pex 2.61.0__tar.gz → 2.61.1__tar.gz

{pex-2.61.0 → pex-2.61.1}/CHANGES.md

@@ -1,5 +1,13 @@
 # Release Notes
 
+## 2.61.1
+
+This release fixes a long standing bug hashing local project directories when building PEXes. Pex
+now hashes the content of an exploded sdist for the local project just like it does when hashing
+local projects for a lock.
+
+* Fix local project directory hashing. (#2954)
+
 ## 2.61.0
 
 This release adds support for the Python 3.15 series early. Pex runs on 3.15.0a1, can produce scies

{pex-2.61.0 → pex-2.61.1}/PKG-INFO

@@ -1,15 +1,15 @@
 Metadata-Version: 2.4
 Name: pex
-Version: 2.61.0
+Version: 2.61.1
 Summary: The PEX packaging toolchain.
 Home-page: https://github.com/pex-tool/pex
-Download-URL: https://github.com/pex-tool/pex/releases/download/v2.61.0/pex
+Download-URL: https://github.com/pex-tool/pex/releases/download/v2.61.1/pex
 Author: The PEX developers
 Author-email: developers@pex-tool.org
 License-Expression: Apache-2.0
-Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.61.0/CHANGES.md
+Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.61.1/CHANGES.md
 Project-URL: Documentation, https://docs.pex-tool.org/
-Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.61.0
+Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.61.1
 Keywords: package,executable,virtualenv,lock,freeze
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers

{pex-2.61.0 → pex-2.61.1}/pex/cache/dirs.py

@@ -729,7 +729,7 @@ class BuiltWheelDir(AtomicCacheDir):
 
         from pex.dist_metadata import ProjectNameAndVersion, UnrecognizedDistributionFormat
 
-        for path in glob.glob(CacheDir.BUILT_WHEELS.path("sdists", "*", "*")):
+        for path in glob.glob(CacheDir.BUILT_WHEELS.path("sdists", "*", "*", pex_root=pex_root)):
             sdist, fingerprint = os.path.split(path)
             try:
                 pnav = ProjectNameAndVersion.from_filename(sdist)
@@ -745,7 +745,7 @@ class BuiltWheelDir(AtomicCacheDir):
                     yield BuiltWheelDir(path=dist_dir, dist_dir=dist_dir, file_name=file_name)
 
         for built_wheel in glob.glob(
-            CacheDir.BUILT_WHEELS.path("local_projects", "*", "*", "*", "*")
+            CacheDir.BUILT_WHEELS.path("local_projects", "*", "*", "*", "*", pex_root=pex_root)
         ):
             file_name = os.path.basename(built_wheel)
             dist_dir = os.path.dirname(built_wheel)
@@ -755,26 +755,21 @@ class BuiltWheelDir(AtomicCacheDir):
     def create(
         cls,
         sdist,  # type: str
-        fingerprint=None,  # type: Optional[str]
+        fingerprint,  # type: str
         pnav=None,  # type: Optional[ProjectNameAndVersion]
         target=None,  # type: Optional[Target]
         pex_root=ENV,  # type: Union[str, Variables]
     ):
         # type: (...) -> BuiltWheelDir
 
-        import hashlib
-
         from pex import targets
         from pex.dist_metadata import is_sdist
-        from pex.util import CacheHelper
 
         if is_sdist(sdist):
             dist_type = "sdists"
-            fingerprint = fingerprint or CacheHelper.hash(sdist, hasher=hashlib.sha256)
             file_name = os.path.basename(sdist)
         else:
             dist_type = "local_projects"
-            fingerprint = fingerprint or CacheHelper.dir_hash(sdist, hasher=hashlib.sha256)
             file_name = None
 
         # For the purposes of building a wheel from source, the product should be uniqued by the

{pex-2.61.0 → pex-2.61.1}/pex/cli/commands/pip/wheel.py

@@ -55,7 +55,7 @@ class Wheel(BuildTimeCommand):
                     core.build_wheels(
                         configuration,
                         tuple(
-                            BuildRequest.create(
+                            BuildRequest.for_file(
                                 target=target,
                                 source_path=sdist.path,
                                 subdirectory=sdist.subdirectory,

{pex-2.61.0 → pex-2.61.1}/pex/resolve/lockfile/create.py

@@ -333,12 +333,22 @@ class LockObserver(ResolveObserver):
                 dist_metadatas_by_download_target[local_distribution.download_target].add(
                     DistMetadata.load(local_distribution.path)
                 )
+            elif os.path.isfile(local_distribution.path):
+                build_requests.add(
+                    BuildRequest.for_file(
+                        target=local_distribution.download_target,
+                        source_path=local_distribution.path,
+                        subdirectory=local_distribution.subdirectory,
+                    )
+                )
             else:
                 build_requests.add(
-                    BuildRequest.create(
+                    BuildRequest.for_directory(
                         target=local_distribution.download_target,
                         source_path=local_distribution.path,
                         subdirectory=local_distribution.subdirectory,
+                        resolver=self.resolver,
+                        pip_version=self.package_index_configuration.pip_version,
                     )
                 )
 
@@ -348,7 +358,12 @@ class LockObserver(ResolveObserver):
         for analysis in self._analysis:
             lock_result = analysis.analyzer.lock_result
             build_requests.update(
-                BuildRequest.create(target=analysis.download_target, source_path=local_project)
+                BuildRequest.for_directory(
+                    target=analysis.download_target,
+                    source_path=local_project,
+                    resolver=self.resolver,
+                    pip_version=self.package_index_configuration.pip_version,
+                )
                 for local_project in lock_result.local_projects
             )
             resolved_requirements_by_download_target[

{pex-2.61.0 → pex-2.61.1}/pex/resolve/pre_resolved_resolver.py

@@ -39,7 +39,7 @@ from pex.typing import TYPE_CHECKING, cast
 from pex.util import CacheHelper
 
 if TYPE_CHECKING:
-    from typing import DefaultDict, Dict, Iterable, List, Tuple
+    from typing import DefaultDict, Dict, List, Sequence, Tuple
 
 
 def _fingerprint_dist(dist_path):
@@ -49,8 +49,8 @@ def _fingerprint_dist(dist_path):
 
 def resolve_from_dists(
     targets,  # type: Targets
-    sdists,  # type: Iterable[str]
-    wheels,  # type: Iterable[str]
+    sdists,  # type: Sequence[str]
+    wheels,  # type: Sequence[str]
     requirement_configuration,  # type: RequirementConfiguration
     pip_configuration=PipConfiguration(),  # type: PipConfiguration
     compile=False,  # type: bool
@@ -70,9 +70,6 @@ def resolve_from_dists(
         if isinstance(direct_requirement, LocalProjectRequirement):
             local_projects.append(direct_requirement)
 
-    source_paths = [local_project.path for local_project in local_projects] + list(
-        sdists
-    )  # type: List[str]
     with TRACER.timed("Fingerprinting pre-resolved wheels"):
         fingerprinted_wheels = tuple(
             FingerprintedDistribution(
@@ -94,7 +91,7 @@ def resolve_from_dists(
         fingerprinted_wheels and InstallableType.INSTALLED_WHEEL_CHROOT is result_type
     )
     with TRACER.timed("Preparing pre-resolved distributions"):
-        if source_paths or resolve_installed_wheel_chroots:
+        if sdists or local_projects or resolve_installed_wheel_chroots:
             package_index_configuration = PackageIndexConfiguration.create(
                 pip_version=pip_configuration.version,
                 resolver_version=pip_configuration.resolver_version,
@@ -104,12 +101,24 @@ def resolve_from_dists(
                 extra_pip_requirements=pip_configuration.extra_requirements,
                 keyring_provider=pip_configuration.keyring_provider,
             )
+            resolver = ConfiguredResolver(pip_configuration=pip_configuration)
+            build_requests = [
+                BuildRequest.for_file(target=target, source_path=sdist)
+                for sdist in sdists
+                for target in unique_targets
+            ]
+            build_requests.extend(
+                BuildRequest.for_directory(
+                    target=target,
+                    source_path=local_project.path,
+                    resolver=resolver,
+                    pip_version=pip_configuration.version,
+                )
+                for local_project in local_projects
+                for target in unique_targets
+            )
             build_and_install = BuildAndInstallRequest(
-                build_requests=[
-                    BuildRequest.create(target=target, source_path=source_path)
-                    for source_path in source_paths
-                    for target in unique_targets
-                ],
+                build_requests=build_requests,
                 install_requests=[
                     InstallRequest(
                         download_target=target,

{pex-2.61.0 → pex-2.61.1}/pex/resolver.py

@@ -46,6 +46,7 @@ from pex.pep_427 import InstallableType, WheelError, install_wheel_chroot
 from pex.pep_503 import ProjectName
 from pex.pip.download_observer import DownloadObserver
 from pex.pip.installation import get_pip
+from pex.pip.local_project import digest_local_project
 from pex.pip.tool import PackageIndexConfiguration
 from pex.pip.version import PipVersionValue
 from pex.requirements import LocalProjectRequirement, URLRequirement
@@ -261,8 +262,11 @@ class DownloadRequest(object):
         for requirement in self.direct_requirements:
             if isinstance(requirement, LocalProjectRequirement):
                 for download_target in self.download_targets:
-                    yield BuildRequest.create(
-                        target=download_target.target, source_path=requirement.path
+                    yield BuildRequest.for_directory(
+                        target=download_target.target,
+                        source_path=requirement.path,
+                        resolver=self.resolver,
+                        pip_version=self.pip_version,
                     )
 
     def download_distributions(self, dest=None, max_parallel_jobs=None):
@@ -396,7 +400,14 @@ class DownloadResult(object):
                 subdirectory = self.subdirectory_by_filename.get(
                     os.path.basename(distribution_path)
                 )
-                yield BuildRequest.create(
+                production_assert(
+                    os.path.isfile(distribution_path),
+                    (
+                        "Pip download results should always be files and never local project "
+                        "directories."
+                    ),
+                )
+                yield BuildRequest.for_file(
                     target=self.download_target,
                     source_path=distribution_path,
                     subdirectory=subdirectory,
@@ -415,26 +426,46 @@ class IntegrityError(Exception):
     pass
 
 
-def fingerprint_path(path):
+if TYPE_CHECKING:
+    from pex.hashing import Hasher
+
+
+def _hasher():
+    # type: () -> Hasher
+
+    return hashlib.sha256()
+
+
+def _fingerprint_file(path):
     # type: (str) -> str
+    return CacheHelper.hash(path, digest=_hasher())
+
+
+def _fingerprint_directory(path):
+    # type: (str) -> str
+    return CacheHelper.dir_hash(path, digest=_hasher())
 
-    # We switched from sha1 to sha256 at the transition from using `pip install --target` to
-    # `pip install --prefix` to serve two purposes:
-    # 1. Insulate the new installation scheme from the old.
-    # 2. Move past sha1 which was shown to have practical collision attacks in 2019.
-    #
-    # The installation scheme switch was the primary purpose and switching hashes proved a pragmatic
-    # insulation. If the `pip install --prefix` re-arrangement scheme evolves, then some other
-    # option than switching hashing algorithms will be needed, like post-fixing a running version
-    # integer or just mixing one into the hashed content.
-    #
-    # See: https://github.com/pex-tool/pex/issues/1655 for a general overview of these cache
-    # structure concerns.
-    hasher = hashlib.sha256
 
-    if os.path.isdir(path):
-        return CacheHelper.dir_hash(path, hasher=hasher)
-    return CacheHelper.hash(path, hasher=hasher)
+def _fingerprint_local_project(
+    path,  # type: str
+    target,  # type: Target
+    resolver=None,  # type: Optional[Resolver]
+    pip_version=None,  # type: Optional[PipVersionValue]
+):
+    if resolver:
+        build_system_resolver = resolver
+    else:
+        from pex.resolve.configured_resolver import ConfiguredResolver
+
+        build_system_resolver = ConfiguredResolver.default()
+
+    return digest_local_project(
+        directory=path,
+        digest=_hasher(),
+        target=target,
+        resolver=build_system_resolver,
+        pip_version=pip_version,
+    )
 
 
 class BuildError(Exception):
@@ -449,14 +480,14 @@ def _as_download_target(target):
 @attr.s(frozen=True)
 class BuildRequest(object):
     @classmethod
-    def create(
+    def for_file(
         cls,
         target,  # type: Union[DownloadTarget, Target]
         source_path,  # type: str
         subdirectory=None,  # type: Optional[str]
     ):
         # type: (...) -> BuildRequest
-        fingerprint = fingerprint_path(source_path)
+        fingerprint = _fingerprint_file(source_path)
         return cls(
             download_target=_as_download_target(target),
             source_path=source_path,
@@ -464,6 +495,30 @@ class BuildRequest(object):
             subdirectory=subdirectory,
         )
 
+    @classmethod
+    def for_directory(
+        cls,
+        target,  # type: Union[DownloadTarget, Target]
+        source_path,  # type: str
+        subdirectory=None,  # type: Optional[str]
+        resolver=None,  # type: Optional[Resolver]
+        pip_version=None,  # type: Optional[PipVersionValue]
+    ):
+        # type: (...) -> BuildRequest
+        download_target = _as_download_target(target)
+        fingerprint = _fingerprint_local_project(
+            path=source_path,
+            target=download_target.target,
+            resolver=resolver,
+            pip_version=pip_version,
+        )
+        return cls(
+            download_target=download_target,
+            source_path=source_path,
+            fingerprint=fingerprint,
+            subdirectory=subdirectory,
+        )
+
     download_target = attr.ib(converter=_as_download_target)  # type: DownloadTarget
     source_path = attr.ib()  # type: str
     fingerprint = attr.ib()  # type: str
@@ -635,7 +690,7 @@ class InstallRequest(object):
         was_built_locally=False,  # type: bool
     ):
         # type: (...) -> InstallRequest
-        fingerprint = fingerprint_path(wheel_path)
+        fingerprint = _fingerprint_file(wheel_path)
         return cls(
             download_target=_as_download_target(target),
             wheel_path=wheel_path,
@@ -768,7 +823,7 @@ class InstallResult(object):
         else:
             cached_fingerprint = installed_wheel.fingerprint
 
-        wheel_dir_hash = cached_fingerprint or fingerprint_path(self.install_chroot)
+        wheel_dir_hash = cached_fingerprint or _fingerprint_directory(self.install_chroot)
         runtime_key_dir = os.path.join(self._installation_root, wheel_dir_hash)
         with atomic_directory(runtime_key_dir) as atomic_dir:
             if not atomic_dir.is_finalized():
@@ -1086,8 +1141,17 @@ class BuildAndInstallRequest(object):
                     )
                 if is_wheel(dist_path):
                     to_install.add(InstallRequest.create(install_request.target, dist_path))
+                elif os.path.isdir(dist_path):
+                    to_build.add(
+                        BuildRequest.for_directory(
+                            install_request.target,
+                            dist_path,
+                            resolver=self._resolver,
+                            pip_version=self._pip_version,
+                        )
+                    )
                 else:
-                    to_build.add(BuildRequest.create(install_request.target, dist_path))
+                    to_build.add(BuildRequest.for_file(install_request.target, dist_path))
             already_analyzed.add(metadata.project_name)
 
         all_install_requests = OrderedSet(install_requests)
@@ -1496,10 +1560,6 @@ class LocalDistribution(object):
         # type: () -> Target
         return self.download_target.target
 
-    @fingerprint.default
-    def _calculate_fingerprint(self):
-        return fingerprint_path(self.path)
-
     @property
     def is_wheel(self):
         return is_wheel(self.path) and zipfile.is_zipfile(self.path)

{pex-2.61.0 → pex-2.61.1}/pex/version.py

@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.61.0"
+__version__ = "2.61.1"

pex-2.61.1/tests/integration/test_issue_2949.py

@@ -0,0 +1,150 @@
+# Copyright 2025 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+import os
+import subprocess
+from textwrap import dedent
+
+from pex.cache.dirs import InstalledWheelDir
+from pex.common import safe_open
+from pex.fs import safe_symlink
+from pex.pep_503 import ProjectName
+from pex.pex_info import PexInfo
+from pex.version import __version__
+from testing import run_pex_command
+from testing.docker import skip_unless_docker
+from testing.pytest_utils.tmp import Tempdir
+
+
+@skip_unless_docker
+def test_local_project_hashing_2949_case(
+    tmpdir,  # type: Tempdir
+    pex_project_dir,  # type: str
+):
+    # type: (...) -> None
+
+    # Just as for the original posting in #2949, Pex uses uv to run tests; so its project dir
+    # contains a `.venv/` with a dangling `python` symlink when the project is mounted into a
+    # docker container. This confirms that dangling symlink does not factor into the PEX build.
+
+    assert (
+        __version__
+        == subprocess.check_output(
+            args=[
+                "docker",
+                "run",
+                "--rm",
+                "-v",
+                "{pex_project_dir}:/code".format(pex_project_dir=pex_project_dir),
+                "-w",
+                "/code",
+                "python:3.14-slim-trixie",
+                "python",
+                "-m",
+                "pex",
+                ".",
+                "-c",
+                "pex",
+                "--",
+                "-V",
+            ]
+        )
+        .decode("utf-8")
+        .strip()
+    )
+
+
+def test_local_project_hashing_elides_irrelevant_files(tmpdir):
+    # type:(Tempdir) -> None
+
+    project_dir = tmpdir.join("project")
+    with safe_open(os.path.join(project_dir, "example", "__init__.py"), "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                import pkgutil
+
+
+                def run():
+                    print(pkgutil.get_data(__name__, "data.txt").decode("utf-8"))                    
+                """
+            )
+        )
+    with safe_open(os.path.join(project_dir, "example", "data.txt"), "w") as fp:
+        fp.write("42")
+    with safe_open(os.path.join(project_dir, "setup.cfg"), "w") as fp:
+        fp.write(
+            dedent(
+                """\
+                [metadata]
+                name = example
+                version = 0.0.1
+
+                [options]
+                packages = example
+                include_package_data = True
+                
+                [options.entry_points]
+                console_scripts =
+                    run = example:run
+                """
+            )
+        )
+    with safe_open(os.path.join(project_dir, "setup.py"), "w") as fp:
+        fp.write("from setuptools import setup; setup()")
+    with safe_open(os.path.join(project_dir, "MANIFEST.in"), "w") as fp:
+        fp.write("include example/data.txt")
+
+    pex_root = tmpdir.join("pex-root")
+
+    def build_pex(pex):
+        # type: (str) -> str
+        run_pex_command(
+            args=[
+                "--pex-root",
+                pex_root,
+                "--runtime-pex-root",
+                pex_root,
+                project_dir,
+                "-c",
+                "run",
+                "-o",
+                pex,
+            ]
+        ).assert_success()
+        return pex
+
+    def assert_built_wheels(expected_count):
+        assert expected_count == len(
+            list(
+                installed_wheel_dir
+                for installed_wheel_dir in InstalledWheelDir.iter_all(pex_root=pex_root)
+                if installed_wheel_dir.project_name == ProjectName("example")
+            )
+        )
+
+    pex1 = build_pex(tmpdir.join("pex1"))
+    assert "42" == subprocess.check_output(args=[pex1]).decode("utf-8").strip()
+    assert_built_wheels(1)
+    wheel1, fingerprint1 = PexInfo.from_pex(pex1).distributions.popitem()
+
+    with safe_open(os.path.join(project_dir, "example", "data.txt"), "w") as fp:
+        fp.write("37")
+    pex2 = build_pex(tmpdir.join("pex2"))
+    assert "37" == subprocess.check_output(args=[pex2]).decode("utf-8").strip()
+    assert_built_wheels(2)
+    wheel2, fingerprint2 = PexInfo.from_pex(pex2).distributions.popitem()
+    assert wheel1 == wheel2
+    assert fingerprint1 != fingerprint2
+
+    safe_symlink(
+        os.path.join(project_dir, "does-not-exist"), os.path.join(project_dir, "dangling-symlink")
+    )
+    pex3 = build_pex(tmpdir.join("pex3"))
+    assert "37" == subprocess.check_output(args=[pex3]).decode("utf-8").strip()
+    assert_built_wheels(2)
+    wheel3, fingerprint3 = PexInfo.from_pex(pex3).distributions.popitem()
+    assert wheel2 == wheel3
+    assert fingerprint2 == fingerprint3