pex 2.103.0__tar.gz → 2.103.2__tar.gz

{pex-2.103.0 → pex-2.103.2}/CHANGES.md

@@ -1,5 +1,24 @@
 # Release Notes
 
+## 2.103.2
+
+This release fixes `pex3 venv create --link-python` for a foreign platform when the venv is
+installed from a `--pex-repository`. Populating the venv's sources re-resolved the repository PEX
+against a local interpreter, which fails whenever that PEX holds no distributions for it, as is the
+case for a PEX built for the foreign platform alone. The distributions already resolved for the
+target are now used instead.
+
+* Fix `pex3 venv create --link-python` for `--pex-repository`. (#3286)
+
+## 2.103.1
+
+This releases fixes import hygiene in the PEX runtime surrounding use of HTTPS fetches. These only
+occur when creating venvs via `PEX_TOOLS=1` when using a system interpreter without the `ensurepip`
+module. A practical benefit is runtime support for normal PEX use on interpreters without the `ssl`
+module.
+
+* Isolate `URLFetcher` use in the PEX runtime. (#3283)
+
 ## 2.103.0
 
 This release adds `pex3 venv create --link-python`, which points the created venv's Python at a

{pex-2.103.0 → pex-2.103.2}/PKG-INFO

@@ -1,15 +1,15 @@
 Metadata-Version: 2.4
 Name: pex
-Version: 2.103.0
+Version: 2.103.2
 Summary: The PEX packaging toolchain.
 Home-page: https://github.com/pex-tool/pex
-Download-URL: https://github.com/pex-tool/pex/releases/download/v2.103.0/pex
+Download-URL: https://github.com/pex-tool/pex/releases/download/v2.103.2/pex
 Author: The PEX developers
 Author-email: developers@pex-tool.org
 License-Expression: Apache-2.0
-Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.103.0/CHANGES.md
+Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.103.2/CHANGES.md
 Project-URL: Documentation, https://docs.pex-tool.org/
-Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.103.0
+Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.103.2
 Keywords: package,executable,virtualenv,lock,freeze
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers

{pex-2.103.0 → pex-2.103.2}/pex/cache/dirs.py

@@ -190,7 +190,7 @@ class CacheDir(Enum["CacheDir.Value"]):
 
     PIP = Value(
         "pip",
-        version=3,
+        version=4,
         name="Pip Versions",
         description="Isolated Pip caches and Pip PEXes Pex uses to resolve distributions.",
         dependencies=[INSTALLED_WHEELS],
@@ -255,7 +255,7 @@ class CacheDir(Enum["CacheDir.Value"]):
 
     UNZIPPED_PEXES = Value(
         "unzipped_pexes",
-        version=3,
+        version=4,
         name="Unzipped PEXes",
         description="The unzipped PEX files executed on this machine.",
         dependencies=[BOOTSTRAPS, USER_CODE, INSTALLED_WHEELS],
@@ -263,7 +263,7 @@ class CacheDir(Enum["CacheDir.Value"]):
 
     VENVS = Value(
         "venvs",
-        version=3,
+        version=4,
         name="Virtual Environments",
         description="Virtual environments generated at runtime for `--venv` mode PEXes.",
         dependencies=[INSTALLED_WHEELS],

{pex-2.103.0 → pex-2.103.2}/pex/cli/commands/venv.py

@@ -42,7 +42,7 @@ from pex.venv.installer_configuration import InstallerConfiguration
 from pex.venv.virtualenv import Virtualenv
 
 if TYPE_CHECKING:
-    from typing import Any, Dict, Iterable, Optional, Sequence, Union
+    from typing import Any, Dict, Optional, Sequence, Union
 
 
 logger = logging.getLogger(__name__)
@@ -495,7 +495,7 @@ def _install_from_pex(
     pex,  # type: PEX
     installer_configuration,  # type: InstallerConfiguration
     provenance,  # type: Provenance
-    distributions,  # type: Iterable[Distribution]
+    distributions,  # type: Sequence[Distribution]
     dest_dir,  # type: str
     hermetic_scripts,  # type: bool
     venv=None,  # type: Optional[Virtualenv]
@@ -531,6 +531,7 @@ def _install_from_pex(
                 venv=venv,
                 pex=pex,
                 provenance=provenance,
+                activated_dists=distributions,
                 bin_path=installer_configuration.bin_path,
                 hermetic_scripts=hermetic_scripts,
             )

{pex-2.103.0 → pex-2.103.2}/pex/compatibility.py

@@ -121,23 +121,12 @@ else:
 
 
 if PY3:
-    from http.client import HTTPConnection as HTTPConnection
-    from http.client import HTTPResponse as HTTPResponse
     from urllib import parse as _url_parse
     from urllib.error import HTTPError as HTTPError
     from urllib.parse import quote as _url_quote
     from urllib.parse import quote_plus as _url_quote_plus
     from urllib.parse import unquote as _url_unquote
     from urllib.parse import unquote_plus as _url_unquote_plus
-    from urllib.request import AbstractHTTPHandler as AbstractHTTPHandler
-    from urllib.request import FileHandler as FileHandler
-    from urllib.request import HTTPBasicAuthHandler as HTTPBasicAuthHandler
-    from urllib.request import HTTPDigestAuthHandler as HTTPDigestAuthHandler
-    from urllib.request import HTTPPasswordMgrWithDefaultRealm as HTTPPasswordMgrWithDefaultRealm
-    from urllib.request import HTTPSHandler as HTTPSHandler
-    from urllib.request import ProxyHandler as ProxyHandler
-    from urllib.request import Request as Request
-    from urllib.request import build_opener as build_opener
 else:
     from urllib import quote as _url_quote
     from urllib import quote_plus as _url_quote_plus
@@ -145,18 +134,7 @@ else:
     from urllib import unquote_plus as _url_unquote_plus
 
     import urlparse as _url_parse
-    from httplib import HTTPConnection as HTTPConnection
-    from httplib import HTTPResponse as HTTPResponse
-    from urllib2 import AbstractHTTPHandler as AbstractHTTPHandler
-    from urllib2 import FileHandler as FileHandler
-    from urllib2 import HTTPBasicAuthHandler as HTTPBasicAuthHandler
-    from urllib2 import HTTPDigestAuthHandler as HTTPDigestAuthHandler
     from urllib2 import HTTPError as HTTPError
-    from urllib2 import HTTPPasswordMgrWithDefaultRealm as HTTPPasswordMgrWithDefaultRealm
-    from urllib2 import HTTPSHandler as HTTPSHandler
-    from urllib2 import ProxyHandler as ProxyHandler
-    from urllib2 import Request as Request
-    from urllib2 import build_opener as build_opener
 
 urlparse = _url_parse
 url_unquote = _url_unquote

pex-2.103.2/pex/fetcher/__init__.py

@@ -0,0 +1,9 @@
+# Copyright 2026 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+from pex.fetcher.ssl import initialize_ssl_context
+from pex.fetcher.url import URLFetcher
+
+__all__ = ["URLFetcher", "initialize_ssl_context"]

pex-2.103.2/pex/fetcher/ssl.py

@@ -0,0 +1,131 @@
+# Copyright 2026 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+import contextlib
+import os
+import sys
+import threading
+from contextlib import contextmanager
+
+from pex.compatibility import in_main_thread
+from pex.exceptions import production_assert
+from pex.network_configuration import NetworkConfiguration
+from pex.typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from ssl import SSLContext
+    from typing import Dict, Iterator, Optional
+
+    import attr  # vendor:skip
+else:
+    from pex.third_party import attr
+
+
+@contextmanager
+def guard_stdout():
+    # type: () -> Iterator[None]
+    # Under PyPy 3.9 and 3.10, `ssl.create_default_context` causes spurious informational text about
+    # SSL certs to be emitted to stdout; so we squelch this.
+    if hasattr(sys, "pypy_version_info") and sys.version_info[:2] >= (3, 9):
+        with open(os.devnull, "w") as fp:
+            # The `contextlib.redirect_stdout` function is available for Python 3.4+.
+            with contextlib.redirect_stdout(fp):  # type: ignore[attr-defined]
+                yield
+    else:
+        yield
+
+
+@attr.s(frozen=True)
+class _CertConfig(object):
+    @classmethod
+    def create(cls, network_configuration=None):
+        # type: (Optional[NetworkConfiguration]) -> _CertConfig
+        if network_configuration is None:
+            return cls()
+        return cls(cert=network_configuration.cert, client_cert=network_configuration.client_cert)
+
+    cert = attr.ib(default=None)  # type: Optional[str]
+    client_cert = attr.ib(default=None)  # type: Optional[str]
+
+    def create_ssl_context(self):
+        # type: () -> SSLContext
+
+        # These shenanigans deserve some explanation, since, in OpenSSL 3.0 anyhow, it is perfectly
+        # fine to create an SSL Context (`SSL_CTX_new`) in any thread:
+        #
+        # It turns out that, in typical use, the CPython ssl module hides OpenSSL configuration
+        # issues through no real fault of its own. This is due to the fact that an import of the
+        # `ssl` module, which generally happens in the main thread, triggers, through instantiation
+        # of the `ssl.Purpose` enum type [^1] a call to OpenSSL's `OBJ_obj2nid` [^2][^3] which
+        # loads OpenSSL config but throws away the return value; thus hiding errors in config. Since
+        # the OpenSSL config scheme is to load it at most once per thread, this means subsequent
+        # OpenSSL call paths in the same thread that imported `ssl` (like the one generated via
+        # `ssl.create_default_context`) that _do_ check the return value of config loading [^4][^5],
+        # will not have to load config (since it's been done once already in the thread) and thus
+        # will not get the chance to check the config load function return value and will thus not
+        # error. This default behavior is almost certainly bad, since it allows invalid OpenSSL
+        # configs to go partially read at best. That said, this is the default Python
+        # single-threaded behavior and, right or wrong, we preserve that here by forcing our SSL
+        # initialization to happen in the main thread, keeping any OpenSSL misconfiguration silently
+        # ignored.
+        #
+        # The only solace here is that the use cases where OpenSSL config can be bad on a machine
+        # and the machine still function are narrow. The case we know of, that triggered creation of
+        # this machinery, involves the combination of a modern PBS Python [^6] (which has a vanilla
+        # OpenSSL statically linked into the Python binary) running on a RedHat OS that expresses
+        # custom RedHat configuration keys [^7] in its OpenSSL config. These custom keys are only
+        # supported by RedHat patches to OpenSSL and cause vanilla versions of OpenSSL to error when
+        # loading config due to unknown configuration options.
+        #
+        # [^1]: https://github.com/python/cpython/blob/5a173efa693a053bf4a059c82c1c06c82a9fa8fb/Lib/ssl.py#L394-L419
+        # [^2]: https://github.com/python/cpython/blob/5a173efa693a053bf4a059c82c1c06c82a9fa8fb/Modules/_ssl.c#L5534-L5552
+        # [^3]: https://github.com/openssl/openssl/blob/c3cc0f1386b0544383a61244a4beeb762b67498f/crypto/objects/obj_dat.c#L326-L340
+        # [^4]: https://github.com/openssl/openssl/blob/c3cc0f1386b0544383a61244a4beeb762b67498f/ssl/ssl_lib.c#L3194-L3212
+        # [^5]: https://github.com/openssl/openssl/blob/c3cc0f1386b0544383a61244a4beeb762b67498f/ssl/ssl_init.c#L86-L116
+        # [^6]: https://github.com/astral-sh/python-build-standalone/releases/tag/20240107
+        # [^7]: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/110/diffs#269a48e71ac25ad1d07ff00db2390834c8ba7596_11_16
+        production_assert(
+            in_main_thread(),
+            "An SSLContext must be initialized from the main thread. An attempt was made to "
+            "initialize an SSLContext for {cert_config} from thread {thread}.",
+            cert_config=self,
+            thread=threading.current_thread(),
+        )
+        with guard_stdout():
+            # We import ssl lazily as an affordance to PEXes that use gevent SSL monkeypatching,
+            # which requires (and checks) that the `ssl` module is not imported priory to the
+            # `from gevent import monkey; monkey.patch_all()` call.
+            #
+            # See: https://github.com/pex-tool/pex/issues/2415
+            import ssl
+
+            ssl_context = ssl.create_default_context(cafile=self.cert)
+            if self.client_cert:
+                ssl_context.load_cert_chain(self.client_cert)
+            return ssl_context
+
+
+_SSL_CONTEXTS = {}  # type: Dict[_CertConfig, SSLContext]
+
+
+def get_ssl_context(network_configuration=None):
+    # type: (Optional[NetworkConfiguration]) -> SSLContext
+    cert_config = _CertConfig.create(network_configuration=network_configuration)
+    ssl_context = _SSL_CONTEXTS.get(cert_config)
+    if not ssl_context:
+        ssl_context = cert_config.create_ssl_context()
+        _SSL_CONTEXTS[cert_config] = ssl_context
+    return ssl_context
+
+
+def initialize_ssl_context(network_configuration=None):
+    # type: (Optional[NetworkConfiguration]) -> None
+    get_ssl_context(network_configuration=network_configuration)
+
+
+# N.B.: We eagerly initialize an SSLContext for the default case of no CA cert and no client cert.
+# When a custom CA cert or client cert or both are configured, that code will need to call
+# initialize_ssl_context on its own.
+initialize_ssl_context()

pex-2.103.0/pex/fetcher.py → pex-2.103.2/pex/fetcher/url.py

@@ -3,153 +3,47 @@
 
 from __future__ import absolute_import
 
-import contextlib
 import os
 import socket
-import sys
-import threading
 import time
 from contextlib import closing, contextmanager
 
 from pex.auth import PasswordDatabase, PasswordEntry
-from pex.compatibility import (
-    PY2,
-    AbstractHTTPHandler,
-    FileHandler,
-    HTTPBasicAuthHandler,
-    HTTPConnection,
-    HTTPDigestAuthHandler,
-    HTTPError,
-    HTTPPasswordMgrWithDefaultRealm,
-    HTTPResponse,
-    HTTPSHandler,
-    ProxyHandler,
-    Request,
-    build_opener,
-    in_main_thread,
-    urlparse,
-)
-from pex.exceptions import production_assert
+from pex.compatibility import PY2, PY3, HTTPError, urlparse
+from pex.fetcher.ssl import get_ssl_context
 from pex.network_configuration import NetworkConfiguration
 from pex.typing import TYPE_CHECKING, cast
 from pex.version import __version__
 
-if TYPE_CHECKING:
-    from ssl import SSLContext
-    from typing import Any, BinaryIO, Dict, Iterable, Iterator, Mapping, Optional, Text
-
-    import attr  # vendor:skip
+if PY3:
+    from http.client import HTTPConnection, HTTPResponse
+    from urllib.request import (
+        AbstractHTTPHandler,
+        FileHandler,
+        HTTPBasicAuthHandler,
+        HTTPDigestAuthHandler,
+        HTTPPasswordMgrWithDefaultRealm,
+        HTTPSHandler,
+        ProxyHandler,
+        Request,
+        build_opener,
+    )
 else:
-    BinaryIO = None
-    from pex.third_party import attr
-
-
-@contextmanager
-def guard_stdout():
-    # type: () -> Iterator[None]
-    # Under PyPy 3.9 and 3.10, `ssl.create_default_context` causes spurious informational text about
-    # SSL certs to be emitted to stdout; so we squelch this.
-    if hasattr(sys, "pypy_version_info") and sys.version_info[:2] >= (3, 9):
-        with open(os.devnull, "w") as fp:
-            # The `contextlib.redirect_stdout` function is available for Python 3.4+.
-            with contextlib.redirect_stdout(fp):  # type: ignore[attr-defined]
-                yield
-    else:
-        yield
-
-
-@attr.s(frozen=True)
-class _CertConfig(object):
-    @classmethod
-    def create(cls, network_configuration=None):
-        # type: (Optional[NetworkConfiguration]) -> _CertConfig
-        if network_configuration is None:
-            return cls()
-        return cls(cert=network_configuration.cert, client_cert=network_configuration.client_cert)
-
-    cert = attr.ib(default=None)  # type: Optional[str]
-    client_cert = attr.ib(default=None)  # type: Optional[str]
-
-    def create_ssl_context(self):
-        # type: () -> SSLContext
-
-        # These shenanigans deserve some explanation, since, in OpenSSL 3.0 anyhow, it is perfectly
-        # fine to create an SSL Context (`SSL_CTX_new`) in any thread:
-        #
-        # It turns out that, in typical use, the CPython ssl module hides OpenSSL configuration
-        # issues through no real fault of its own. This is due to the fact that an import of the
-        # `ssl` module, which generally happens in the main thread, triggers, through instantiation
-        # of the `ssl.Purpose` enum type [^1] a call to OpenSSL's `OBJ_obj2nid` [^2][^3] which
-        # loads OpenSSL config but throws away the return value; thus hiding errors in config. Since
-        # the OpenSSL config scheme is to load it at most once per thread, this means subsequent
-        # OpenSSL call paths in the same thread that imported `ssl` (like the one generated via
-        # `ssl.create_default_context`) that _do_ check the return value of config loading [^4][^5],
-        # will not have to load config (since it's been done once already in the thread) and thus
-        # will not get the chance to check the config load function return value and will thus not
-        # error. This default behavior is almost certainly bad, since it allows invalid OpenSSL
-        # configs to go partially read at best. That said, this is the default Python
-        # single-threaded behavior and, right or wrong, we preserve that here by forcing our SSL
-        # initialization to happen in the main thread, keeping any OpenSSL misconfiguration silently
-        # ignored.
-        #
-        # The only solace here is that the use cases where OpenSSL config can be bad on a machine
-        # and the machine still function are narrow. The case we know of, that triggered creation of
-        # this machinery, involves the combination of a modern PBS Python [^6] (which has a vanilla
-        # OpenSSL statically linked into the Python binary) running on a RedHat OS that expresses
-        # custom RedHat configuration keys [^7] in its OpenSSL config. These custom keys are only
-        # supported by RedHat patches to OpenSSL and cause vanilla versions of OpenSSL to error when
-        # loading config due to unknown configuration options.
-        #
-        # [^1]: https://github.com/python/cpython/blob/5a173efa693a053bf4a059c82c1c06c82a9fa8fb/Lib/ssl.py#L394-L419
-        # [^2]: https://github.com/python/cpython/blob/5a173efa693a053bf4a059c82c1c06c82a9fa8fb/Modules/_ssl.c#L5534-L5552
-        # [^3]: https://github.com/openssl/openssl/blob/c3cc0f1386b0544383a61244a4beeb762b67498f/crypto/objects/obj_dat.c#L326-L340
-        # [^4]: https://github.com/openssl/openssl/blob/c3cc0f1386b0544383a61244a4beeb762b67498f/ssl/ssl_lib.c#L3194-L3212
-        # [^5]: https://github.com/openssl/openssl/blob/c3cc0f1386b0544383a61244a4beeb762b67498f/ssl/ssl_init.c#L86-L116
-        # [^6]: https://github.com/astral-sh/python-build-standalone/releases/tag/20240107
-        # [^7]: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/110/diffs#269a48e71ac25ad1d07ff00db2390834c8ba7596_11_16
-        production_assert(
-            in_main_thread(),
-            "An SSLContext must be initialized from the main thread. An attempt was made to "
-            "initialize an SSLContext for {cert_config} from thread {thread}.",
-            cert_config=self,
-            thread=threading.current_thread(),
-        )
-        with guard_stdout():
-            # We import ssl lazily as an affordance to PEXes that use gevent SSL monkeypatching,
-            # which requires (and checks) that the `ssl` module is not imported priory to the
-            # `from gevent import monkey; monkey.patch_all()` call.
-            #
-            # See: https://github.com/pex-tool/pex/issues/2415
-            import ssl
-
-            ssl_context = ssl.create_default_context(cafile=self.cert)
-            if self.client_cert:
-                ssl_context.load_cert_chain(self.client_cert)
-            return ssl_context
-
-
-_SSL_CONTEXTS = {}  # type: Dict[_CertConfig, SSLContext]
+    from httplib import HTTPConnection, HTTPResponse
+    from urllib2 import (
+        AbstractHTTPHandler,
+        FileHandler,
+        HTTPBasicAuthHandler,
+        HTTPDigestAuthHandler,
+        HTTPPasswordMgrWithDefaultRealm,
+        HTTPSHandler,
+        ProxyHandler,
+        Request,
+        build_opener,
+    )
 
-
-def get_ssl_context(network_configuration=None):
-    # type: (Optional[NetworkConfiguration]) -> SSLContext
-    cert_config = _CertConfig.create(network_configuration=network_configuration)
-    ssl_context = _SSL_CONTEXTS.get(cert_config)
-    if not ssl_context:
-        ssl_context = cert_config.create_ssl_context()
-        _SSL_CONTEXTS[cert_config] = ssl_context
-    return ssl_context
-
-
-def initialize_ssl_context(network_configuration=None):
-    # type: (Optional[NetworkConfiguration]) -> None
-    get_ssl_context(network_configuration=network_configuration)
-
-
-# N.B.: We eagerly initialize an SSLContext for the default case of no CA cert and no client cert.
-# When a custom CA cert or client cert or both are configured, that code will need to call
-# initialize_ssl_context on its own.
-initialize_ssl_context()
+if TYPE_CHECKING:
+    from typing import Any, BinaryIO, Dict, Iterable, Iterator, Mapping, Optional, Text
 
 
 class UnixHTTPConnection(HTTPConnection):
@@ -334,7 +228,7 @@ class URLFetcher(object):
             # The fp is typed as Optional[...] for Python 2 only in the typeshed. A `None`
             # can only be returned if a faulty custom handler is installed and we only
             # install stdlib handlers.
-            fp = cast(BinaryIO, opener.open(request, timeout=self._timeout))
+            fp = cast("BinaryIO", opener.open(request, timeout=self._timeout))
             try:
                 with closing(fp) as body_stream:
                     yield body_stream

{pex-2.103.0 → pex-2.103.2}/pex/pex_builder.py

@@ -568,7 +568,7 @@ class PEXBuilder(object):
         )
 
         bootstrap_digest = hashlib.sha1()
-        bootstrap_packages = ["cache", "fs", "repl", "third_party", "venv", "windows"]
+        bootstrap_packages = ["cache", "fetcher", "fs", "repl", "third_party", "venv", "windows"]
         if self._pex_info.includes_tools:
             bootstrap_packages.extend(["commands", "tools"])
 

{pex-2.103.0 → pex-2.103.2}/pex/requirements.py

@@ -19,7 +19,6 @@ from pex.dist_metadata import (
     Requirement,
     RequirementParseError,
 )
-from pex.fetcher import URLFetcher
 from pex.orderedset import OrderedSet
 from pex.pep_503 import ProjectName
 from pex.third_party.packaging.markers import Marker
@@ -31,6 +30,8 @@ if TYPE_CHECKING:
     from typing import FrozenSet, Iterable, Iterator, Match, Optional, Text, Tuple, Union
 
     import attr  # vendor:skip
+
+    from pex.fetcher import URLFetcher
 else:
     from pex.third_party import attr
 

{pex-2.103.0 → pex-2.103.2}/pex/venv/installer.py

@@ -360,6 +360,7 @@ def populate_venv_sources(
     venv,  # type: Virtualenv
     pex,  # type: PEX
     provenance,  # type: Provenance
+    activated_dists,  # type: Sequence[Distribution]
     bin_path=BinPath.FALSE,  # type: BinPath.Value
     hermetic_scripts=True,  # type: bool
     shebang=None,  # type: Optional[str]
@@ -373,6 +374,7 @@ def populate_venv_sources(
             target_dir=provenance.target_dir,
             venv=venv,
             pex=pex,
+            activated_dists=activated_dists,
             shebang=shebang,
             venv_python=provenance.target_python,
             bin_path=bin_path,
@@ -420,10 +422,11 @@ def populate_venv_from_pex(
     shebang = provenance.calculate_shebang(hermetic_scripts=hermetic_scripts)
     top_level_source_packages = tuple(iter_top_level_source_packages(pex))
 
+    distributions = tuple(pex.resolve())
     if scope in (InstallScope.ALL, InstallScope.DEPS_ONLY):
         populate_venv_distributions(
             venv=venv,
-            distributions=pex.resolve(),
+            distributions=distributions,
             copy_mode=copy_mode,
             hermetic_scripts=hermetic_scripts,
             provenance=provenance,
@@ -434,6 +437,7 @@ def populate_venv_from_pex(
         populate_venv_sources(
             venv=venv,
             pex=pex,
+            activated_dists=distributions,
             bin_path=bin_path,
             hermetic_scripts=hermetic_scripts,
             provenance=provenance,
@@ -745,6 +749,7 @@ def _populate_first_party(
     target_dir,  # type: str
     venv,  # type: Virtualenv
     pex,  # type: PEX
+    activated_dists,  # type: Sequence[Distribution]
     shebang,  # type: str
     venv_python,  # type: str
     bin_path,  # type: BinPath.Value
@@ -764,7 +769,7 @@ def _populate_first_party(
         target_dir=target_dir,
         venv=venv,
         pex_info=pex_info,
-        activated_dists=tuple(pex.resolve()),
+        activated_dists=activated_dists,
         shebang=shebang,
         venv_python=venv_python,
         bin_path=bin_path,

{pex-2.103.0 → pex-2.103.2}/pex/venv/virtualenv.py

@@ -20,7 +20,6 @@ from pex.compatibility import get_stdout_bytes_buffer, safe_commonpath
 from pex.dist_metadata import Distribution, find_distributions
 from pex.enum import Enum
 from pex.executor import Executor
-from pex.fetcher import URLFetcher
 from pex.fs import safe_symlink
 from pex.interpreter import (
     Platlib,
@@ -608,6 +607,8 @@ class Virtualenv(object):
             get_pip = os.path.join(ENV.PEX_ROOT, "get-pip", dst_rel_path)
             with atomic_directory(os.path.dirname(get_pip)) as atomic_dir:
                 if not atomic_dir.is_finalized():
+                    from pex.fetcher import URLFetcher
+
                     with URLFetcher().get_body_stream(
                         "https://bootstrap.pypa.io/pip/" + url_rel_path
                     ) as src_fp, safe_open(

{pex-2.103.0 → pex-2.103.2}/pex/version.py

@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.103.0"
+__version__ = "2.103.2"

{pex-2.103.0 → pex-2.103.2}/pex/windows/__init__.py

@@ -14,7 +14,6 @@ from pex.atomic_directory import atomic_directory
 from pex.cache.dirs import CacheDir
 from pex.common import open_zip, safe_open
 from pex.executables import chmod_plus_x
-from pex.fetcher import URLFetcher
 from pex.fs import safe_rename
 from pex.os import Os
 from pex.sysconfig import SysPlatform
@@ -67,6 +66,8 @@ def _fetch_stub(stub_name):
     stub_dir = os.path.join(_CACHE_DIR, stub_name)
     with atomic_directory(stub_dir) as atomic_dir:
         if not atomic_dir.is_finalized():
+            from pex.fetcher import URLFetcher
+
             with URLFetcher().get_body_stream(
                 "https://raw.githubusercontent.com/astral-sh/uv/refs/tags/{version}/crates/"
                 "uv-trampoline/trampolines/{stub_name}".format(

{pex-2.103.0 → pex-2.103.2}/tests/integration/cli/commands/test_venv_create.py

@@ -639,6 +639,48 @@ def test_foreign_target_link_python(
     assert_foreign_venv(3, 11, expect_pyvenv_cfg_executable=link_python)
 
 
+@pytest.mark.skipif(IS_WINDOWS, reason="This feature is not supported on Windows.")
+def test_foreign_target_link_python_from_pex_repository(
+    tmpdir,  # type: Tempdir
+    py310,  # type: PythonInterpreter
+):
+    # type: (...) -> None
+
+    foreign_platform = cross_arch_platform(3, 10)
+    pex_repository = tmpdir.join("psutil.pex")
+    run_pex_command(
+        args=["psutil==7.2.2", "--platform", foreign_platform, "-o", pex_repository]
+    ).assert_success()
+
+    venv_dir = tmpdir.join("venv")
+    link_python = "/opt/python/bin/bob"
+    run_pex3(
+        "venv",
+        "create",
+        "-d",
+        venv_dir,
+        "--pex-repository",
+        pex_repository,
+        "--platform",
+        foreign_platform,
+        "--python-path",
+        py310.binary,
+        "--link-python",
+        link_python,
+    ).assert_success()
+
+    assert {link_python} == {
+        os.readlink(python) for python in glob.glob(os.path.join(venv_dir, "bin", "python*"))
+    }
+
+    site_packages = os.path.join(
+        venv_dir, SysPlatform.CURRENT.venv_lib_dir(version=(3, 10)), "site-packages"
+    )
+    distributions = list(dist_metadata.find_distributions(search_path=[site_packages]))
+    assert 1 == len(distributions)
+    assert ProjectName("psutil") == distributions[0].metadata.project_name
+
+
 def test_venv_update_target_mismatch(
     tmpdir,  # type: Any
     foreign_platform,  # type: str