code-sandboxes 1.9.21__tar.gz → 1.9.26__tar.gz

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.21
+Version: 1.9.26
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.21"
+__version__ = "1.9.26"

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/environments/adapters/datalayer.py

@@ -112,6 +112,24 @@ DEFAULT_MAX_ARTIFACT_BYTES = 20 * 1024**3
 # does; nothing about their behavior changed.
 
 
+#: The Dockerfile frontend the generated build asks for.
+#:
+#: At least **1.10**, because `_secret_mount` renders `mountAs: env` as
+#: `--mount=type=secret,env=NAME` and that key does not exist before it: 1.7,
+#: which this pinned for its first year, answers `unexpected key 'env' in
+#: 'env=NAME'` and fails the whole build. The mount and the pin were written
+#: against each other's assumptions and never ran together, because no build
+#: had ever carried a build secret — found on r1 on 2026-09-17 by the first
+#: one that did, and checked against both frontends before changing it.
+#:
+#: Raising this is a change to every Datalayer build, so it is one constant
+#: with one reason, not a literal inside the Dockerfile's own text.
+DOCKERFILE_FRONTEND = "docker/dockerfile:1.10"
+
+#: The first frontend with `--mount=type=secret,env=` (see above).
+SECRET_ENV_FRONTEND = (1, 10)
+
+
 def _secret_mount(secret: BuildSecret) -> str:
     """The ``--mount=type=secret`` flag one `BuildSecret` renders as (E3-05).
 
@@ -283,7 +301,7 @@ class Builder:
         spec = request.environment.spec
         apt = apt_pins_in(request.lock_text)
         lines = [
-            "# syntax=docker/dockerfile:1.7",
+            f"# syntax={DOCKERFILE_FRONTEND}",
             f"# Generated by Datalayer for {request.environment.metadata.name} "
             f"v{request.version}, build {request.build_uid}.",
             f"# Lock: {request.lock_digest}",

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/environments/adapters/daytona.py

@@ -90,7 +90,7 @@ from __future__ import annotations
 import shlex
 import tempfile
 import uuid
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from pathlib import Path
 from typing import Any
 
@@ -100,6 +100,7 @@ from ..builders import (
     ArtifactReference,
     BuildRequest,
     CapabilityFinding,
+    ValidationResult,
 )
 from ..contract import SANDBOX_CONTRACT_V1
 from ..errors import (
@@ -177,15 +178,18 @@ class Builder(ManagedBuilder):
     variant = "daytona"
     item = "E2-04"
     title = "Daytona"
-    #: A `packages` list and, for conda (E3-02), an `environment.yml`
-    #: dependency file installed with `micromamba`.
+    #: A `packages` list, or a dependency file: a conda `environment.yml`
+    #: installed with `micromamba` (E3-02), and a `requirements.txt` or a
+    #: `pyproject.toml` with its lock (E3-01), both of which resolve to the
+    #: very pip lock a `packages` list does — `build` tells a conda lock from
+    #: a pip one and nothing finer, so nothing here is format-specific.
     build_sources = ("packages", "dependencyFile", "dockerfile")
     #: None beyond the contract's own (E3-03): `Image.from_dockerfile` keeps
     #: the Dockerfile text as it is and Daytona builds it on a real Docker
     #: builder, so the grammar it accepts is Docker's. Checked in the SDK on
     #: 2026-09-17.
     forbidden_instructions = ()
-    dependency_formats = ("conda",)
+    dependency_formats = ("requirements", "pyproject", "conda")
     #: Daytona runs GPUs, on its own hardware and the owner's account (E2-17).
     #: This builder does not build one yet: see `_own_findings`.
     gpu = True
@@ -567,6 +571,112 @@ class Builder(ManagedBuilder):
             raise self._provider_error("ask whether the snapshot exists", error) from error
         return True
 
+    def delete(self, artifact: ArtifactReference) -> None:
+        """Remove the snapshot, by id; one already gone is removed (E2-18).
+
+        Deleting what is gone is a success because the collector deletes
+        first and marks second (E1-17): a sweep that died between the two
+        deletes again tomorrow, and must not be refused for having worked.
+
+        **By id, never by name.** The SDK takes either, and a name is reused
+        once its snapshot is deleted (E0-04) — deleting by name could remove
+        a later build's snapshot that inherited it.
+        """
+        sdk = self._daytona_sdk()
+        client = self._client(sdk)
+        snapshot = artifact.provider_artifact_id or artifact.immutable_reference
+        try:
+            client.snapshot.delete(snapshot)
+        except sdk.DaytonaNotFoundError:
+            self._log(f"The Daytona snapshot {snapshot} was already gone")
+            return
+        except Exception as error:
+            raise self._provider_error("delete the snapshot", error) from error
+        self._log(f"Deleted the Daytona snapshot {snapshot}")
+
+    def smoke_test(
+        self,
+        artifact: ArtifactReference,
+        *,
+        environment: Any = None,
+        lock_text: str | None = None,
+        secret_values: Sequence[str] = (),
+    ) -> ValidationResult:
+        """Launch the snapshot and run Appendix B's core tier in it (E2-04).
+
+        This box's own `Done when` asks for exactly this — "a sandbox launched
+        from its id passes the core tier" — and until 2026-09-17 it refused
+        through `ManagedBuilder`, so **no Daytona build could reach
+        `succeeded`**: the workflow calls this step, the snapshot was built and
+        live at the provider, and the build was recorded failed.
+
+        **Launched by id, never by name** (E0-04): a Daytona sandbox record
+        keeps the snapshot's *name*, and a name is republished, so only the id
+        says which artifact actually ran.
+
+        **Restarted by stopping and starting the sandbox**, not the kernel
+        (E0-04 again): Daytona's own daemon is PID 1 here, so there is no
+        kernel to restart, and check 8 means the thing that survives a real
+        restart.
+
+        The sandbox is deleted whether the tier passed or not — a smoke test
+        that leaves a sandbox running bills the owner for a check.
+        """
+        if environment is None:
+            raise EnvironmentsError(
+                CAPABILITY_UNSUPPORTED,
+                "A Daytona smoke test needs the version's spec: the core tier "
+                "asks for the Python version it declared and the packages its "
+                "lock pinned, and an artifact carries neither",
+                detail={"variant": self.variant},
+            )
+        from ..conformance import expected_packages, run_core_tier
+
+        snapshot = artifact.provider_artifact_id or artifact.immutable_reference
+        sandbox = self._smoke_test_sandbox(snapshot)
+        self._log(f"Launching {snapshot} to smoke-test it")
+        try:
+            sandbox.start()
+            return run_core_tier(
+                sandbox,
+                python_version=environment.spec.language.version,
+                expected_packages=expected_packages(environment, lock_text or ""),
+                secret_values=tuple(secret_values),
+                restart=lambda: self._restart(sandbox),
+            )
+        except EnvironmentsError:
+            raise
+        except Exception as error:
+            raise self._provider_error("smoke-test the snapshot", error) from error
+        finally:
+            try:
+                sandbox.stop()
+            except Exception as error:
+                self._log(f"The smoke-test sandbox could not be stopped: {error}")
+
+    def _smoke_test_sandbox(self, snapshot: str) -> Any:
+        """A sandbox of this build's own snapshot, deleted when it stops."""
+        from ...daytona_sandbox import DaytonaSandbox
+
+        secrets = self._provider_secrets()
+        return DaytonaSandbox(
+            api_key=secrets.get("DAYTONA_API_KEY"),
+            organization_id=secrets.get("DAYTONA_ORGANIZATION_ID"),
+            snapshot=snapshot,
+            delete_on_stop=True,
+        )
+
+    @staticmethod
+    def _restart(sandbox: Any) -> None:
+        """Check 8's restart, as Daytona can do it.
+
+        Its daemon is PID 1, so there is no kernel to restart: the sandbox
+        itself is stopped and started, which is the stronger version of the
+        same question.
+        """
+        sandbox.stop()
+        sandbox.start()
+
     def _provider_error(self, what: str, error: BaseException) -> EnvironmentsError:
         return EnvironmentsError(
             PROVIDER_ERROR,

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/environments/adapters/managed.py

@@ -24,6 +24,7 @@ An SDK imported at module scope would turn `validate` into a 500.
 
 from __future__ import annotations
 
+from collections.abc import Sequence
 from typing import Any, Callable
 
 from ..builders import (
@@ -261,7 +262,23 @@ class ManagedBuilder:
     def inspect(self, artifact: ArtifactReference) -> ArtifactMetadata:
         raise self._not_built("inspect an artifact")
 
-    def smoke_test(self, artifact: ArtifactReference) -> ValidationResult:
+    def smoke_test(
+        self,
+        artifact: ArtifactReference,
+        *,
+        environment: Any = None,
+        lock_text: str | None = None,
+        secret_values: Sequence[str] = (),
+    ) -> ValidationResult:
+        """Launch the artifact and run Appendix B's core tier in it (E2-03/04/05).
+
+        `environment` and `lock_text` are what the core tier needs and an
+        artifact does not carry: the Python version the spec asks for and the
+        packages its lock pins. The caller has both — it read them to build —
+        and passes them rather than making every adapter fetch them again.
+        They are keyword-only and optional so a caller that has neither still
+        type-checks, and an adapter that needs them says so itself.
+        """
         raise self._not_built("smoke-test an artifact")
 
     def resolve(self, version_ref: str) -> ArtifactReference:

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/environments/adapters/modal.py

@@ -124,7 +124,7 @@ import contextlib
 import io
 import os
 import tempfile
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from pathlib import Path
 from typing import Any
 
@@ -135,6 +135,7 @@ from ..builders import (
     ArtifactReference,
     BuildRequest,
     CapabilityFinding,
+    ValidationResult,
 )
 from ..contract import SANDBOX_CONTRACT_V1
 from ..errors import (
@@ -535,23 +536,31 @@ class Builder(ManagedBuilder):
         return declared, values
 
     def _ecr_secret(self, sdk: Any, client: Any) -> Any | None:
-        """A Modal Secret carrying this build's own base-reader credential (D-17, D-18).
-
-        `None` when the credential carries no registry login: the base is
-        then whatever the ambient workspace can already reach, the same
-        fallback `_client` takes with no owner token.
+        """A Modal Secret carrying this build's base-reader session (D-17, D-18).
+
+        `from_aws_ecr` wants the IAM session itself — keys, token and region —
+        not the docker-login `AWS`/token pair Daytona and E2B take, which is
+        what the credential's `username`/`password` hold. So it reads
+        `aws_session`. Reading the login pair as IAM keys is what this did
+        until 2026-09-18: the worker minted `AWS`/<ECR token>, this wrote it
+        as `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, and AWS answered "The
+        security token included in the request is invalid" on the base pull,
+        so no Modal build through the worker could ever succeed.
+
+        `None` when the credential carries no session: the base is then
+        whatever the ambient workspace can already reach, the same fallback
+        `_client` takes with no owner token.
         """
-        username = str(getattr(self._credential, "username", "") or "")
-        password = str(getattr(self._credential, "password", "") or "")
-        if not (username and password):
+        session = dict(getattr(self._credential, "aws_session", None) or {})
+        if not (session.get("AWS_ACCESS_KEY_ID") and session.get("AWS_SECRET_ACCESS_KEY")):
             return None
-        # `from_aws_ecr` wants IAM-shaped credentials, not the docker-login
-        # `AWS`/token pair Daytona and E2B take (found live, 2026-09-13):
-        # the same D-17 session, read differently.
         secret = sdk.Secret.from_dict(
             {
-                "AWS_ACCESS_KEY_ID": username,
-                "AWS_SECRET_ACCESS_KEY": password,
+                **{
+                    name: str(session[name])
+                    for name in ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN")
+                    if session.get(name)
+                },
                 "AWS_REGION": self._region,
             }
         )
@@ -665,6 +674,84 @@ class Builder(ManagedBuilder):
             raise self._provider_error("ask whether the image exists", error) from error
         return True
 
+    def smoke_test(
+        self,
+        artifact: ArtifactReference,
+        *,
+        environment: Any = None,
+        lock_text: str | None = None,
+        secret_values: Sequence[str] = (),
+    ) -> ValidationResult:
+        """Launch the image and run Appendix B's core tier in it (E2-05).
+
+        This box's own `Done when` asks for exactly this — "the live test
+        launches by image id and passes the core tier" — and it refused
+        through `ManagedBuilder`, so **no Modal build could reach
+        `succeeded`**: the image was built in the owner's workspace and the
+        build recorded failed at this step, the same state Daytona was in
+        until 2026-09-17.
+
+        **Launched by image id, never by name**: a published name is mutable
+        by design (§6), so only the id says which artifact ran. Launched
+        through `ModalSandbox` — the same class a person's launch uses —
+        rather than a hand-rolled `Sandbox.create`, because a hand-rolled
+        launch is exactly what hid, on 2026-09-13, that every image this
+        builder made died the instant it was launched for real.
+
+        **As the owner** (D-8): the sandbox is created with the same client
+        the build used, so it runs in the workspace the image is in.
+
+        **Restarted by replacing the sandbox.** Modal has no in-place
+        restart, so check 7's restart stops this sandbox and starts another
+        from the same image, which is the stronger form of the question.
+
+        The sandbox is terminated whether the tier passed or not.
+        """
+        if environment is None:
+            raise EnvironmentsError(
+                CAPABILITY_UNSUPPORTED,
+                "A Modal smoke test needs the version's spec: the core tier "
+                "asks for the Python version it declared and the packages its "
+                "lock pinned, and an artifact carries neither",
+                detail={"variant": self.variant},
+            )
+        from ...modal_sandbox import ModalSandbox
+        from ...models import SandboxConfig
+        from ..conformance import expected_packages, run_core_tier
+
+        sdk = self._modal_sdk()
+        sandbox = ModalSandbox(
+            config=SandboxConfig(name=f"smoke-{artifact.provider_artifact_id}"),
+            app_name=f"dl-{environment.metadata.name}",
+            image_id=artifact.provider_artifact_id,
+            client=self._client(sdk),
+        )
+        self._log(f"Launching {artifact.provider_artifact_id} to smoke-test it")
+        try:
+            sandbox.start()
+            return run_core_tier(
+                sandbox,
+                python_version=environment.spec.language.version,
+                expected_packages=expected_packages(environment, lock_text or ""),
+                secret_values=tuple(secret_values),
+                restart=lambda: self._restart(sandbox),
+            )
+        except EnvironmentsError:
+            raise
+        except Exception as error:
+            raise self._provider_error("smoke-test the image", error) from error
+        finally:
+            try:
+                sandbox.stop()
+            except Exception as error:
+                self._log(f"The smoke-test sandbox could not be stopped: {error}")
+
+    @staticmethod
+    def _restart(sandbox: Any) -> None:
+        """Check 7's restart, as Modal can do it: a new sandbox from the same image."""
+        sandbox.stop()
+        sandbox.start()
+
     def delete(self, artifact: ArtifactReference) -> None:
         """Delete the image, and every intermediate layer this build recorded (E2-05, E2-09).
 

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/environments/attest.py

@@ -49,7 +49,16 @@ from .errors import (
     SCAN_BLOCKED,
     EnvironmentsError,
 )
-from .policy import DEFAULT_POLICY, PolicyDecision, ScanPolicy, decide, findings_of
+from .policy import (
+    DEFAULT_POLICY,
+    UNRESTRICTED_POLICY,
+    EnvironmentsPolicy,
+    PolicyDecision,
+    ScanPolicy,
+    decide,
+    findings_of,
+    refuse_unlicensed,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -116,47 +125,72 @@ _SPDX_LICENSE_KEYS = ("licenseConcluded", "licenseDeclared")
 _SPDX_UNKNOWN = frozenset({"NOASSERTION", "NONE", ""})
 
 
-def _spdx_licenses(document: Mapping[str, Any]) -> set[str]:
-    """What an SPDX document names, which is what BuildKit's `attest:sbom=` writes.
+def _spdx_license_pairs(document: Mapping[str, Any]) -> list[tuple[str, str]]:
+    """Every SPDX package with a licence, as `(package, licence)`.
 
     `licenseConcluded` is what the tool decided and `licenseDeclared` what the
     package claimed, so the concluded one is read first and the declared one
     only when it said nothing.
     """
-    found: set[str] = set()
+    found: list[tuple[str, str]] = []
     for package in document.get("packages") or ():
         if not isinstance(package, Mapping):
             continue
+        name = str(package.get("name") or "").strip()
         for key in _SPDX_LICENSE_KEYS:
             value = str(package.get(key) or "").strip()
             if value and value.upper() not in _SPDX_UNKNOWN:
-                found.add(value)
+                # Kept even with no name: `licenses_of` reads only the licence
+                # half, and dropping an unnamed package's licence there would
+                # be exactly the silent behavior change this refactor must
+                # not make. `licenses_by_package`'s own callers decide what an
+                # empty package name means for them.
+                found.append((name, value))
                 break
     return found
 
 
-def _cyclonedx_licenses(document: Mapping[str, Any]) -> set[str]:
-    """What a CycloneDX document names, by id, by name, or as an expression."""
-    found: set[str] = set()
+def _cyclonedx_license_pairs(document: Mapping[str, Any]) -> list[tuple[str, str]]:
+    """Every CycloneDX component with a licence, as `(component, licence)`."""
+    found: list[tuple[str, str]] = []
     for component in document.get("components") or ():
         if not isinstance(component, Mapping):
             continue
+        name = str(component.get("name") or "").strip()
         for entry in component.get("licenses") or ():
             if not isinstance(entry, Mapping):
                 continue
             licence = entry.get("license")
+            value = ""
             if isinstance(licence, Mapping):
                 for key in _CYCLONEDX_LICENSE_KEYS:
                     value = str(licence.get(key) or "").strip()
                     if value:
-                        found.add(value)
                         break
-            expression = str(entry.get("expression") or "").strip()
-            if expression:
-                found.add(expression)
+            if not value:
+                value = str(entry.get("expression") or "").strip()
+            if value:
+                # Kept even with no component name; see the SPDX reader's own
+                # note above.
+                found.append((name, value))
     return found
 
 
+def licenses_by_package(document: Any) -> list[tuple[str, str]]:
+    """Every `(package, licence)` an SBOM names, package first (E3-06).
+
+    The same two shapes `licenses_of` reads, kept attributed rather than
+    flattened: a policy that denies a licence has to name the package that
+    carries it, which `licenses_of`'s own deduplicated set of licence strings
+    alone cannot answer. Insertion order, not sorted — the order the SBOM's
+    own packages/components came in, which is what a refusal naming "the
+    first one" should mean deterministically for the same document.
+    """
+    if not isinstance(document, Mapping):
+        return []
+    return _spdx_license_pairs(document) + _cyclonedx_license_pairs(document)
+
+
 def licenses_of(document: Any) -> list[str]:
     """Every licence an SBOM names, deduplicated and sorted.
 
@@ -173,7 +207,7 @@ def licenses_of(document: Any) -> list[str]:
     """
     if not isinstance(document, Mapping):
         return []
-    return sorted(_spdx_licenses(document) | _cyclonedx_licenses(document))
+    return sorted({licence for _package, licence in licenses_by_package(document)})
 
 
 @dataclass(frozen=True)
@@ -589,12 +623,21 @@ class Attestor:
         sbom_ref: str = "",
         provenance_ref: str = "",
         sbom: Any = None,
+        environments_policy: EnvironmentsPolicy = UNRESTRICTED_POLICY,
     ) -> AttestationResult:
         """Scan, then sign: the order the Operator's check depends on (D-11).
 
         `sbom`, when the caller has the document, is read for the licences a
         publication carries; the registry's scanner reports vulnerabilities
         and never licences, so there is nowhere else they come from.
+
+        **Refused before signing, never after (E3-06).** A licence an
+        organization's own policy denies is checked against the same `sbom`,
+        naming the package that carries it, and raised before `sign` runs —
+        an artifact whose licence policy denies it is never signed, the same
+        as one whose scan blocks it: a signature is Datalayer's word that an
+        artifact may run, and this is the second of the two words that go
+        into it.
         """
         self.can_sign()
         decision = self.scan(repository=repository, digest=digest)
@@ -609,6 +652,8 @@ class Attestor:
                     "blocking": [finding.id for finding in decision.blocking],
                 },
             )
+        pairs = licenses_by_package(sbom)
+        refuse_unlicensed(pairs, environments_policy)
         signature, signed_now = self.sign(registry=registry, repository=repository, digest=digest)
         return AttestationResult(
             decision=decision,
@@ -619,7 +664,7 @@ class Attestor:
             if size_bytes is not None
             else self.size_of(repository=repository, digest=digest),
             signed_now=signed_now,
-            licenses=tuple(licenses_of(sbom)),
+            licenses=tuple(sorted({licence for _package, licence in pairs})),
         )
 
     def size_of(self, *, repository: str, digest: str) -> int | None:
@@ -665,8 +710,10 @@ def attest_artifact(
     artifact: Any,
     credential: Any = None,
     policy: ScanPolicy = DEFAULT_POLICY,
+    environments_policy: EnvironmentsPolicy = UNRESTRICTED_POLICY,
     log: Callable[[str], None] | None = None,
     size_bytes: int | None = None,
+    sbom: Any = None,
     attestor: Attestor | None = None,
 ) -> dict[str, Any]:
     """The `attest` seam of `EnvironmentBuildWorkflow` (E1-08, E1-09).
@@ -674,6 +721,13 @@ def attest_artifact(
     Takes the artifact the builder recorded and the build's credential, and
     answers the mapping the workflow stores: the scan's decision, the
     signature, the SBOM and provenance references, and the size.
+
+    `environments_policy` is the caller's organization's own narrowing of
+    what licence a build may carry (E3-06); `sbom`, when the caller has the
+    document, is what it is checked against — nobody fetches one here. A
+    caller with neither passes nothing through, and nothing is refused: the
+    platform default is unrestricted on licences, the same as every other
+    dimension of this policy until an organization writes one.
     """
     variant = str(getattr(artifact, "variant", "") or "")
     reference = str(getattr(artifact, "immutable_reference", "") or "")
@@ -724,6 +778,8 @@ def attest_artifact(
         repository=repository,
         digest=digest,
         size_bytes=size_bytes,
+        sbom=sbom,
+        environments_policy=environments_policy,
     ).body()
 
 

{code_sandboxes-1.9.21 → code_sandboxes-1.9.26}/code_sandboxes/environments/conformance.py

@@ -457,6 +457,36 @@ def _secrets(
     )
 
 
+def expected_packages(environment: Any, lock_text: str) -> dict[str, str]:
+    """Each top-level distribution the spec names, pinned to what its lock resolved.
+
+    What Appendix B check 5 is given. Never every package the lock pins — most
+    of a real lock is transitive, and check 5 tries to *import* each name it is
+    handed; a build tool or a C-library-only wheel that was never meant to be
+    imported directly would fail a check with nothing wrong to report. The
+    spec's own `packages.python.dependencies` is what a person declared
+    wanting, so it is what disagreeing across variants (E2-08) means something
+    about.
+
+    Here rather than in the durable worker, which had the only copy, so that a
+    builder running its own smoke test asks the same question of its own
+    artifact (E2-03/04/05).
+    """
+    from packaging.requirements import InvalidRequirement, Requirement
+    from packaging.utils import canonicalize_name
+
+    from .resolve import locked_versions
+
+    pinned = locked_versions(lock_text) if lock_text else {}
+    names: list[str] = []
+    for text in environment.spec.packages.python.dependencies:
+        try:
+            names.append(canonicalize_name(Requirement(text).name))
+        except InvalidRequirement:
+            continue
+    return {name: pinned[name] for name in names if name in pinned}
+
+
 def run_core_tier(
     sandbox: Sandbox,
     *,
@@ -551,9 +581,7 @@ def _gpu(sandbox: Sandbox, requested: bool, cuda: str | None, timeout: float | N
     # version its spec describes. A version that asked for none never
     # reaches here (the trivial pass above), so the extended tier still
     # gates nothing for a CPU version.
-    return _result(
-        11, not problems, gating=True, detail="; ".join(problems) or None, actual=answer
-    )
+    return _result(11, not problems, gating=True, detail="; ".join(problems) or None, actual=answer)
 
 
 def _throughput(