nab-python 0.0.5__py3-none-any.whl → 0.0.6__py3-none-any.whl

nab_python/_build/env.py

@@ -6,7 +6,7 @@
 * ``venv.EnvBuilder`` (stdlib) creates an empty interpreter at a temp
   path, ``with_pip=False``; nab does not need pip in there.
 * nab's own resolver picks versions for ``[build-system].requires``
-  using the same indexes / ``exclude-newer`` window as the outer
+  using the same indexes / ``uploaded-prior-to`` window as the outer
   resolve.
 * ``download_lock`` from :mod:`nab_python.download` fetches the
   resolved wheels into a temp directory.
@@ -37,6 +37,7 @@ from installer.destinations import SchemeDictionaryDestination
 from installer.sources import WheelFile
 from nab_index.urllib3_async_transport import Urllib3AsyncTransport
 
+from .._vcs_admission import UnsupportedVcsError
 from ..config import NabProjectConfig
 from ..download import download_lock
 
@@ -97,7 +98,7 @@ class NabBuildEnv:
 
     ``requires`` is the PEP 508 string list from
     ``[build-system].requires``. ``config`` carries the indexes,
-    ``exclude-newer`` window and other nab inputs from the outer
+    ``uploaded-prior-to`` window and other nab inputs from the outer
     resolve; it is pruned (no local sources, no workspace, no
     marker overlay) before the inner resolve so the build env is
     computed against PyPI alone.
@@ -269,20 +270,27 @@ class NabBuildEnv:
 
         inner_config = NabProjectConfig(
             indexes=self._config.indexes,
+            package_overrides=self._config.package_overrides,
             index_overrides=self._config.index_overrides,
             uploaded_prior_to=self._config.uploaded_prior_to,
-            uploaded_prior_to_overrides=self._config.uploaded_prior_to_overrides,
         )
         # download_lock closes its transport, and ``install`` may call
         # this again for ``get_requires_for_build_wheel`` follow-ups;
         # build a fresh transport each time.
         transport = self._transport_factory()
-        result = resolve_pyproject(
-            synthetic,
-            transport,
-            config=inner_config,
-            python_version=self._python_version,
-        )
+        try:
+            result = resolve_pyproject(
+                synthetic,
+                transport,
+                config=inner_config,
+                python_version=self._python_version,
+            )
+        except (UnsupportedVcsError, NotImplementedError) as exc:
+            # A direct-URL/VCS build requirement means nab cannot build this
+            # sdist. Report it as a build-env failure so the outer resolve
+            # skips the version instead of aborting on the raw error.
+            msg = f"build env resolve failed: {exc}"
+            raise BuildEnvError(msg) from exc
 
         # Reject sdist-only pins early: build deps that ship only an
         # sdist trigger a recursive backend invocation that this

nab_python/_build/runner.py

@@ -250,9 +250,9 @@ def _parse_metadata(metadata_path: Path) -> WheelMetadata:
 
     provides_extra: list[str] = sorted(
         {
-            canonicalize_name(extra)
+            canonicalize_name(stripped)
             for extra in msg_obj.get_all("Provides-Extra") or ()
-            if extra
+            if (stripped := extra.strip())
         }
     )
 

nab_python/_conflict_kind.py

@@ -8,6 +8,14 @@ cycle.  :class:`nab_python.config.ConflictKind` takes its enum values from
 
 from __future__ import annotations
 
+import re
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+    from ._vendor.packaging.markers import Marker
+
 KIND_EXTRA = "extra"
 KIND_GROUP = "group"
 
@@ -18,3 +26,37 @@ MARKER_VARIABLE_FOR_KIND = {
     KIND_EXTRA: "extras",
     KIND_GROUP: "dependency_groups",
 }
+
+# ``extras`` and ``dependency_groups`` are PEP 685 / PEP 735 set variables that
+# packaging only defines when consuming a lockfile.  At resolve time no
+# conflict-fork member is active as a marker-set member (forks fold their
+# members into requirements, not the environment), so both are empty.  Seeding
+# them keeps a dependency marker that tests one from raising a raw KeyError at
+# evaluation; the membership simply tests False and the dep is dropped.
+EMPTY_MEMBERSHIP_SETS: dict[str, frozenset[str]] = {
+    variable: frozenset() for variable in MARKER_VARIABLE_FOR_KIND.values()
+}
+
+_MEMBERSHIP_SET_PATTERN = re.compile(
+    r"\b(" + "|".join(MARKER_VARIABLE_FOR_KIND.values()) + r")\b"
+)
+
+
+def membership_set_in_marker(marker_text: str) -> str | None:
+    """Return the lockfile-only set variable a marker tests, or ``None``.
+
+    A dependency marker that tests ``extras`` or ``dependency_groups`` is a
+    mistake (usually meant as ``extra ==``): those variables are defined only
+    when consuming a lockfile, so they are empty at resolve time.
+    """
+    match = _MEMBERSHIP_SET_PATTERN.search(marker_text)
+    return match.group(1) if match else None
+
+
+def dependency_marker_holds(marker: Marker, environment: Mapping[str, str]) -> bool:
+    """Evaluate a dependency marker for a resolve-time ``environment``.
+
+    Seeds the empty lockfile-only set variables so a marker that tests one
+    evaluates cleanly to False instead of raising a raw KeyError.
+    """
+    return bool(marker.evaluate({**environment, **EMPTY_MEMBERSHIP_SETS}))

nab_python/_lockfile/builder.py

@@ -13,7 +13,7 @@ from collections import defaultdict
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import TYPE_CHECKING, Protocol, overload
-from urllib.parse import urlsplit, urlunsplit
+from urllib.parse import quote, urlsplit, urlunsplit
 
 import tomli
 
@@ -47,6 +47,7 @@ __all__ = [
     "build_lock_input_from_provider",
     "read_lockfile_anchor",
     "read_lockfile_packages",
+    "require_artifact_hashes",
 ]
 
 
@@ -104,8 +105,16 @@ class LockInputProvider(Protocol):
         """Return the listing slice that matches ``(canonical_name, version)``."""
         ...
 
-    def effective_dist_policy(self, canonical_name: str, /) -> DistPolicy:
-        """Return the effective :class:`DistPolicy` for ``canonical_name``."""
+    def effective_dist_policy(
+        self, canonical_name: str, version: Version, index_name: str | None = None, /
+    ) -> DistPolicy:
+        """Return the effective :class:`DistPolicy` for ``canonical_name==version``."""
+        ...
+
+    def effective_requires_python(
+        self, canonical_name: str, version: Version, /
+    ) -> str | None:
+        """Return the ``requires-python`` override for ``canonical_name==version``."""
         ...
 
 
@@ -205,17 +214,23 @@ def read_lockfile_packages(path: Path) -> dict[str, Version] | None:
 
 
 def _strip_userinfo(url: str) -> str:
-    """Return ``url`` with any ``user:password@`` userinfo removed.
-
-    Lockfiles are committed to version control, so an index or VCS
-    URL carrying embedded credentials must not be written verbatim.
-    Only the userinfo is dropped: host case and port are preserved
-    and a ``git+`` scheme prefix is left intact.  A no-op for URLs
-    without credentials.
+    """Return ``url`` with credential userinfo removed.
+
+    Lockfiles are committed to version control, so an index or VCS URL
+    carrying an embedded ``user:password`` must not be written verbatim.
+    An SSH login such as ``git@`` is the protocol login, not a secret,
+    and is required to clone, so it is kept (only an embedded password is
+    dropped); host case and port are preserved.  A no-op for URLs without
+    userinfo.
     """
     parts = urlsplit(url)
-    netloc = parts.netloc.rpartition("@")[2]
-    return urlunsplit(parts._replace(netloc=netloc))
+    userinfo, sep, host = parts.netloc.rpartition("@")
+    if not sep:
+        return url
+    if parts.scheme.endswith("ssh"):
+        login = userinfo.split(":", 1)[0]
+        host = f"{login}@{host}"
+    return urlunsplit(parts._replace(netloc=host))
 
 
 def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a distinct lockfile field
@@ -348,13 +363,23 @@ def _index_pin_from_listing(
     package's wheels stayed in ``versions_cache`` as a possible
     metadata source for the resolver; only the sdist is emitted
     into the lock so installers download and build that archive.
+
+    A ``requires-python`` metadata override takes precedence over the
+    Simple-API value so the pin records the specifier the resolver
+    actually admitted against; a conforming :pep:`751` installer would
+    otherwise reject a widened pin whose lock still carried the narrow
+    artefact value.
     """
     from ..fetch import DEFAULT_INDEX_URL
     from ..lockfile import IndexPin, SdistArtifact, WheelArtifact
     from ..provider import DistPolicy
 
     files = list(provider.dist_files_for(canonical, version))
-    if provider.effective_dist_policy(canonical) is DistPolicy.SDIST_INSTALL:
+    serving = provider.coordinator.index.get_listing_index(canonical)
+    if (
+        provider.effective_dist_policy(canonical, version, serving)
+        is DistPolicy.SDIST_INSTALL
+    ):
         files = [f for f in files if not isinstance(f, WheelFile)]
         if not any(isinstance(f, SdistFile) for f in files):
             msg = (
@@ -365,17 +390,18 @@ def _index_pin_from_listing(
             raise MissingSdistError(msg)
 
     wheels = tuple(
-        _build_artifact(canonical, f, WheelArtifact)
-        for f in files
-        if isinstance(f, WheelFile)
+        _build_artifact(f, WheelArtifact) for f in files if isinstance(f, WheelFile)
     )
     sdist_file = next((f for f in files if isinstance(f, SdistFile)), None)
     sdist = (
-        _build_artifact(canonical, sdist_file, SdistArtifact)
-        if sdist_file is not None
-        else None
+        _build_artifact(sdist_file, SdistArtifact) if sdist_file is not None else None
     )
-    requires_python = _common_requires_python(files)
+
+    override_rp = provider.effective_requires_python(canonical, version)
+    requires_python = (
+        override_rp if override_rp is not None else _common_requires_python(files)
+    )
+
     serving_name = provider.coordinator.index.get_listing_index(canonical)
     by_name = {ix.name: ix.url for ix in indexes}
     index_url = by_name.get(serving_name) if serving_name is not None else None
@@ -402,25 +428,22 @@ def _index_pin_from_listing(
 
 @overload
 def _build_artifact(
-    canonical: str,
     source: WheelFile | SdistFile,
     cls: type[WheelArtifact],
 ) -> WheelArtifact: ...
 @overload
 def _build_artifact(
-    canonical: str,
     source: WheelFile | SdistFile,
     cls: type[SdistArtifact],
 ) -> SdistArtifact: ...
 def _build_artifact(
-    canonical: str,
     source: WheelFile | SdistFile,
     cls: type[WheelArtifact | SdistArtifact],
 ) -> WheelArtifact | SdistArtifact:
-    hashes = _filter_acceptable_hashes(canonical, source.filename, source.hashes)
+    hashes = _filter_acceptable_hashes(source.hashes)
     return cls(
         filename=source.filename,
-        url=source.url,
+        url=_strip_userinfo(source.url),
         hashes=hashes,
         size=source.size,
         upload_time=_parse_upload_time(source.upload_time),
@@ -449,30 +472,50 @@ def _parse_upload_time(raw: str | None) -> datetime | None:
 
 
 def _filter_acceptable_hashes(
-    canonical: str, filename: str, hashes: tuple[tuple[str, str], ...]
+    hashes: tuple[tuple[str, str], ...],
 ) -> tuple[tuple[str, str], ...]:
     """Return the subset of ``hashes`` whose algorithm is consumable.
 
     Pip's hash-checking mode and PEP 751 both accept any of sha256,
     sha384, or sha512; nab forwards every recorded entry so consumers
-    can pick.  Raise :class:`MissingHashError` when none of the
-    acceptable algorithms are present.
+    can pick.  Unacceptable algorithms (e.g. md5) are dropped, so the
+    result may be empty.
     """
     from ..lockfile import ACCEPTED_HASH_ALGORITHMS
 
-    accepted = tuple(
+    return tuple(
         (algo, digest)
         for algo, digest in sorted(hashes)
         if algo in ACCEPTED_HASH_ALGORITHMS
     )
-    if not accepted:
-        algos = sorted({algo for algo, _ in hashes})
-        msg = (
-            f"{canonical}: artefact {filename!r} has no acceptable hash"
-            f" (need one of {list(ACCEPTED_HASH_ALGORITHMS)!r}, got {algos!r})"
-        )
-        raise MissingHashError(msg)
-    return accepted
+
+
+def require_artifact_hashes(lock_input: LockInput) -> None:
+    """Raise :class:`MissingHashError` if a pinned artefact has no hash.
+
+    PEP 751 and pip's hash-checking mode each need at least one of
+    sha256/sha384/sha512 per artefact.  The plain ``name==version``
+    writer records no hash and does not call this.
+    """
+    from ..lockfile import ACCEPTED_HASH_ALGORITHMS, IndexPin
+
+    pin_groups: Iterable[Mapping[str, PinShape]] = (
+        lock_input.pins,
+        *lock_input.per_tuple_pins.values(),
+    )
+    for pins in pin_groups:
+        for pin in pins.values():
+            if not isinstance(pin, IndexPin):
+                continue
+            artefacts = (*pin.wheels, *((pin.sdist,) if pin.sdist is not None else ()))
+            for artefact in artefacts:
+                if not artefact.hashes:
+                    msg = (
+                        f"{pin.name}: artefact {artefact.filename!r} has no "
+                        f"acceptable hash (need one of "
+                        f"{list(ACCEPTED_HASH_ALGORITHMS)!r})"
+                    )
+                    raise MissingHashError(msg)
 
 
 def _common_requires_python(files: Iterable[WheelFile | SdistFile]) -> str | None:
@@ -538,7 +581,7 @@ def _vcs_pin_from_source(
     bare_repo_url = _strip_userinfo(parsed.repo_url)
     repo_url = f"{parsed.scheme}+{bare_repo_url}@{resolved_sha}"
     if parsed.subdirectory:
-        repo_url += f"#subdirectory={parsed.subdirectory}"
+        repo_url += f"#subdirectory={quote(parsed.subdirectory, safe='/')}"
 
     return VcsPin(
         name=canonical,

nab_python/_lockfile/disjointness.py

@@ -99,8 +99,8 @@ def validate_marker_disjointness(
 
     ``declared_groups`` carries every conflict set regardless of policy
     so the hint can distinguish an undeclared collision (suggest adding
-    a declaration) from one already declared under ``at_least_one``
-    (suggest tightening to ``at_most_one`` or ``exactly_one``).
+    a declaration) from one already declared under ``at-least-one``
+    (suggest tightening to ``at-most-one`` or ``exactly-one``).
     """
     if not environments:
         return
@@ -265,7 +265,7 @@ def _conflict_hint(
     because a conflict declaration would not help.
 
     When ``declared_groups`` already covers the active members, the
-    hint instead suggests tightening the policy: an ``at_least_one``
+    hint instead suggests tightening the policy: an ``at-least-one``
     declaration permits co-selection, so the validator still raises and
     the user has to switch to an exclusive policy to prune the point.
     """
@@ -288,8 +288,8 @@ def _conflict_hint(
     if already_declared:
         return (
             ". These members are declared in [tool.nab].conflicts under a"
-            " policy that permits co-selection; switch to at_most_one or"
-            " exactly_one to prune the colliding context"
+            " policy that permits co-selection; switch to at-most-one or"
+            " exactly-one to prune the colliding context"
         )
     return (
         ". If these are intentionally mutually exclusive, declare them in"

nab_python/_lockfile/pylock.py

@@ -31,6 +31,7 @@ from .._vendor.packaging.specifiers import SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
 from .._vendor.packaging.version import Version
 from ..config import conflict_exclusion_groups, conflict_member_groups
+from .builder import require_artifact_hashes
 from .disjointness import validate_marker_disjointness
 
 if TYPE_CHECKING:
@@ -82,14 +83,26 @@ def write_lock(
     With no ``output_path`` the current directory is the base.
     """
     lock_dir = Path(output_path).parent if output_path is not None else None
-    pylock = build_pylock(lock_input, lock_dir=lock_dir)
-    pylock.validate()
-    text = tomli_w.dumps(dict(pylock.to_dict()))
+    text = render_lock(lock_input, lock_dir=lock_dir)
     if output_path is not None:
         Path(output_path).write_text(text, encoding="utf-8")
     return text
 
 
+def render_lock(lock_input: LockInput, *, lock_dir: Path | None = None) -> str:
+    """Serialise ``lock_input`` to PEP 751 TOML text without writing a file.
+
+    ``lock_dir`` is the directory the lock will live in; directory, wheel
+    and sdist paths are emitted relative to it so the lock stays portable.
+    Defaults to the current directory.  Used by ``write_lock`` and by
+    ``nab lock --locked`` to render the would-be lock for comparison.
+    """
+    require_artifact_hashes(lock_input)
+    pylock = build_pylock(lock_input, lock_dir=lock_dir)
+    pylock.validate()
+    return tomli_w.dumps(dict(pylock.to_dict()))
+
+
 def build_pylock(lock_input: LockInput, *, lock_dir: Path | None = None) -> Pylock:
     """Build a :class:`Pylock` from the input shape.
 
@@ -539,7 +552,7 @@ def _build_marker(
     ``tuple_markers`` means the caller has not declared a tuple
     universe and the marker is omitted.
 
-    A dep required by every member of an ``at_most_one`` set but not
+    A dep required by every member of an ``at-most-one`` set but not
     by the base is absent from ``env_base_names``, so it keeps the
     membership OR and does not install when no member is selected.
     An environment with no base-name set (no conflict fork ran) leaves

nab_python/_lockfile/requirements.py

@@ -11,6 +11,9 @@ from __future__ import annotations
 
 from pathlib import Path
 from typing import TYPE_CHECKING
+from urllib.parse import quote
+
+from .builder import require_artifact_hashes
 
 if TYPE_CHECKING:
     import os
@@ -38,6 +41,7 @@ def write_requirements_with_hashes(
     ``#subdirectory=`` fragment.  Returns the text and, when
     ``output_path`` is provided, atomically writes it.
     """
+    require_artifact_hashes(lock_input)
     return _render_requirements(lock_input, with_hashes=True, output_path=output_path)
 
 
@@ -101,7 +105,7 @@ def _render_pins(pins: Mapping[str, PinShape], *, with_hashes: bool) -> list[str
         elif isinstance(pin, LocalPin):
             url = Path(pin.path).resolve().as_uri()
             if pin.subdirectory is not None:
-                url += f"#subdirectory={pin.subdirectory}"
+                url += f"#subdirectory={quote(pin.subdirectory, safe='/')}"
             if pin.editable:
                 lines.append(f"-e {url}")
             else:

nab_python/_provider/build_remote.py

@@ -22,12 +22,13 @@ from typing import TYPE_CHECKING
 
 from nab_index.client import SdistFile, WheelFile, extract_sdist_archive
 
+from .._vendor.packaging.specifiers import SpecifierSet
 from .._vendor.packaging.utils import canonicalize_name
+from .._vendor.packaging.version import Version
 
 if TYPE_CHECKING:
     from collections.abc import Sequence
 
-    from .._vendor.packaging.version import Version
     from ..metadata import WheelMetadata
     from ..provider import Provider
 
@@ -40,7 +41,14 @@ def build_remote_sdist(
     """Download the sdist for ``(package, version)``, extract, and build.
 
     ``package`` is the canonical package name; ``version`` matches an
-    entry in ``provider.versions_cache``.
+    entry in ``provider.versions_cache``.  A built sdist whose
+    ``Requires-Python`` excludes the resolve target is rejected, since the
+    Simple-API listing filter only sees the listing's own (possibly absent)
+    Requires-Python, not the value the build produces.  A per-package
+    ``requires-python`` metadata override substitutes for the built value
+    here, matching the listing gate.  A built sdist whose declared name or
+    version disagrees with the requested candidate is also rejected rather
+    than used for the wrong package.
     """
     # Late imports: ``provider`` imports this module at module load.
     from .. import build_backend
@@ -58,8 +66,15 @@ def build_remote_sdist(
         raise UnsupportedSdistError(msg)
 
     ver_str = str(version)
-    event = provider.coordinator.request_sdist_archive(canonical, ver_str, sdist.url)
+    event = provider.coordinator.request_sdist_archive(
+        canonical, ver_str, sdist.url, sdist.hashes
+    )
     event.wait()
+    integrity_error = provider.coordinator.index.get_sdist_archive_error(
+        canonical, ver_str
+    )
+    if integrity_error is not None:
+        raise integrity_error
     data = provider.coordinator.index.get_sdist_archive(canonical, ver_str)
     if data is None:
         msg = (
@@ -75,7 +90,7 @@ def build_remote_sdist(
             msg = f"{package}=={version} sdist archive could not be extracted: {exc}"
             raise UnsupportedSdistError(msg) from exc
         try:
-            return build_backend.extract_metadata(
+            built = build_backend.extract_metadata(
                 source_dir,
                 config=provider.build_config,
                 python_version=provider.python_version,
@@ -84,6 +99,26 @@ def build_remote_sdist(
             msg = f"{package}=={version} build-remote backend failed: {exc}"
             raise UnsupportedSdistError(msg) from exc
 
+    target = provider.python_version
+    override_rp = provider.effective_requires_python(canonical, version)
+    spec = (
+        SpecifierSet(override_rp) if override_rp is not None else built.requires_python
+    )
+    if spec is not None and target and Version(target) not in spec:
+        msg = (
+            f"{package}=={version} built sdist requires Python {spec} but the"
+            f" resolve targets Python {target}"
+        )
+        raise UnsupportedSdistError(msg)
+    if canonicalize_name(built.name) != canonical or built.version != version:
+        msg = (
+            f"{package}=={version} built sdist declares"
+            f" {built.name}=={built.version}, which does not match the"
+            " requested candidate"
+        )
+        raise UnsupportedSdistError(msg)
+    return built
+
 
 def _find_sdist(
     versions: Sequence[tuple[Version, WheelFile | SdistFile]],

nab_python/_provider/extras.py

@@ -13,6 +13,7 @@ import logging
 from typing import TYPE_CHECKING
 
 from .._vendor.packaging.ranges import VersionRange
+from .metadata_resolver import refuse_url_dep
 
 if TYPE_CHECKING:
     from nab_resolver.types import RangeProtocol
@@ -187,6 +188,11 @@ def get_extra_dependencies(
         msg = f"No metadata cached for {base}=={version}"
         raise MetadataError(msg)
 
+    deferred = provider.deferred_url_extras.get(base_cache_key, {}).get(extra)
+    if deferred:
+        req, url = deferred[0]
+        refuse_url_dep(provider, req, url)
+
     extra_map = provider.extra_deps_map.get(base_cache_key, {})
     if extra not in extra_map:
         return handle_missing_extra(provider, normalized, extra, version, cache_key)