class="lede">{{ summary }}</p>
      {% endif %}
      <div class="tags">
        {% for fmt in formats %}<span class="tag">{{ fmt }}</span>{% endfor %}
        {% if has_attestation %}
        <span class="tag tag-success">
          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/></svg>
          PEP 740 attested
        </span>
        {% endif %}
      </div>
    </header>

    <section class="section card card-body" aria-labelledby="info-heading">
      <h2 id="info-heading" class="visually-hidden">Package information</h2>
      <dl class="meta-grid">
        {% if author %}
        <div>
          <dt>Author</dt>
          <dd>{{ author }}</dd>
        </div>
        {% endif %}
        {% if license %}
        <div>
          <dt>License</dt>
          <dd>{{ license }}</dd>
        </div>
        {% endif %}
        {% if requires_python %}
        <div>
          <dt>Requires Python</dt>
          <dd>{{ requires_python }}</dd>
        </div>
        {% endif %}
        <div>
          <dt>PyPI</dt>
          <dd><a href="https://pypi.org/project/{{ name }}/{{ version }}/" class="link" rel="noopener" data-ph-event="external_link_clicked" data-ph-link-type="pypi">{{ name }} {{ version }}</a></dd>
        </div>
        {% for label, url in project_urls.items() %}
        <div>
          <dt>{{ label }}</dt>
          <dd><a href="{{ url }}" class="link break" rel="noopener nofollow" data-ph-event="external_link_clicked" data-ph-link-type="project_url" data-ph-label="{{ label }}">{{ url }}</a></dd>
        </div>
        {% endfor %}
      </dl>
    </section>

    <section class="section" aria-labelledby="sboms-heading">
      <div class="section-head">
        <h2 id="sboms-heading">Available SBOMs</h2>
        <p>Read from <code>.dist-info/sboms/</code> in each wheel.</p>
      </div>
      {% for wheel in wheels %}
      <div class="card wheel">
        <div class="card-head">
          <div class="wheel-title">
            <h3>{{ wheel.filename }}</h3>
            {% if wheel.attestation and wheel.attestation.status == "verified" %}
            <span class="tag tag-success" title="Verified by {{ wheel.attestation.publisher_kind }}{% if wheel.attestation.repository %} ({{ wheel.attestation.repository }}){% endif %}">{{ check_icon }} Attested</span>
            {% elif wheel.attestation and wheel.attestation.status == "failed" %}
            <span class="tag tag-danger" title="{{ wheel.attestation.error or 'Verification failed' }}">{{ cross_icon }} Failed</span>
            {% endif %}
          </div>
          {% if wheel.attestation and wheel.attestation.status == "verified" %}
          <div class="wheel-meta">
            {% if wheel.attestation.publisher_kind %}<span>Publisher: <b>{{ wheel.attestation.publisher_kind }}</b></span>{% endif %}
            {% if wheel.attestation.repository %}<span>Source: <b>{{ wheel.attestation.repository }}</b></span>{% endif %}
            {% if wheel.attestation.workflow %}<span>Workflow: <b>{{ wheel.attestation.workflow }}</b></span>{% endif %}
            {% if wheel.attestation.environment %}<span>Environment: <b>{{ wheel.attestation.environment }}</b></span>{% endif %}
          </div>
          {% endif %}
        </div>
        {% for sbom in wheel.sboms %}
        <div class="sbom-row">
          <div class="sbom-file">
            {% if sbom.valid is not none %}
            <span class="icon {% if sbom.valid %}ok{% else %}bad{% endif %}" title="{% if sbom.valid %}Valid{% else %}Invalid{% endif %}">
              {% if sbom.valid %}{{ check_icon }}{% else %}{{ cross_icon }}{% endif %}
              <span class="visually-hidden">{% if sbom.valid %}Valid{% else %}Invalid{% endif %}</span>
            </span>
            {% endif %}
            <div class="sbom-file-text">
              <div class="name">{{ sbom.path.split('/')[-1] }}</div>
              <div class="kind">
                {% if sbom.format %}<span>{{ sbom.format }}</span>{% endif %}
                <span>{{ sbom.media_type }}</span>
              </div>
            </div>
          </div>
          <a href="{{ sbom.download_url }}" rel="nofollow" class="btn btn-navy" download data-ph-event="sbom_download_clicked" data-ph-artifact-uuid="{{ sbom.artifact_uuid }}" data-ph-wheel="{{ wheel.filename }}" data-ph-sbom-format="{{ sbom.format_family }}" data-ph-sbom-valid="{{ sbom.valid | lower }}" data-ph-wheel-attested="{{ 'true' if wheel.attestation and wheel.attestation.status == 'verified' else 'false' }}">
            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"/></svg>
            Download
          </a>
        </div>
        {% endfor %}
      </div>
      {% endfor %}
    </section>

    <section class="section card card-body" aria-labelledby="tea-heading">
      <h2 id="tea-heading">Access via TEA</h2>
      <p class="prose-sm">Use the <a href="https://github.com/CycloneDX/transparency-exchange-api" class="link" rel="noopener">Transparency Exchange API</a> to fetch this SBOM programmatically:</p>
      <div class="code">
        <pre><code>pip install libtea
python -m libtea {{ server_root_url }} pkg:pypi/{{ name }}@{{ version }}</code></pre>
      </div>
    </section>

    <aside class="cta">
      <div>
        <h2>Manage SBOMs for your own releases</h2>
        <p>sbomify collects, shares and monitors SBOMs across every product you ship.</p>
      </div>
      <a class="btn btn-secondary" href="https://sbomify.com/" data-ph-event="sbomify_cta_clicked" data-ph-cta="learn_more" data-ph-placement="package_page">Learn more</a>
    </aside>
  </article>
{% endblock %}