fix: Use purl.bzl for a better api, add module package_metadata

MODULE.bazel

@@ -6,7 +6,7 @@ module(
 
 bazel_dep(name = "bazel_features", version = "1.21.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
-bazel_dep(name = "package_metadata", version = "0.0.7")
+bazel_dep(name = "package_metadata", version = "0.0.13")
 bazel_dep(name = "platforms", version = "0.0.11")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "toml.bzl", version = "0.4.1")

WORKSPACE

@@ -17,6 +17,17 @@ workspace(name = "rules_python")
 # Everything below this line is used only for developing rules_python. Users
 # should not copy it to their WORKSPACE.
 
+# Loaded by Starlark files (e.g. purl.bzl) that the loads below pull in, so it
+# must be defined before them.
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "package_metadata",
+    sha256 = "755bd6c8a3751982e2555d96c913ec070954ca9d01f935563392255da4ebad72",
+    strip_prefix = "package_metadata-0.0.13/metadata",
+    url = "https://github.com/bazel-contrib/supply-chain/releases/download/package_metadata-0.0.13/package_metadata-0.0.13.tar.gz",
+)
+
 # Workaround for Bazel 9 duplicate name issue in Gazelle.
 load("//:workspace_bazel9.bzl", "bazel_9_workaround")
 
@@ -85,8 +96,6 @@ load("@uv_manifest//:dist_manifest.bzl", "uv_register_toolchains")
 
 uv_register_toolchains(name = "uv")
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
 # Used for Bazel CI
 http_archive(
     name = "bazelci_rules",

python/private/py_repositories.bzl

@@ -80,9 +80,9 @@ def py_repositories(transition_settings = []):
     )
     http_archive(
         name = "package_metadata",
-        sha256 = "8f27dc7393e3f3bdc793bdc4ba36d67a63c22cc9d38cc65d3204654974ea4563",
-        strip_prefix = "supply-chain-0.0.7/metadata",
-        url = "https://github.com/bazel-contrib/supply-chain/releases/download/v0.0.7/supply-chain-v0.0.7.tar.gz",
+        sha256 = "755bd6c8a3751982e2555d96c913ec070954ca9d01f935563392255da4ebad72",
+        strip_prefix = "package_metadata-0.0.13/metadata",
+        url = "https://github.com/bazel-contrib/supply-chain/releases/download/package_metadata-0.0.13/package_metadata-0.0.13.tar.gz",
     )
 
     # Needed by rules_cc, triggered by @rules_java_prebuilt in Bazel by using @rules_cc//cc:defs.bzl

python/private/pypi/BUILD.bazel

@@ -598,6 +598,7 @@ bzl_library(
         ":whl_metadata",
         "//python/private:normalize_name",
         "//python/private:repo_utils",
+        "@package_metadata//purl:srcs",
     ],
 )
 

python/private/pypi/patch_and_extract_whl.bzl

@@ -1,5 +1,6 @@
 ""
 
+load("@package_metadata//purl:purl.bzl", "purl")
 load("//python/private:normalize_name.bzl", "normalize_name")
 load("//python/private:repo_utils.bzl", "repo_utils")
 load(":generate_whl_library_build_bazel.bzl", "generate_whl_library_build_bazel")
@@ -49,13 +50,13 @@ def _to_purl(*, index, metadata, filename):
     # https://github.com/package-url/purl-spec/blob/main/types-doc/pypi-definition.md#name-definition
     name = normalize_name(metadata.name).replace("_", "-")
 
-    qualifiers = {}
+    builder = purl.builder().type("pypi").name(name).version(metadata.version)
     if index:
-        qualifiers["repository_url"] = index
+        builder.add_qualifier("repository_url", index)
     if filename:
-        qualifiers["file_name"] = filename
+        builder.add_qualifier("file_name", filename)
 
-    return "pkg:pypi/{}@{}?{}".format(name, metadata.version, "&".join(["{}={}".format(key, val) for key, val in qualifiers.items()]))
+    return builder.build()
 
 def _remove_files(rctx, *basenames):
     paths = list(rctx.path(".").readdir())

tests/integration/whl_library/MODULE.bazel

@@ -1,6 +1,6 @@
 module(name = "integration_test")
 
-bazel_dep(name = "package_metadata", version = "0.0.7")
+bazel_dep(name = "package_metadata", version = "0.0.13")
 bazel_dep(name = "rules_python", version = "0.0.0")
 local_path_override(
     module_name = "rules_python",