fix: Fetch package metadata from private artifactory if specified

If a private repository is specified, the package metadata should be
fetched from it, not from pypi.org.

Fixes aboutcode-org#260.

Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.com>

Author: nnobelis

src/python_inspector/api.py

@@ -296,7 +296,7 @@ def resolve_dependencies(
     async def gather_pypi_data():
         async def get_pypi_data(package):
             data = await get_pypi_data_from_purl(
-                package, repos=repos, environment=environment, prefer_source=prefer_source
+                package, repos=repos, environment=environment, prefer_source=prefer_source, index_url=index_url
             )
 
             if verbose:

src/python_inspector/package_data.py

@@ -27,7 +27,7 @@
 
 
 async def get_pypi_data_from_purl(
-    purl: str, environment: Environment, repos: List[PypiSimpleRepository], prefer_source: bool
+    purl: str, environment: Environment, repos: List[PypiSimpleRepository], prefer_source: bool, index_url: str
 ) -> Optional[PackageData]:
     """
     Generate `Package` object from the `purl` string of pypi type
@@ -43,7 +43,9 @@ async def get_pypi_data_from_purl(
     version = parsed_purl.version
     if not version:
         raise Exception("Version is not specified in the purl")
-    base_path = "https://pypi.org/pypi"
+
+    base_path = index_url.removesuffix("/simple") + "/pypi" if index_url else  "https://pypi.org/pypi"
+
     api_url = f"{base_path}/{name}/{version}/json"
 
     from python_inspector.utils import get_response_async