pex 2.65.0__tar.gz → 2.66.0__tar.gz

{pex-2.65.0 → pex-2.66.0}/CHANGES.md

@@ -1,5 +1,11 @@
 # Release Notes
 
+## 2.66.0
+
+This release adds support for `--pip-version 25.3`.
+
+* Add support for `--pip-version 25.3`. (#2968)
+
 ## 2.65.0
 
 This release adds support for PEX scies using CPython free-threaded builds. Most such scies should

{pex-2.65.0 → pex-2.66.0}/PKG-INFO

@@ -1,15 +1,15 @@
 Metadata-Version: 2.4
 Name: pex
-Version: 2.65.0
+Version: 2.66.0
 Summary: The PEX packaging toolchain.
 Home-page: https://github.com/pex-tool/pex
-Download-URL: https://github.com/pex-tool/pex/releases/download/v2.65.0/pex
+Download-URL: https://github.com/pex-tool/pex/releases/download/v2.66.0/pex
 Author: The PEX developers
 Author-email: developers@pex-tool.org
 License-Expression: Apache-2.0
-Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.65.0/CHANGES.md
+Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.66.0/CHANGES.md
 Project-URL: Documentation, https://docs.pex-tool.org/
-Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.65.0
+Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.66.0
 Keywords: package,executable,virtualenv,lock,freeze
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers

{pex-2.65.0 → pex-2.66.0}/pex/hashing.py

@@ -1,7 +1,7 @@
 # Copyright 2022 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-from __future__ import absolute_import
+from __future__ import absolute_import, print_function
 
 import hashlib
 import os
@@ -241,10 +241,12 @@ def dir_hash(
         def iter_files():
             # type: () -> Iterator[Text]
             for root, dirs, files in os.walk(top, followlinks=True):
-                dirs[:] = [d for d in dirs if dir_filter(os.path.join(root, d))]
+                dirs[:] = [
+                    d for d in dirs if dir_filter(os.path.relpath(os.path.join(root, d), top))
+                ]
                 for f in files:
                     path = os.path.join(root, f)
-                    if file_filter(path):
+                    if file_filter(os.path.relpath(path, top)):
                         yield path
 
         file_paths = sorted(iter_files())
@@ -278,16 +280,26 @@ def zip_hash(
             else zf.namelist()
         )
 
-        dirs = frozenset(name.rstrip("/") for name in namelist if name.endswith("/"))
-        accept_dirs = frozenset(d for d in dirs if dir_filter(os.path.basename(d)))
-        reject_dirs = dirs - accept_dirs
-
+        dirs = set()
+        for name in namelist:
+            if name.endswith("/"):
+                dirname = name.rstrip("/")
+            else:
+                dirname = os.path.dirname(name)
+            while dirname:
+                dirs.add(dirname)
+                dirname = os.path.dirname(dirname)
+
+        accept_dirs = frozenset(
+            d for d in dirs if dir_filter(os.path.relpath(d, relpath) if relpath else d)
+        )
+        reject_dirs = tuple("{dir}/".format(dir=path) for path in (dirs - accept_dirs))
         accept_files = sorted(
             name
             for name in namelist
             if not name.endswith("/")
-            and not any(name.startswith(reject_dir) for reject_dir in reject_dirs)
-            and file_filter(os.path.basename(name))
+            and not name.startswith(reject_dirs)
+            and file_filter(os.path.relpath(name, relpath) if relpath else name)
         )
 
         hashed_names = (
@@ -297,3 +309,53 @@ def zip_hash(
 
         for filename in accept_files:
             update_hash(zf.open(filename, "r"), digest)
+
+
+if __name__ == "__main__":
+    import sys
+    import zipfile
+    from argparse import ArgumentParser
+
+    from pex.common import is_pyc_dir, is_pyc_file
+
+    parser = ArgumentParser()
+    parser.add_argument(
+        "--exclude-dir",
+        dest="exclude_dirs",
+        action="append",
+        default=[],
+    )
+    parser.add_argument("--zip-relpath")
+    parser.add_argument("paths", nargs="+")
+
+    options = parser.parse_args()
+    exclude_dirs = frozenset(options.exclude_dirs)
+
+    for path in options.paths:
+        digest = Sha256()
+        if zipfile.is_zipfile(path):
+            zip_hash(
+                path,
+                digest=digest,
+                relpath=options.zip_relpath,
+                dir_filter=(
+                    lambda dir_path: (
+                        not is_pyc_dir(dir_path) and os.path.basename(dir_path) not in exclude_dirs
+                    )
+                ),
+                file_filter=lambda f: not is_pyc_file(f),
+            )
+        elif os.path.isdir(path):
+            dir_hash(
+                path,
+                digest=digest,
+                dir_filter=(
+                    lambda dir_path: (
+                        not is_pyc_dir(dir_path) and os.path.basename(dir_path) not in exclude_dirs
+                    )
+                ),
+                file_filter=lambda f: not is_pyc_file(f),
+            )
+        else:
+            print("Can only hash zip files or directories. Skipping file", path, file=sys.stderr)
+        print(path, digest.hexdigest(), file=sys.stdout)

{pex-2.65.0 → pex-2.66.0}/pex/pex_builder.py

@@ -470,10 +470,7 @@ class PEXBuilder(object):
     def _prepare_code(self):
         chroot_path = self._chroot.path()
         self._pex_info.code_hash = CacheHelper.pex_code_hash(
-            chroot_path,
-            exclude_dirs=tuple(
-                os.path.join(chroot_path, d) for d in (layout.BOOTSTRAP_DIR, layout.DEPS_DIR)
-            ),
+            chroot_path, exclude_dirs=(layout.BOOTSTRAP_DIR, layout.DEPS_DIR)
         )
         self._pex_info.pex_hash = hashlib.sha1(self._pex_info.dump().encode("utf-8")).hexdigest()
         self._chroot.write(self._pex_info.dump().encode("utf-8"), PexInfo.PATH, label="manifest")

{pex-2.65.0 → pex-2.66.0}/pex/pip/tool.py

@@ -552,8 +552,7 @@ class Pip(object):
         )
         return Job(command=command, process=process, finalizer=finalizer, context="pip")
 
-    @staticmethod
-    def _iter_build_configuration_options(build_configuration):
+    def _iter_build_configuration_options(self, build_configuration):
         # type: (BuildConfiguration) -> Iterator[str]
 
         # N.B.: BuildConfiguration maintains invariants that ensure --only-binary, --no-binary,
@@ -576,7 +575,8 @@ class Pip(object):
         if build_configuration.prefer_older_binary:
             yield "--prefer-binary"
 
-        if build_configuration.use_pep517 is not None:
+        # N.B.: In 25.3 `--use-pep517` became the default and only option.
+        if build_configuration.use_pep517 is not None and self.version < PipVersion.v25_3:
             yield "--use-pep517" if build_configuration.use_pep517 else "--no-use-pep517"
 
         if not build_configuration.build_isolation:

pex-2.66.0/pex/pip/vcs.py

@@ -0,0 +1,179 @@
+# Copyright 2022 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+import os
+import re
+
+from pex import hashing
+from pex.artifact_url import VCS, Fingerprint
+from pex.common import is_pyc_dir, is_pyc_file
+from pex.exceptions import reportable_unexpected_error_msg
+from pex.hashing import Sha256
+from pex.pep_440 import Version
+from pex.pep_503 import ProjectName
+from pex.result import Error, try_
+from pex.typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    # N.B.: The `re.Pattern` type is not available in all Python versions Pex supports.
+    from re import Pattern  # type: ignore[attr-defined]
+    from typing import Callable, Optional, Text, Tuple, Union
+
+    from pex.hashing import HintedDigest
+
+
+def _project_name_re(project_name):
+    # type: (ProjectName) -> str
+    return project_name.normalized.replace("-", "[-_.]+")
+
+
+def _built_source_dist_pattern(project_name):
+    # type: (ProjectName) -> Pattern
+    return re.compile(
+        r"(?P<project_name>{project_name_re})-(?P<version>.+)\.zip".format(
+            project_name_re=_project_name_re(project_name)
+        ),
+        re.IGNORECASE,
+    )
+
+
+def _find_built_source_dist(
+    build_dir,  # type: str
+    project_name,  # type: ProjectName
+    version,  # type: Version
+):
+    # type: (...) -> Union[str, Error]
+
+    # All VCS requirements are prepared as zip archives with this naming scheme as
+    # encoded in: `pip._internal.req.req_install.InstallRequirement.archive`.
+
+    listing = os.listdir(build_dir)
+    pattern = _built_source_dist_pattern(project_name)
+    for name in listing:
+        match = pattern.match(name)
+        if match and Version(match.group("version")) == version:
+            return os.path.join(build_dir, name)
+
+    return Error(
+        "Expected to find built sdist for {project_name} {version} in {build_dir} but only found:\n"
+        "{listing}".format(
+            project_name=project_name.raw,
+            version=version.raw,
+            build_dir=build_dir,
+            listing="\n".join(listing),
+        )
+    )
+
+
+def fingerprint_downloaded_vcs_archive(
+    download_dir,  # type: str
+    project_name,  # type: ProjectName
+    version,  # type: Version
+    vcs,  # type: VCS.Value
+):
+    # type: (...) -> Tuple[Fingerprint, str]
+
+    archive_path = try_(
+        _find_built_source_dist(build_dir=download_dir, project_name=project_name, version=version)
+    )
+    digest = Sha256()
+    digest_vcs_archive(project_name=project_name, archive_path=archive_path, vcs=vcs, digest=digest)
+    return Fingerprint.from_digest(digest), archive_path
+
+
+def _vcs_dir_filter(
+    vcs,  # type: VCS.Value
+    project_name,  # type: ProjectName
+):
+    # type: (...) -> Callable[[Text], bool]
+
+    # Ignore VCS control directories for the purposes of fingerprinting the version controlled
+    # source tree. VCS control directories can contain non-reproducible content (Git at least
+    # has files that contain timestamps).
+    #
+    # We cannot prune these directories from the source archive directly unfortunately since
+    # some build processes use VCS version information to derive their version numbers (C.F.:
+    # https://pypi.org/project/setuptools-scm/). As such, we'll get a stable fingerprint, but be
+    # forced to re-build a wheel each time the VCS requirement is re-locked later, even when it
+    # hashes the same.
+    vcs_control_dir = ".{vcs}".format(vcs=vcs)
+
+    # N.B.: If the VCS project uses setuptools as its build backend, depending on the version of
+    # Pip used, the VCS checkout can have a `<project name>.egg-info/` directory littering its root
+    # left over from Pip generating project metadata to determine version and dependencies. No other
+    # well known build-backend has this problem at this time (checked hatchling, poetry-core,
+    # pdm-backend and uv_build).
+    # C.F.: https://github.com/pypa/pip/pull/13602
+    egg_info_dir_re = re.compile(
+        r"^{project_name_re}\.egg-info$".format(project_name_re=_project_name_re(project_name)),
+        re.IGNORECASE,
+    )
+
+    def vcs_dir_filter(dir_path):
+        # type: (Text) -> bool
+        if is_pyc_dir(dir_path):
+            return False
+
+        base_dir_name = dir_path.split(os.sep)[0]
+        return base_dir_name != vcs_control_dir and not egg_info_dir_re.match(base_dir_name)
+
+    return vcs_dir_filter
+
+
+def _vcs_file_filter(vcs):
+    # type: (VCS.Value) -> Callable[[Text], bool]
+    return lambda f: not is_pyc_file(f)
+
+
+def digest_vcs_archive(
+    project_name,  # type: ProjectName
+    archive_path,  # type: str
+    vcs,  # type: VCS.Value
+    digest,  # type: HintedDigest
+):
+    # type: (...) -> None
+
+    # All VCS requirements are prepared as zip archives as encoded in:
+    # `pip._internal.req.req_install.InstallRequirement.archive` and the archive is already offset
+    # by a subdirectory (if any).
+
+    # The zip archives created by Pip have a single project name top-level directory housing
+    # the full clone. We look for that to get a consistent clone hash with a bare clone.
+    match = _built_source_dist_pattern(project_name).match(os.path.basename(archive_path))
+    if match is None:
+        raise AssertionError(
+            reportable_unexpected_error_msg(
+                "Failed to determine the project name prefix for the VCS zip {zip} with expected "
+                "canonical project name {project_name}".format(
+                    zip=archive_path, project_name=project_name
+                )
+            )
+        )
+    top_dir = match.group("project_name")
+
+    hashing.zip_hash(
+        zip_path=archive_path,
+        digest=digest,
+        relpath=top_dir,
+        dir_filter=_vcs_dir_filter(vcs, project_name),
+        file_filter=_vcs_file_filter(vcs),
+    )
+
+
+def digest_vcs_repo(
+    project_name,  # type: ProjectName
+    repo_path,  # type: str
+    vcs,  # type: VCS.Value
+    digest,  # type: HintedDigest
+    subdirectory=None,  # type: Optional[str]
+):
+    # type: (...) -> None
+
+    hashing.dir_hash(
+        directory=os.path.join(repo_path, subdirectory) if subdirectory else repo_path,
+        digest=digest,
+        dir_filter=_vcs_dir_filter(vcs, project_name),
+        file_filter=_vcs_file_filter(vcs),
+    )

{pex-2.65.0 → pex-2.66.0}/pex/pip/version.py

@@ -369,6 +369,13 @@ class PipVersion(Enum["PipVersionValue"]):
         requires_python=">=3.9,<3.16",
     )
 
+    v25_3 = PipVersionValue(
+        version="25.3",
+        setuptools_version="80.9.0",
+        wheel_version="0.45.1",
+        requires_python=">=3.9,<3.16",
+    )
+
     VENDORED = v20_3_4_patched
     LATEST = LatestPipVersion()
     LATEST_COMPATIBLE = LatestCompatiblePipVersion()

{pex-2.65.0 → pex-2.66.0}/pex/resolve/lock_downloader.py

@@ -154,6 +154,7 @@ class VCSArtifactDownloadManager(DownloadManager[VCSArtifact]):
         local_distribution = downloaded_vcs.local_distributions[0]
         filename = os.path.basename(local_distribution.path)
         digest_vcs_archive(
+            project_name=project_name,
             archive_path=local_distribution.path,
             vcs=artifact.vcs,
             digest=digest,

{pex-2.65.0 → pex-2.66.0}/pex/resolve/locker.py

@@ -291,6 +291,16 @@ class Locker(LogAnalyzer):
     def _maybe_record_wheel(self, url):
         # type: (str) -> ArtifactURL
         artifact_url = self.parse_url_and_maybe_record_fingerprint(url)
+
+        # N.B.: Lock resolves driven by `pip install --dry-run --report` will only consult PEP-658
+        # `.whl.metadata` side-car files in the happy path; so we must use these as a proxy for the
+        # `.whl` file they are paired with.
+        # See: https://peps.python.org/pep-0658/
+        if not self._lock_is_via_pip_download and artifact_url.url_info.path.endswith(".metadata"):
+            artifact_url = ArtifactURL.from_url_info(
+                artifact_url.url_info._replace(path=artifact_url.url_info.path[:-9])
+            )
+
         if artifact_url.is_wheel:
             pin, partial_artifact = self._extract_resolve_data(artifact_url)
 
@@ -371,8 +381,8 @@ class Locker(LogAnalyzer):
                 if isinstance(artifact_url.scheme, VCSScheme):
                     source_fingerprint, archive_path = fingerprint_downloaded_vcs_archive(
                         download_dir=self._download_dir,
-                        project_name=str(build_result.pin.project_name),
-                        version=str(build_result.pin.version),
+                        project_name=build_result.pin.project_name,
+                        version=build_result.pin.version,
                         vcs=artifact_url.scheme.vcs,
                     )
                     verified = True
@@ -445,6 +455,7 @@ class Locker(LogAnalyzer):
                 if isinstance(artifact_url.scheme, VCSScheme):
                     digest = Sha256()
                     digest_vcs_repo(
+                        project_name=build_result.pin.project_name,
                         repo_path=build_result.path,
                         vcs=artifact_url.scheme.vcs,
                         digest=digest,

{pex-2.65.0 → pex-2.66.0}/pex/version.py

@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.65.0"
+__version__ = "2.66.0"

{pex-2.65.0 → pex-2.66.0}/tests/integration/cli/commands/test_lock.py

@@ -914,24 +914,38 @@ def test_update_targeted_impossible(
             "pip: ERROR: No matching distribution found for urllib3<1.27,>=1.21.1",
         ]
     else:
-        expected_lines = [
-            "pip: ERROR: Cannot install requests==2.26.0 because these package versions have "
-            "conflicting dependencies.",
-            "pip: ERROR: ResolutionImpossible: for help visit "
-            "https://pip.pypa.io/en/latest/topics/dependency-resolution/"
-            "#dealing-with-dependency-conflicts",
-            "pip:  ",
-            "pip:  The conflict is caused by:",
-            "pip:      requests 2.26.0 depends on urllib3<1.27 and >=1.21.1",
-            "pip:      The user requested (constraint) urllib3<1.16",
-            "pip:  ",
-            "pip:  To fix this you could try to:",
-            "pip:  1. loosen the range of package versions you've specified",
-            "pip:  2. remove package versions to allow {pip_to} attempt to solve the dependency "
-            "conflict".format(
-                pip_to="pip" if pip_version.version < PipVersion.v24_1.version else "pip to"
-            ),
-        ]
+        expected_lines = (
+            [
+                "pip: ERROR: Cannot install requests==2.26.0 because these package versions have "
+                "conflicting dependencies.",
+                "pip: ERROR: ResolutionImpossible: for help visit "
+                "https://pip.pypa.io/en/latest/topics/dependency-resolution/"
+                "#dealing-with-dependency-conflicts",
+                "pip:  ",
+                "pip:  The conflict is caused by:",
+                "pip:      requests 2.26.0 depends on urllib3<1.27 and >=1.21.1",
+                "pip:      The user requested (constraint) urllib3<1.16",
+                "pip:  ",
+            ]
+            + (
+                [
+                    "pip:  Additionally, some packages in these conflicts have no matching "
+                    "distributions available for your environment:",
+                    "pip:      urllib3",
+                    "pip:  ",
+                ]
+                if pip_version >= PipVersion.v25_3
+                else []
+            )
+            + [
+                "pip:  To fix this you could try to:",
+                "pip:  1. loosen the range of package versions you've specified",
+                "pip:  2. remove package versions to allow {pip_to} attempt to solve the "
+                "dependency conflict".format(
+                    pip_to="pip" if pip_version.version < PipVersion.v24_1.version else "pip to"
+                ),
+            ]
+        )
     assert expected_lines == error_lines[12:], "\n".join(
         difflib.unified_diff(expected_lines, error_lines[12:])
     )
@@ -1013,25 +1027,39 @@ def test_update_add_impossible(
             "pip: ERROR: No matching distribution found for certifi<2017.4.17",
         ]
     else:
-        expected_lines = [
-            "pip: ERROR: Cannot install conflicting-certifi-requirement==1.2.3 and "
-            "requests==2.26.0 because these package versions have conflicting dependencies.",
-            "pip: ERROR: ResolutionImpossible: for help visit "
-            "https://pip.pypa.io/en/latest/topics/dependency-resolution/"
-            "#dealing-with-dependency-conflicts",
-            "pip:  ",
-            "pip:  The conflict is caused by:",
-            "pip:      requests 2.26.0 depends on certifi>=2017.4.17",
-            "pip:      conflicting-certifi-requirement 1.2.3 depends on certifi<2017.4.17",
-            "pip:      The user requested (constraint) certifi==2021.5.30",
-            "pip:  ",
-            "pip:  To fix this you could try to:",
-            "pip:  1. loosen the range of package versions you've specified",
-            "pip:  2. remove package versions to allow {pip_to} attempt to solve the dependency "
-            "conflict".format(
-                pip_to="pip" if pip_version.version < PipVersion.v24_1.version else "pip to"
-            ),
-        ]
+        expected_lines = (
+            [
+                "pip: ERROR: Cannot install conflicting-certifi-requirement==1.2.3 and "
+                "requests==2.26.0 because these package versions have conflicting dependencies.",
+                "pip: ERROR: ResolutionImpossible: for help visit "
+                "https://pip.pypa.io/en/latest/topics/dependency-resolution/"
+                "#dealing-with-dependency-conflicts",
+                "pip:  ",
+                "pip:  The conflict is caused by:",
+                "pip:      requests 2.26.0 depends on certifi>=2017.4.17",
+                "pip:      conflicting-certifi-requirement 1.2.3 depends on certifi<2017.4.17",
+                "pip:      The user requested (constraint) certifi==2021.5.30",
+                "pip:  ",
+            ]
+            + (
+                [
+                    "pip:  Additionally, some packages in these conflicts have no matching "
+                    "distributions available for your environment:",
+                    "pip:      certifi",
+                    "pip:  ",
+                ]
+                if pip_version >= PipVersion.v25_3
+                else []
+            )
+            + [
+                "pip:  To fix this you could try to:",
+                "pip:  1. loosen the range of package versions you've specified",
+                "pip:  2. remove package versions to allow {pip_to} attempt to solve the "
+                "dependency conflict".format(
+                    pip_to="pip" if pip_version.version < PipVersion.v24_1.version else "pip to"
+                ),
+            ]
+        )
     assert expected_lines == error_lines[13:], "\n".join(
         difflib.unified_diff(expected_lines, error_lines[12:])
     )

{pex-2.65.0 → pex-2.66.0}/tests/integration/test_issue_1560.py

@@ -8,6 +8,7 @@ from textwrap import dedent
 import pytest
 
 from pex.common import safe_open, touch
+from pex.pip.version import PipVersion
 from pex.typing import TYPE_CHECKING
 from testing import (
     IntegResults,
@@ -88,12 +89,14 @@ def test_pep_517_for_pep_517_project():
     build_pex().assert_success()
     build_pex("--force-pep517").assert_success()
 
-    result = build_pex("--no-use-pep517")
-    result.assert_failure()
-    assert (
-        "ERROR: Disabling PEP 517 processing is invalid: project does not have a setup.py"
-        in result.error
-    )
+    # N.B.: In 25.3 `--use-pep517` became the default and only option.
+    if PipVersion.DEFAULT < PipVersion.v25_3:
+        result = build_pex("--no-use-pep517")
+        result.assert_failure()
+        assert (
+            "ERROR: Disabling PEP 517 processing is invalid: project does not have a setup.py"
+            in result.error
+        )
 
 
 def test_pep_517_for_legacy_project():
@@ -108,4 +111,7 @@ def test_pep_517_for_legacy_project():
 
     assert_build_pex()
     assert_build_pex("--use-pep517")
-    assert_build_pex("--no-use-pep517")
+
+    # N.B.: In 25.3 `--use-pep517` became the default and only option.
+    if PipVersion.DEFAULT < PipVersion.v25_3:
+        assert_build_pex("--no-use-pep517")

{pex-2.65.0 → pex-2.66.0}/tests/integration/test_issue_2343.py

@@ -88,10 +88,24 @@ def test_no_build_no_wheel_honored_pex(repo_args):
         re_flags=re.DOTALL,
     )
 
+    if PipVersion.DEFAULT >= PipVersion.v25_3:
+        # N.B.: Pip 25.3 is stricter and `--no-wheel`, which translates to Pip's
+        # `--no-binary :all:`, indicates not even build requirements, like setuptools and wheel,
+        # can come from wheels; so the sdist builds fail. As such we target just `only_sdist` and
+        # `both` for sdist builds.
+        no_wheel_args = [
+            "--only-build",
+            "only_sdist",
+            "--only-build",
+            "both",
+        ]
+    else:
+        no_wheel_args = ["--no-wheel"]
+
     run_pex_command(
         args=repo_args
+        + no_wheel_args
         + [
-            "--no-wheel",
             "only_sdist",
             "both",
             "--",