warehouse: PEP 740 models

[woodruffw]

This is a breakout from #16624,
to reduce the complexity/headache of zippered reverts.

Signed-off-by: William Woodruff william@trailofbits.com

[DarkaMaul]

I added a simple test and Factory in 34ec661 that can easily be reverted if needed.

However, just thinking out loud here, I think we should also have a version column in the Provenance that contains the Provenance object version.

The current design forces us to keep a forward-compatible version of the Provenance object to use the opaque JSON object with a model_validate_json call.
Having a separate field allows us to deviate from the original design and handle the deserialization logic without resorting to try/catch.

[woodruffw]

However, just thinking out loud here, I think we should also have a version column in the Provenance that contains the Provenance object version.

The current design forces us to keep a forward-compatible version of the Provenance object to use the opaque JSON object with a model_validate_json call.

I might be under-thinking it, but I don't think this will be an issue -- if we need to roll the provenance version forwards, we can always do something like TypeAdapter(Provenance | ProvenanceV2).validate_json(...) to avoid needing to explicitly test each version.

(But also, if we need to bump the version, we can always add a version column with default=1. So I don't think we're excessively constraining ourselves at the moment.)

[woodruffw]

Modeling these fields accurately requires access to the services that we're defining in #16624, so I'm inclined to punt on adding the factory in this PR 🙂

I'm going to save a patch for this and apply it on top of #16624, however.