python.mk: Introduce PEP517_PKGNAME

[lwhsu]

Summary

python.mk: Introduce PEP517_PKGNAME

Like PYDISTUTILS_PKGNAME, used when PORTNAME is different from the name
of the python pacakge.

This is developed when I am updating databases/py-pymysql:
https://gist.github.com/lwhsu/7ed5a346faf96236a07dc288400daddb

[vishwin]

Not a good idea. I deliberately left something like this out for conformance and security/integrity reasons.

While name normalisation is the current rule, for compatibility reasons of PyPA's admission, tools "must be prepared to accept . (FULL STOP) and uppercase letters", and build (and gpep517) produce wheels in mixed case. While normalising full stops are easy enough, mixed case is a different problem. The wheel build process does not allow naming the wheel file arbitrarily, instead following the convention without opportunity for deviation. Generating the binary wheel then installing into STAGEDIR by supplying that exact file name is a security and integrity layer, unlike USE_PYTHON=distutils which lacks anything of this sort.

PyPI, like other language package repositories that have minimal at best curation, have and will continue to fall victim to security and integrity lapses like typo-squatting. Since we strongly encourage PYPI, we correspondingly need to ensure our own tree's security and integrity, and supplying the correct file name, matching the package name, without deviation, every build, is an easy step towards that. It is the package author/maintainer's sole discretion on what they want their package to be called, and we need to respect that.

[lwhsu]

I'm not sure if I understand these. This is not renaming whl file, but following the whl file the PYPI module wants.

[vishwin]

And PORTNAME should match that, without deviation.