GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||
GeezerVison is showing github.com — Fix uv pylock wiring wheels under no-binary (#1603) by mikolalysenko · Pull Request #1672 · SocketDev/socket-patch Conversation
|
| Issue lane | Test | Without fix | With fix |
|---|---|---|---|
#1603 hosted pylock (header flag, :all:, [pip]/top-level/pyproject settings, parent settings; --no-config + settings; controls incl. :none:, Pipenv, non-uv lock) |
patch::redirect::python_lock_warning_tests::pylock_no_binary_refuses_a_wheel_uv_would_not_install |
FAILED | ok |
#1603 vendored pylock (same matrix, parent uv.toml, Pipenv path) |
vendor::pypi_lock::tests::pylock_no_binary_refuses_before_writing |
FAILED | ok |
| #1603 CLI, both modes, writes nothing | mode_migration_pypi::uv_pylock_no_binary_is_refused_in_both_modes |
FAILED (hosted pinned 1) | ok |
"Without fix" means the check was short-circuited to None.
Local runs (Linux, uv 0.11.32):
cargo fmt --all -- --check and cargo clippy --workspace --all-features -- -D warnings: clean.cargo test -p socket-patch-core -p socket-patch-cli --all-features --lib: CLI 925 ok. Core 6641 ok and 4 failed. The 4 are permission-injection tests (copy_tree relax_loop, vlt_heal unremovable lock, poetry/requirements wire-write failure) that can't fail when run as root, which this sandbox is. This change doesn't touch them.--test mode_migration_pypi: 68 ok. --test e2e_redirect_uv_build --include-ignored: 23 ok. --test e2e_vendor_pypi_build --include-ignored: 55 ok.cargo test --workspace ran out of the sandbox's disk allowance while building every integration binary, so CI covers the rest.On a33ca5e, coverage failed in upstream_restore_golden::pip_compile_pylock_build_filters_refuse_the_filtered_entry. That test built its hosted lock by running the hosted rewrite on a --no-binary lock, which the rewrite now refuses. It now wires the plain lock first and then adds the flag or setting, which is how such a lock reaches the restore in real use. All 31 core integration binaries pass locally (0656163).
Fixed:
:none: was ignored--no-binary parsing (now one binary_flag_covers, also used by the restore side)Not changed:
uv pip sync, and the uv project lane from Fix uv scans wiring wheels under no-binary (#1603) #1649 behaves the same way (pypi_uv_no_binary is not supersedable).https://claude.ai/code/session_015NdfJ6nfxCRsW1FVjrkuPm
Generated by Claude Code
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Assisted-by: Claude Code:claude-opus-5-5
A PEP 751 lock from `uv pip compile --no-binary six` records six with
only its sdist, and `uv pip` installs six only from an sdist under that
flag or a uv `no-binary` setting. Both scan modes still swapped in the
patched wheel and exited 0, so the matching `uv pip sync` then failed
("marked as `--no-binary` but is itself a binary distribution").
Hosted and vendored scans now refuse such a lock before writing
anything when the `uv pip compile` command line in its header passes
`--no-binary` naming the package or `:all:`, or the root's uv.toml /
`[tool.uv]` covers it through `[pip] no-binary`, `no-binary = true` or
`no-binary-package`. Checked against uv 0.11.32: `[pip]` and top-level
settings add up, and `no-binary = false` turns off only the top-level
package list. Locks written by other tools are left alone.
Fixes #1603
Assisted-by: Claude Code:claude-opus-5-5
Review follow-ups for the pylock no-binary refusal: - uv takes `uv pip`'s settings from the nearest parent directory when the project root sets none, so a parent `uv.toml` or `[tool.uv]` with `no-binary` now refuses too, as it already does for uv projects and scripts. - Pipenv installs the pylocks it reads and ignores uv settings, so those locks keep Pipenv's own refusal (hosted) or are wired as before (vendored) instead of getting a uv error. - `--no-binary :none:` clears the earlier values, as in uv, so a lock compiled with `--no-binary :all: --no-binary :none:` is not refused. The restore side now reads the flag the same way. - The root settings are read once per run instead of once per lock. Refs #1603 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
--no-config skips install settings
Or push these changes by commenting:
@cursor push cecfabd11a
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs --- a/crates/socket-patch-core/src/patch/redirect/mod.rs +++ b/crates/socket-patch-core/src/patch/redirect/mod.rs @@ -26365,6 +26365,8 @@ ), // `:none:` clears only the values before it. (" --no-binary :none: --no-binary six", &[]), + // `uv pip compile --no-config` skips settings, but sync still applies them. + (" --no-config", &[("uv.toml", "no-binary = true\n")]), ]; for (flags, extra) in refusals { let result = run(flags, extra); @@ -26393,10 +26395,8 @@ warning.detail ); } - // Another package's flag or setting, no-build, a list turned off by - // no-binary = false, a uv.toml replacing pyproject's settings, and - // settings `uv pip compile --no-config` never read leave the wheel - // installable. + // Another package's flag or setting, no-build, or a list turned off by + // no-binary = false leave the wheel installable. let wired: &[(&str, &[(&str, &str)])] = &[ ("", &[]), (" --no-binary idna", &[]), @@ -26419,7 +26419,6 @@ ), ], ), - (" --no-config", &[("uv.toml", "no-binary = true\n")]), (" --no-binary :all: --no-binary :none:", &[]), // The root's own settings stop the lookup above it. ( diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs b/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs --- a/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs +++ b/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs @@ -737,9 +737,6 @@ "the lock's `uv pip compile --no-binary` covers {name}, {consequence}" )); } - if command.contains(&"--no-config") { - return None; - } } let (path, key) = settings_no_binary(settings, &name)?; Some(format!( diff --git a/crates/socket-patch-core/src/vendor/pypi_lock.rs b/crates/socket-patch-core/src/vendor/pypi_lock.rs --- a/crates/socket-patch-core/src/vendor/pypi_lock.rs +++ b/crates/socket-patch-core/src/vendor/pypi_lock.rs @@ -1789,6 +1789,8 @@ pyproject("[tool.uv]\nno-binary-package = [\"two\"]\n"), )), ), + // `uv pip compile --no-config` skips settings, but sync still applies them. + (" --no-config", Some(("uv.toml", "no-binary = true\n"))), ] { let Err(error) = load(pylock(flags), config).await else { panic!("{flags:?} with {config:?} must refuse"); @@ -1797,10 +1799,8 @@ assert!(error.1.starts_with("pylock.toml: "), "{}", error.1); assert!(error.1.contains("only from an sdist"), "{}", error.1); } - // Another package's flag or setting, no-build, a list turned off by - // no-binary = false, a uv.toml that replaces pyproject's settings, - // and settings `uv pip compile --no-config` never read leave the - // wheel installable. + // Another package's flag or setting, no-build, or a list turned off by + // no-binary = false leave the wheel installable. for (flags, config) in [ ("", None), (" --no-binary six", None), @@ -1813,7 +1813,6 @@ "no-binary = false\nno-binary-package = [\"two\"]\n", )), ), - (" --no-config", Some(("uv.toml", "no-binary = true\n"))), (" --no-binary :all: --no-binary :none:", None), ] { if let Err(error) = load(pylock(flags), config).await {
You can send follow-ups to the cloud agent here.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
The uv pylock restore test made its hosted lock by running the hosted rewrite on a lock already under `--no-binary`. That rewrite now refuses such a lock, so the test wires the plain lock first and then adds the flag or setting. That is how such a lock reaches the restore in real use: it was wired before this check existed, or filtered later. Refs #1603 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
`uv pip compile --no-config` only keeps settings files away from the compile. The later `uv pip sync` still reads uv.toml, so a `no-binary` setting there still makes it refuse the patched wheel. The pylock check now reads the settings whatever the header says. Refs #1603 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Ready for review at Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Final review briefWhat it does. Before it writes a patched wheel into a uv-made PEP 751 pylock, socket-patch now checks whether uv would refuse to install that wheel, and refuses first (finishes #1603). It refuses in two cases:
Hosted mode marks the patch refused with Risk: low. The change only adds refusals; it never writes anything new.
Look here
Verified
Changes I made: none. Open questions (not blocking)
Auto-merge (squash) is armed, so approving sends it straight to the merge queue. Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
uv reads `[pip] no-binary = [":all:", ":none:"]` in order, the same way it reads repeated `--no-binary` flags: `:none:` clears the values before it, so `uv pip sync` installs the patched wheel (checked with uv 0.11.32). The pylock check treated any `:all:` in the list as covering the package and refused a lock that would install fine. Both the list and the header flags now go through one ordered reader. Refs #1603 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
[agent] Fixed the open question from the final review brief in 6ef706e. With uv 0.11.32, Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Stale Bugbot comment from a previous run.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
In a uv workspace member, `uv pip` reads the workspace root's settings and never the member's own `[tool.uv]`, so a root-level no-binary setting would break a member pylock that the no-binary check reads from the member. Both modes already refuse a run in a governed member before reading any lock (#1138), so that pylock is never wired. This test pins that. Refs #1603 Assisted-by: Claude Code:claude-opus-5-5
|
BugBot review Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 02faef7. Configure here.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
[final reviewer] Turned auto-merge off. My last brief covered Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Final review brief (head
|
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Still Ready for review at the new head (burn-down agent). The earlier label comment covered
Generated by Claude Code |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
Hosted and vendored uv scans wire a patched wheel into a project that setsno-binary / no-binary-package for that package, so every later uv sync fails ("marked as --no-binary but is itself a binary distribution")
There was an error while loading. Please reload this page.