nordisk/holger

holger-znippy-python-repository — crate card

Reverse-engineered (from source — verify, don't trust the name)

• One-line pitch: znippy-archive-backed Python (pip) repository — serves wheels/sdists behind a PEP 503 simple index.
• Does: PipRepoZnippy implements RepositoryBackendTrait, exposing the PEP 503 simple index and serving package files from a .znippy (via typed view/reader). Because the simple index reflects attacker-influenced values (requested package name from the URL, package/file names from archive contents) into HTML, html_escape escapes the five significant characters for both text and attribute contexts (M10 reflected-injection guard).
• Key deps: traits, znippy-common (ZnippyArchive/ZnippyReader), anyhow.
• Shape: lib, single lib.rs. Shared znippy-backend pattern.
• Observed role in the workspace: Registered in server-lib as repository-znippy-python; also used by bench-scenarios (the Python-wheel workload) and agent-cli tests. Python is one of the "working" formats.

Fill in (one line each — only the human knows these)

• Primary consumer(s):
• Why it exists (vs the obvious alternative):
• Hard constraint (airgap / no-C-deps / no-FFI / pure-Rust / etc.):
• Release cadence & independence (rides a parent? own repo someday?):
• Status (production / prototype / experimental / stubbed):
• Must-NOT-change invariant:
• Biggest known gap or TODO:
• Anything a newcomer would get wrong about it: