GeezerVison is showing github.com — Preserve pip patch markers and hash checks by mikolalysenko · Pull Request #237 · SocketDev/socket-patch
Conversation
LLM Description written by Codex:gpt-6-astra
Pip ignores an environment marker placed after a per-requirement --hash option. Vendored requirements now put the marker before the hash, so python_version < "2" skips the wheel on Python 3 and a matching marker installs it.
Hosted requirements now remove inline comments before preserving the marker. Previously, django==3.2.3 ; python_version >= "2" # explanation became a URL whose generated --hash was inside the comment, disabling the intended hash check. Reruns remain stable.
Validation:
- 34 existing PyPI requirements wiring and revert tests pass.
- Both hosted marker rewrite tests pass, including the inline-comment regression and rerun check.
- A new integration test runs the actual CLI and real pip with true/false markers, checks patched
six bytes, and verifies byte-for-byte revert.
- Live hosted CLI output installs Django 3.2.3 with pip 26.2.1 and
--require-hashes after the comment fix.
These bugs were found while backtesting hosted and vendored pip annotations in https://github.com/SocketDev/depscan/pull/26138. The completed matrix checks all 16 published pip majors; supported installs verify the patched Django file hashes.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Keep environment markers ahead of hash options in vendored
requirements. Strip hosted inline comments before appending hashes
so pip enforces them. Cover marker evaluation with real installs.
Assisted-by: Codex:gpt-6-astra
Uh oh!
There was an error while loading. Please reload this page.
Mikola Lysenko (mikolalysenko)
added a commit
that referenced
this pull request
Sep 15, 2026
Resolve the conflict in patch/redirect/mod.rs: main (#237) patched the
inline requirements.txt rewriter to strip trailing inline comments so
the appended --hash is not swallowed into the comment; this branch had
already replaced that body with redirect::requirements::rewrite, which
splits the comment off outside quotes and re-appends it after the hash.
Keep the delegation and update #237's test to expect the preserved
comment (hash still active, user note kept).
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.