From 46428ed85d599baa9572a570ce7f1603f7c52692 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Mon, 13 Apr 2026 01:59:28 +0900
Subject: [PATCH] internal/rosa/python: url pip wheel helper

This enables a cleaner higher-level helper.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 internal/rosa/nss.go    | 32 +++++++++++++++++++++++---------
 internal/rosa/python.go | 20 ++++++++++++++++++++
 2 files changed, 43 insertions(+), 9 deletions(-)

diff --git a/internal/rosa/nss.go b/internal/rosa/nss.go
index 12354de3..b2d2a8ca 100644
--- a/internal/rosa/nss.go
+++ b/internal/rosa/nss.go
@@ -83,16 +83,30 @@ func init() {
 	}
 }
 
-func init() {
-	const version = "0.4.0"
-	artifactsM[buildcatrust] = newViaPip(
-		"buildcatrust",
-		"transform certificate stores between formats",
-		version, "py3", "none", "any",
-		"k_FGzkRCLjbTWBkuBLzQJ1S8FPAz19neJZlMHm0t10F2Y0hElmvVwdSBRc03Rjo1",
-		"https://github.com/nix-community/buildcatrust/"+
-			"releases/download/v"+version+"/",
+func (t Toolchain) newBuildCATrust() (pkg.Artifact, string) {
+	const (
+		version  = "0.4.0"
+		checksum = "k_FGzkRCLjbTWBkuBLzQJ1S8FPAz19neJZlMHm0t10F2Y0hElmvVwdSBRc03Rjo1"
 	)
+	return t.newViaPip("buildcatrust", version,
+		"https://github.com/nix-community/buildcatrust/releases/"+
+			"download/v"+version+"/buildcatrust-"+version+"-py3-none-any.whl",
+		checksum), version
+}
+func init() {
+	artifactsM[buildcatrust] = Metadata{
+		f: Toolchain.newBuildCATrust,
+
+		Name:        "buildcatrust",
+		Description: "transform certificate stores between formats",
+		Website:     "https://github.com/nix-community/buildcatrust",
+
+		Dependencies: P{
+			Python,
+		},
+
+		ID: 233988,
+	}
 }
 
 func (t Toolchain) newNSSCACert() (pkg.Artifact, string) {
diff --git a/internal/rosa/python.go b/internal/rosa/python.go
index fded5dca..323ad3f9 100644
--- a/internal/rosa/python.go
+++ b/internal/rosa/python.go
@@ -1,6 +1,7 @@
 package rosa
 
 import (
+	"path"
 	"slices"
 	"strings"
 
@@ -80,6 +81,25 @@ func init() {
 	}
 }
 
+// newViaPip installs a pip wheel from a url.
+func (t Toolchain) newViaPip(
+	name, version, url, checksum string,
+	extra ...PArtifact,
+) pkg.Artifact {
+	return t.New(name+"-"+version, 0, t.AppendPresets(nil,
+		slices.Concat(P{Python}, extra)...,
+	), nil, nil, `
+pip3 install \
+	--no-index \
+	--prefix=/system \
+	--root=/work \
+	'/usr/src/`+path.Base(url)+`'
+`, pkg.Path(AbsUsrSrc.Append(path.Base(url)), false, pkg.NewHTTPGet(
+		nil, url,
+		mustDecode(checksum),
+	)))
+}
+
 // newViaPip is a helper for installing python dependencies via pip.
 func newViaPip(
 	name, description, version, interpreter, abi, platform, checksum, prefix string,