#Calunga

#The Problem

• PyPI wheels are pre-built binaries - you trust the uploader

• No guarantee of source-to-binary correspondence

• Supply chain attacks on popular packages (typosquatting, account takeover)

• No embedded SBOM or provenance metadata

• Enterprise compliance requires verifiable supply chains

#Calunga's Answer

• Build from source - 17 C/C++ libs + Python compiled in trusted environments

• SBOM in every wheel - CycloneDXSBOM standard. Fromager generates CycloneDX SBOMs embedded as redhat.spdx.json, listing all components and their provenance. redhat.spdx.json

• 6 security scans per build (Clair, Snyk, ClamAV, Coverity, ShellCheck, Unicode)

• Enterprise Contract PolicyKonflux policy framework. Validates that builds meet Red Hat compliance requirements (provenance, signatures, SBOM presence) before allowing releases. - Red Hat compliance enforcement

• Attestation & signing - cosignSigstore tool for signing and verifying container images and artifacts. Used for attestation and provenance in the release pipeline. provenance

• Hermetic builds - optional zero-network mode

#pip Configuration

# pip.conf (venv/, ~/.config/pip/, or /etc/pip.conf)
[global]
index-url = https://<username>:<password>@packages.redhat.com/trusted-libraries/python/

# Install packages
python3.12 -m venv venv && source venv/bin/activate
pip install numpy
pip install --only-binary=:all: -r requirements.txt

#uv Configuration

# pyproject.toml
[[tool.uv.index]]
name = "trusted-libraries"
url = "https://packages.redhat.com/trusted-libraries/python"
default = true

# Export credentials
export UV_INDEX_INTERNAL_PROXY_USERNAME=<username>
export UV_INDEX_INTERNAL_PROXY_PASSWORD=<password>

#calunga-project-plumbing

Build Infrastructure

• Container images (builder, utils)
• TektonKubernetes-native CI/CD framework. Pipelines defined as YAML CRDs (Tasks, Pipelines, PipelineRuns). Each step runs in its own container. Used here via Konflux. tasks & pipelines
• Build scripts (FromagerPython wheel build orchestrator. Resolves full dependency graph from source distributions, builds each package in order, and embeds CycloneDX SBOMs. Ensures wheels are built from source - not downloaded pre-built from PyPI., auditwheelPost-build compliance tool. Inspects Linux wheels for shared library dependencies, bundles required .so files into the wheel, and relabels it with the correct manylinux platform tag.)
• SBOM patching & artifact collection

#calunga-project-index

Package Registry

• 1,547 onboarded package JSONs
• Version detection (12h cron)
• Auto-PR creation & merge
• KonfluxRed Hat's enterprise CI/CD platform built on Tekton. Adds Enterprise Contract Policy enforcement, release management, nudge-based auto-updates, and OCI Trusted Artifacts for secure data passing between tasks. release pipeline

#npm-registry

npm Package Onboarding

• npm package definitions (packages/)
• Lint & identification scripts (hack/)
• Tekton build pipeline (.tekton/)

#check-source-origin

Source Verification

• Python CLI: verify published sdists match VCS source
• Commands: resolve, download, diff, verify

#dfd (Dumpster Fire Diving)

CI Failure Analysis

• AI-powered failure analysis (FastAPI + Claude)
• React dashboard
• KubeArchive collector

#bounty-board

Package Prioritization

• Package prioritization tracker
• Python scripts + GitHub Actions
• Static HTML dashboard

#wheel-patcher

Wheel Post-Processing

• Patch wheel files (add SBOM, license files)
• Zero runtime dependencies

#Build Resources

• Memory: 20GB for wheel builds
• Task: build-python-wheels-oci-ta
• Image: pinned by SHA256 digest

#Output

• IMAGE_URL - built wheel OCI artifact
• IMAGE_DIGEST - SHA256 of artifact
• GIT_COMMIT - source commit hash

#Input

python hack/onboard_package.py flask

#Output: flask.json

{
    "version": "3.1.1",
    "ignored_versions": ["0.1", "0.2", ...]
}

#Attestation Flow

• SHA256 hash computed for each wheel
• SLSA v0.2 provenance predicate generated
• Signed with cosign (key from K8s secret)
• DSSE envelope converted to PEP 740 format
• Attestation uploaded alongside wheel

#Upload Logic

• Skip if wheel already exists in Pulp
• Skip if attestation file missing
• Fail if any upload errors or missing attestations
• Summary report: uploaded / skipped / failed counts

#Log Forwarding

A separate GitHub Actions workflow (forward_logs.yml) triggers after every version-check run:

#PR Tracking

• Automated version PRs labeled "automated build"
• Konflux nudge PRs labeled "konflux-nudge"
• Branch naming: update-<package>==<version>
• All PRs auto-merged with rebase strategy

#Build Artifacts

• PR builds expire after 5 days
• Push builds permanent (tagged by git revision)
• All images referenced by SHA256 digest

#Python Versions

#Architectures

#Manylinux Target

Primary: manylinux_2_28 (glibc 2.28+, RHEL 8+). Some wheels also carry manylinux_2_27 compatibility.