shortcutxl 0.3.76 → 0.3.78

package/xll/python/Lib/site-packages/pip/_internal/index/package_finder.py

@@ -12,8 +12,6 @@ from collections.abc import Iterable
 from dataclasses import dataclass
 from typing import (
     TYPE_CHECKING,
-    Optional,
-    Union,
 )
 
 from pip._vendor.packaging import specifiers
@@ -49,15 +47,15 @@ from pip._internal.utils.packaging import check_requires_python
 from pip._internal.utils.unpacking import SUPPORTED_EXTENSIONS
 
 if TYPE_CHECKING:
-    from typing_extensions import TypeGuard
+    from typing import TypeGuard
 
 __all__ = ["FormatControl", "BestCandidateResult", "PackageFinder"]
 
 
 logger = getLogger(__name__)
 
-BuildTag = Union[tuple[()], tuple[int, str]]
-CandidateSortingKey = tuple[int, int, int, _BaseVersion, Optional[int], BuildTag]
+BuildTag = tuple[()] | tuple[int, str]
+CandidateSortingKey = tuple[int, int, int, _BaseVersion, int | None, BuildTag]
 
 
 def _check_link_requires_python(
@@ -664,6 +662,9 @@ class PackageFinder:
             BestCandidateResult,
         ] = {}
 
+        # projects for which a link is locked from a pylock
+        self._locked_links: dict[NormalizedName, Link] = {}
+
     # Don't include an allow_yanked default value to make sure each call
     # site considers whether yanked releases are allowed. This also causes
     # that decision to be made explicit in the calling code, which helps
@@ -724,10 +725,18 @@ class PackageFinder:
     def index_urls(self) -> list[str]:
         return self.search_scope.index_urls
 
+    @property
+    def refresh_package(self) -> set[str]:
+        return self._link_collector.session.refresh_package
+
     @property
     def proxy(self) -> str | None:
         return self._link_collector.session.pip_proxy
 
+    @property
+    def no_proxy_env(self) -> bool:
+        return self._link_collector.session.pip_no_proxy_env
+
     @property
     def trusted_hosts(self) -> Iterable[str]:
         for host_port in self._link_collector.session.pip_trusted_origins:
@@ -851,7 +860,9 @@ class PackageFinder:
             "Fetching project page and analyzing links: %s",
             project_url,
         )
-        index_response = self._link_collector.fetch_response(project_url)
+        index_response = self._link_collector.fetch_response(
+            project_url, package_name=link_evaluator.project_name
+        )
         if index_response is None:
             return []
 
@@ -868,7 +879,8 @@ class PackageFinder:
     def find_all_candidates(self, project_name: str) -> list[InstallationCandidate]:
         """Find all available InstallationCandidate for project_name
 
-        This checks index_urls and find_links.
+        This checks index_urls and find_links, unless a locked link is known
+        for that project.
         All versions found are returned as an InstallationCandidate list.
 
         See LinkEvaluator.evaluate_link() for details on which files
@@ -879,6 +891,23 @@ class PackageFinder:
 
         link_evaluator = self.make_link_evaluator(project_name)
 
+        if locked_link := self._locked_links.get(canonicalize_name(project_name)):
+            # If a locked link is known for that project, do not check
+            # index_urls nor find_links. We don't use get_install_candidate here,
+            # because if a locked link is unsupported (due to format control,
+            # release control or otherwise), we want to error out immediately
+            # instead of ignoring it.
+            result, detail = link_evaluator.evaluate_link(locked_link)
+            if result != LinkType.candidate:
+                raise InstallationError(
+                    f"Could not install locked package {project_name!r} "
+                    f"from {locked_link.comes_from!r}: {detail}"
+                )
+            self._all_candidates[project_name] = [
+                InstallationCandidate(project_name, detail, locked_link, locked=True)
+            ]
+            return self._all_candidates[project_name]
+
         collected_sources = self._link_collector.collect_sources(
             project_name=project_name,
             candidates_from_page=functools.partial(
@@ -1068,6 +1097,16 @@ class PackageFinder:
         )
         raise BestVersionAlreadyInstalled
 
+    def add_locked_link(self, project_name: NormalizedName, locked_link: Link) -> None:
+        assert not self._all_candidates
+        if project_name in self._locked_links:
+            raise InstallationError(
+                f"Multiple locked links provided for {project_name}: "
+                f"{self._locked_links[project_name]} and {locked_link}"
+            )
+
+        self._locked_links[project_name] = locked_link
+
 
 def _find_name_version_sep(fragment: str, canonical_name: str) -> int:
     """Find the separator's index based on the package's canonical name.

package/xll/python/Lib/site-packages/pip/_internal/index/sources.py

@@ -4,8 +4,7 @@ import logging
 import mimetypes
 import os
 from collections import defaultdict
-from collections.abc import Iterable
-from typing import Callable
+from collections.abc import Callable, Iterable
 
 from pip._vendor.packaging.utils import (
     InvalidSdistFilename,

package/xll/python/Lib/site-packages/pip/_internal/locations/_sysconfig.py

@@ -4,7 +4,7 @@ import logging
 import os
 import sys
 import sysconfig
-from typing import Callable
+from collections.abc import Callable
 
 from pip._internal.exceptions import InvalidSchemeCombination, UserInstallationInvalid
 from pip._internal.models.scheme import SCHEME_KEYS, Scheme

package/xll/python/Lib/site-packages/pip/_internal/locations/base.py

@@ -41,7 +41,7 @@ def change_root(new_root: str, pathname: str) -> str:
             return os.path.join(new_root, pathname[1:])
 
     elif os.name == "nt":
-        (drive, path) = os.path.splitdrive(pathname)
+        drive, path = os.path.splitdrive(pathname)
         if path[0] == "\\":
             path = path[1:]
         return os.path.join(new_root, path)

package/xll/python/Lib/site-packages/pip/_internal/metadata/base.py

@@ -14,7 +14,6 @@ from typing import (
     Any,
     NamedTuple,
     Protocol,
-    Union,
 )
 
 from pip._vendor.packaging.requirements import Requirement
@@ -29,14 +28,21 @@ from pip._internal.models.direct_url import (
     DirectUrl,
     DirectUrlValidationError,
 )
-from pip._internal.utils.compat import stdlib_pkgs  # TODO: Move definition here.
 from pip._internal.utils.egg_link import egg_link_path_from_sys_path
 from pip._internal.utils.misc import is_local, normalize_path
 from pip._internal.utils.urls import url_to_path
 
 from ._json import msg_to_json
 
-InfoPath = Union[str, pathlib.PurePath]
+# packages in the stdlib that may have installation metadata, but should not be
+# considered 'installed'.  this theoretically could be determined based on
+# dist.location (py27:`sysconfig.get_paths()['stdlib']`,
+# py26:sysconfig.get_config_vars('LIBDEST')), but fear platform variation may
+# make this ineffective, so hard-coding
+stdlib_pkgs = {"python", "wsgiref", "argparse"}
+
+
+InfoPath = str | pathlib.PurePath
 
 logger = logging.getLogger(__name__)
 
@@ -152,14 +158,13 @@ class BaseDistribution(Protocol):
         """
         raise NotImplementedError()
 
-    @property
+    @functools.cached_property
     def editable_project_location(self) -> str | None:
         """The project location for editable distributions.
 
         This is the directory where pyproject.toml or setup.py is located.
         None if the distribution is not installed in editable mode.
         """
-        # TODO: this property is relatively costly to compute, memoize it ?
         direct_url = self.direct_url
         if direct_url:
             if direct_url.is_local_editable():

package/xll/python/Lib/site-packages/pip/_internal/metadata/importlib/_dists.py

@@ -177,7 +177,7 @@ class Distribution(BaseDistribution):
 
     @property
     def raw_version(self) -> str:
-        return self._dist.version
+        return self.metadata["Version"]
 
     def is_file(self, path: InfoPath) -> bool:
         return self._dist.read_text(str(path)) is not None

package/xll/python/Lib/site-packages/pip/_internal/metadata/importlib/_envs.py

@@ -7,7 +7,6 @@ import pathlib
 import sys
 import zipfile
 from collections.abc import Iterator, Sequence
-from typing import Optional
 
 from pip._vendor.packaging.utils import (
     InvalidWheelFilename,
@@ -24,6 +23,10 @@ from ._dists import Distribution
 
 logger = logging.getLogger(__name__)
 
+# Used to avoid emitting duplicate invalid distribution metadata warnings for
+# the same dist-info directory.
+_warned_bad_metadata: set[BasePath | None] = set()
+
 
 def _looks_like_wheel(location: str) -> bool:
     if not location.endswith(WHEEL_EXTENSION):
@@ -50,7 +53,7 @@ class _DistributionFinder:
     installations as well. It's useful feature, after all.
     """
 
-    FoundResult = tuple[importlib.metadata.Distribution, Optional[BasePath]]
+    FoundResult = tuple[importlib.metadata.Distribution, BasePath | None]
 
     def __init__(self) -> None:
         self._found_names: set[NormalizedName] = set()
@@ -69,7 +72,9 @@ class _DistributionFinder:
             try:
                 name = get_dist_canonical_name(dist)
             except BadMetadata as e:
-                logger.warning("Skipping %s due to %s", info_location, e.reason)
+                if info_location not in _warned_bad_metadata:
+                    logger.warning("Skipping %s due to %s", info_location, e.reason)
+                    _warned_bad_metadata.add(info_location)
                 continue
             if name in self._found_names:
                 continue

package/xll/python/Lib/site-packages/pip/_internal/models/candidate.py

@@ -13,11 +13,15 @@ class InstallationCandidate:
     name: str
     version: Version
     link: Link
+    locked: bool
 
-    def __init__(self, name: str, version: str, link: Link) -> None:
+    def __init__(
+        self, name: str, version: str, link: Link, locked: bool = False
+    ) -> None:
         object.__setattr__(self, "name", name)
         object.__setattr__(self, "version", parse_version(version))
         object.__setattr__(self, "link", link)
+        object.__setattr__(self, "locked", locked)
 
     def __str__(self) -> str:
         return f"{self.name!r} candidate (version {self.version} at {self.link})"

package/xll/python/Lib/site-packages/pip/_internal/models/link.py

@@ -8,12 +8,12 @@ import os
 import posixpath
 import re
 import urllib.parse
-import urllib.request
 from collections.abc import Mapping
 from dataclasses import dataclass
 from typing import (
     Any,
     NamedTuple,
+    NewType,
 )
 
 from pip._internal.exceptions import InvalidEggFragment
@@ -31,6 +31,49 @@ from pip._internal.utils.urls import path_to_url, url_to_path
 logger = logging.getLogger(__name__)
 
 
+# A single path component: percent-decoded once and reduced to a basename, so it
+# contains no path separator and is not a ``.`` or ``..`` reference. The empty
+# string means "no component".
+PathComponent = NewType("PathComponent", str)
+
+
+def _to_path_component(name: str) -> PathComponent:
+    """Reduce ``name`` to a single path component, or ``""`` if it has none.
+
+    ``os.path.basename`` drops any directory part, drive letter, or separator;
+    a ``.``, ``..``, or empty result is not a component and becomes ``""``.
+    """
+    name = os.path.basename(name)
+    if name in ("", os.curdir, os.pardir):
+        return PathComponent("")
+
+    return PathComponent(name)
+
+
+def as_path_component(name: str) -> PathComponent:
+    """Like ``_to_path_component`` but reject the empty result.
+
+    Use where a file is about to be written, so a missing name is an error
+    rather than a silent fallback to the directory itself.
+    """
+    component = _to_path_component(name)
+    if not component:
+        raise ValueError(f"Unexpected file name derived from URL: {name!r}")
+
+    return component
+
+
+def join_within_directory(directory: str, component: PathComponent) -> str:
+    """Join a single path ``component`` onto ``directory``.
+
+    ``component`` is a :data:`PathComponent`, so by type it has no separator and
+    is not a ``.`` or ``..`` reference; the result can never escape ``directory``.
+    Requiring ``PathComponent`` rather than ``str`` lets the type checker enforce
+    at the call site that the name was reduced to a safe component beforehand.
+    """
+    return os.path.join(directory, component)
+
+
 # Order matters, earlier hashes have a precedence over later hashes for what
 # we will pick to use.
 _SUPPORTED_HASHES = ("sha512", "sha384", "sha256", "sha224", "sha1", "md5")
@@ -125,6 +168,8 @@ def _clean_file_url_path(part: str) -> str:
     Clean the first part of a URL path that corresponds to a local
     filesystem path (i.e. the first part after splitting on "@" characters).
     """
+    import urllib.request
+
     # We unquote prior to quoting to make sure nothing is double quoted.
     # Also, on Windows the path part might contain a drive letter which
     # should not be quoted. On Linux where drive letters do not
@@ -423,18 +468,13 @@ class Link:
         return redact_auth_from_url(self.url)
 
     @property
-    def filename(self) -> str:
-        path = self.path.rstrip("/")
-        name = posixpath.basename(path)
-        if not name:
-            # Make sure we don't leak auth information if the netloc
-            # includes a username and password.
-            netloc, user_pass = split_auth_from_netloc(self.netloc)
-            return netloc
-
-        name = urllib.parse.unquote(name)
-        assert name, f"URL {self._url!r} produced no filename"
-        return name
+    def filename(self) -> PathComponent:
+        name = _to_path_component(posixpath.basename(self.path.rstrip("/")))
+        if name:
+            return name
+
+        # No component in the path; fall back to the netloc, dropping any auth.
+        return _to_path_component(split_auth_from_netloc(self.netloc)[0])
 
     @property
     def file_path(self) -> str:

package/xll/python/Lib/site-packages/pip/_internal/network/auth.py

@@ -6,6 +6,7 @@ providing credentials in the context of network requests.
 
 from __future__ import annotations
 
+import json
 import logging
 import os
 import shutil
@@ -118,34 +119,48 @@ class KeyRingCliProvider(KeyRingBaseProvider):
         self.keyring = cmd
 
     def get_auth_info(self, url: str, username: str | None) -> AuthInfo | None:
-        # This is the default implementation of keyring.get_credential
-        # https://github.com/jaraco/keyring/blob/97689324abcf01bd1793d49063e7ca01e03d7d07/keyring/backend.py#L134-L139
-        if username is not None:
-            password = self._get_password(url, username)
-            if password is not None:
-                return username, password
-        return None
+        return self._get_creds(url, username)
 
     def save_auth_info(self, url: str, username: str, password: str) -> None:
         return self._set_password(url, username, password)
 
-    def _get_password(self, service_name: str, username: str) -> str | None:
-        """Mirror the implementation of keyring.get_password using cli"""
+    def _get_creds(self, service_name: str, username: str | None) -> AuthInfo | None:
+        """Mirror the implementation of keyring.get_credential using cli"""
         if self.keyring is None:
             return None
 
-        cmd = [self.keyring, "get", service_name, username]
+        cmd = [self.keyring, "--mode=creds", "--output=json", "get", service_name]
+        if username is not None:
+            cmd.append(username)
+
         env = os.environ.copy()
         env["PYTHONIOENCODING"] = "utf-8"
-        res = subprocess.run(
+        res = subprocess.run(  # noqa: UP022
             cmd,
             stdin=subprocess.DEVNULL,
             stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
             env=env,
         )
+
+        # Detect if the user is running an outdated version of keyring without support
+        # for querying credentials without username
+        errs = res.stderr.decode("utf-8")
+        if (
+            res.returncode == 2
+            and "unrecognized arguments" in errs
+            and "--mode=creds" in errs
+        ):
+            raise RuntimeError(
+                "Keyring util is outdated; must be at least version 25.2.1, "
+                "please upgrade it"
+            )
+
         if res.returncode:
             return None
-        return res.stdout.decode("utf-8").strip(os.linesep)
+
+        data = json.loads(res.stdout.decode("utf-8"))
+        return (data["username"], data["password"])
 
     def _set_password(self, service_name: str, username: str, password: str) -> None:
         """Mirror the implementation of keyring.set_password using cli"""
@@ -487,15 +502,17 @@ class MultiDomainBasicAuth(AuthBase):
         if resp.status_code != 401:
             return resp
 
-        username, password = None, None
-
-        # Query the keyring for credentials:
-        if self.use_keyring:
-            username, password = self._get_new_credentials(
-                resp.url,
-                allow_netrc=False,
-                allow_keyring=True,
-            )
+        # Look for credentials for the (possibly redirected) URL. Credentials
+        # embedded in the URL -- e.g. carried in the ``Location`` of a
+        # cross-origin redirect, whose ``Authorization`` header requests strips
+        # -- are always honoured, since recovering them needs no user
+        # interaction. Keyring is only consulted when it is enabled, because it
+        # may require interaction and is therefore disabled under --no-input.
+        username, password = self._get_new_credentials(
+            resp.url,
+            allow_netrc=False,
+            allow_keyring=self.use_keyring,
+        )
 
         # We are not able to prompt the user so simply return the response
         if not self.prompting and not username and not password:

package/xll/python/Lib/site-packages/pip/_internal/network/cache.py

@@ -4,10 +4,10 @@ from __future__ import annotations
 
 import os
 import shutil
-from collections.abc import Generator
+from collections.abc import Callable, Generator
 from contextlib import contextmanager
 from datetime import datetime
-from typing import Any, BinaryIO, Callable
+from typing import Any, BinaryIO
 
 from pip._vendor.cachecontrol.cache import SeparateBodyBaseCache
 from pip._vendor.cachecontrol.caches import SeparateBodyFileCache

package/xll/python/Lib/site-packages/pip/_internal/network/download.py

@@ -15,11 +15,23 @@ from pip._vendor.requests import PreparedRequest
 from pip._vendor.requests.models import Response
 from pip._vendor.urllib3 import HTTPResponse as URLlib3Response
 from pip._vendor.urllib3._collections import HTTPHeaderDict
-from pip._vendor.urllib3.exceptions import ReadTimeoutError
+from pip._vendor.urllib3.exceptions import ProtocolError, ReadTimeoutError
 
 from pip._internal.cli.progress_bars import BarType, get_download_progress_renderer
-from pip._internal.exceptions import IncompleteDownloadError, NetworkConnectionError
-from pip._internal.models.link import Link
+from pip._internal.exceptions import (
+    ConnectionFailedError,
+    ConnectionTimeoutError,
+    IncompleteDownloadError,
+    NetworkConnectionError,
+    ProxyConnectionError,
+    SSLVerificationError,
+)
+from pip._internal.models.link import (
+    Link,
+    PathComponent,
+    as_path_component,
+    join_within_directory,
+)
 from pip._internal.network.cache import SafeFileCache, is_from_cache
 from pip._internal.network.session import CacheControlAdapter, PipSession
 from pip._internal.network.utils import HEADERS, raise_for_status, response_chunks
@@ -30,9 +42,14 @@ logger = logging.getLogger(__name__)
 
 def _get_http_response_size(resp: Response) -> int | None:
     try:
-        return int(resp.headers["content-length"])
+        size = int(resp.headers["content-length"])
     except (ValueError, KeyError, TypeError):
         return None
+    # A negative length would make _FileDownload.is_incomplete() report a
+    # truncated download as complete, so treat it as unknown instead.
+    if size < 0:
+        return None
+    return size
 
 
 def _get_http_response_etag_or_last_modified(resp: Response) -> str | None:
@@ -116,11 +133,14 @@ def parse_content_disposition(content_disposition: str, default_filename: str) -
     return filename or default_filename
 
 
-def _get_http_response_filename(resp: Response, link: Link) -> str:
+def _get_http_response_filename(resp: Response, link: Link) -> PathComponent:
     """Get an ideal filename from the given HTTP response, falling back to
     the link filename if not provided.
+
+    The result is validated as a single path component, so it can be joined onto
+    a download directory without escaping it.
     """
-    filename = link.filename  # fallback
+    filename: str = link.filename  # fallback
     # Have a look at the Content-Disposition header for a better guess
     content_disposition = resp.headers.get("content-disposition")
     if content_disposition:
@@ -134,7 +154,7 @@ def _get_http_response_filename(resp: Response, link: Link) -> str:
         ext = os.path.splitext(resp.url)[1]
         if ext:
             filename += ext
-    return filename
+    return as_path_component(filename)
 
 
 @dataclass
@@ -187,7 +207,9 @@ class Downloader:
         resp = self._http_get(link)
         download_size = _get_http_response_size(resp)
 
-        filepath = os.path.join(location, _get_http_response_filename(resp, link))
+        filepath = join_within_directory(
+            location, _get_http_response_filename(resp, link)
+        )
         with open(filepath, "wb") as content_file:
             download = _FileDownload(link, content_file, download_size)
             self._process_response(download, resp)
@@ -209,12 +231,12 @@ class Downloader:
         try:
             for chunk in chunks:
                 download.write_chunk(chunk)
-        except ReadTimeoutError as e:
+        except (ReadTimeoutError, ProtocolError) as e:
             # If the download size is not known, then give up downloading the file.
             if download.size is None:
                 raise e
 
-            logger.warning("Connection timed out while downloading.")
+            logger.warning("Connection interrupted while downloading.")
 
     def _attempt_resumes_or_redownloads(
         self, download: _FileDownload, first_resp: Response
@@ -241,9 +263,34 @@ class Downloader:
                     download.reset_file()
                     download.size = _get_http_response_size(resume_resp)
                     first_resp = resume_resp
+                else:
+                    # If the resume request starts at the wrong location, fail
+                    # outright since the server is misbehaving.
+                    content_range = resume_resp.headers.get("Content-Range", "")
+                    resumed_at = content_range.lower().partition("bytes ")[2]
+                    resumed_at = resumed_at.partition("-")[0]
+                    if resumed_at and resumed_at != str(download.bytes_received):
+                        raise IncompleteDownloadError(download)
 
                 self._process_response(download, resume_resp)
-            except (ConnectionError, ReadTimeoutError, OSError):
+            except (
+                ConnectionFailedError,
+                ConnectionTimeoutError,
+                ProxyConnectionError,
+                SSLVerificationError,
+                ReadTimeoutError,
+                ProtocolError,
+                OSError,
+            ):
+                # The error handling here is tricky, a few notes:
+                #
+                # - The diagnostic connection errors are raised by our custom
+                #   requests.request() connection exception handler.
+                # - ProtocolError is raised by urllib3 when the returned data length
+                #   doesn't match the response Content-Length.
+                # - ReadTimeoutError / ProtocolError come straight from urllib3 (via
+                #   process_response) and aren't caught by our connection exception
+                #   handler since they occur while *streaming* a response.
                 continue
 
         # No more resume attempts. Raise an error if the download is still incomplete.