pex 2.98.2__tar.gz → 2.98.4__tar.gz

{pex-2.98.2 → pex-2.98.4}/CHANGES.md

@@ -1,5 +1,18 @@
 # Release Notes
 
+## 2.98.4
+
+This release updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2026.7.22.
+
+* Update vendored Pip's CA cert bundle. (#3227)
+
+## 2.98.3
+
+This release fixes `--venv` PEX scies robustness to `PEX_ROOT` cache deletion and  also fixes
+`--venv` PEX behavior with regard to accurate `pex3 cache prune` last access time pruning.
+
+* Fix `--venv` PEX cache handling. (#3226)
+
 ## 2.98.2
 
 This release fixes generation of foreign platform PEX scies to respect the foreign platform cache

{pex-2.98.2 → pex-2.98.4}/PKG-INFO

@@ -1,15 +1,15 @@
 Metadata-Version: 2.4
 Name: pex
-Version: 2.98.2
+Version: 2.98.4
 Summary: The PEX packaging toolchain.
 Home-page: https://github.com/pex-tool/pex
-Download-URL: https://github.com/pex-tool/pex/releases/download/v2.98.2/pex
+Download-URL: https://github.com/pex-tool/pex/releases/download/v2.98.4/pex
 Author: The PEX developers
 Author-email: developers@pex-tool.org
 License-Expression: Apache-2.0
-Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.98.2/CHANGES.md
+Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.98.4/CHANGES.md
 Project-URL: Documentation, https://docs.pex-tool.org/
-Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.98.2
+Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.98.4
 Keywords: package,executable,virtualenv,lock,freeze
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers

{pex-2.98.2 → pex-2.98.4}/pex/cache/dirs.py

@@ -317,7 +317,7 @@ class UnzipDir(AtomicCacheDir):
     def iter_all(cls, pex_root=ENV):
         # type: (Union[str, Variables]) -> Iterator[UnzipDir]
         for unzip_dir in glob.glob(CacheDir.UNZIPPED_PEXES.path("*", pex_root=pex_root)):
-            if os.path.isdir(unzip_dir):
+            if os.path.isdir(unzip_dir) and not unzip_dir.endswith(".work"):
                 pex_hash = os.path.basename(unzip_dir)
                 yield UnzipDir(path=unzip_dir, pex_hash=pex_hash, pex_root=pex_root)
 

{pex-2.98.2 → pex-2.98.4}/pex/pip/tool.py

@@ -396,6 +396,7 @@ class BootstrapPip(object):
         log=None,  # type: Optional[str]
         pip_verbosity=0,  # type: int
         extra_env=None,  # type: Optional[Dict[str, str]]
+        set_last_access=True,  # type: bool
         **popen_kwargs  # type: Any
     ):
         # type: (...) -> Tuple[List[str], subprocess.Popen]
@@ -492,6 +493,9 @@ class BootstrapPip(object):
         # moves lead to in the `pip wheel` case.
         extra_env.update(TMPDIR=safe_mkdtemp(dir=safe_mkdir(self.cache_dir), prefix=".tmp."))
 
+        if not set_last_access:
+            extra_env.update(_PEX_CACHE_SET_LAST_ACCESS="0")
+
         with ENV.strip().patch(
             PEX_ROOT=ENV.PEX_ROOT,
             PEX_VERBOSE=str(ENV.PEX_VERBOSE),
@@ -537,6 +541,7 @@ class BootstrapPip(object):
         pip_verbosity=0,  # type: int
         finalizer=None,  # type: Optional[Callable[[int], None]]
         extra_env=None,  # type: Optional[Dict[str, str]]
+        set_last_access=True,  # type: bool
         **popen_kwargs  # type: Any
     ):
         # type: (...) -> Job
@@ -547,6 +552,7 @@ class BootstrapPip(object):
             log=log,
             pip_verbosity=pip_verbosity,
             extra_env=extra_env,
+            set_last_access=set_last_access,
             **popen_kwargs
         )
         return Job(command=command, process=process, finalizer=finalizer, context="pip")
@@ -759,7 +765,7 @@ class BootstrapPip(object):
         # analyzer brings that build failure information to the fore.
         log_analyzers.append(_PexIssue2113Analyzer())
 
-        popen_kwargs = {}
+        popen_kwargs = {}  # type: Dict[str, Any]
         finalizer = None
         log = log or os.path.join(safe_mkdtemp(prefix="pex-pip-log."), "pip.log")
 
@@ -893,6 +899,7 @@ class BootstrapPip(object):
         return self._spawn_pip_isolated_job(
             args=["cache", "remove", wheel_name_glob],
             pip_verbosity=1,
+            set_last_access=False,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
         )
@@ -902,6 +909,7 @@ class BootstrapPip(object):
         return self._spawn_pip_isolated_job(
             args=["cache", "list", "--format", "abspath"],
             pip_verbosity=1,
+            set_last_access=False,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
         )

{pex-2.98.2 → pex-2.98.4}/pex/scie/configure-binding.py

@@ -15,7 +15,21 @@ from argparse import ArgumentParser
 TYPE_CHECKING = False
 
 if TYPE_CHECKING:
-    from typing import Iterable, Optional
+    from typing import Dict, Iterable, Optional
+
+    from typing_extensions import Literal
+
+
+def create_binding(
+    key,  # type: str
+    value,  # type: str
+    brake=None,  # type: Optional[Literal["dir", "file", "exists"]]
+):
+    # type: (...) -> Dict[str, str]
+    binding = {"key": key, "value": value}
+    if brake is not None:
+        binding["brake"] = brake
+    return binding
 
 
 def write_bindings(
@@ -27,22 +41,31 @@ def write_bindings(
 ):
     # type: (...) -> None
 
-    with open(env_file, "a") as fp:
-        stem, ext = os.path.splitext(sys.executable)
-        if windowed and ext == ".exe" and not stem.endswith("w"):
-            parent_dir = os.path.dirname(sys.executable)
-            python = os.path.join(parent_dir, "{binary_name}w.exe".format(binary_name=stem))
-
-        else:
-            python = sys.executable
+    stem, ext = os.path.splitext(sys.executable)
+    if windowed and ext == ".exe" and not stem.endswith("w"):
+        parent_dir = os.path.dirname(sys.executable)
+        python = os.path.join(parent_dir, "{binary_name}w.exe".format(binary_name=stem))
+    else:
+        python = sys.executable
+
+    bindings = [
+        create_binding("PYTHON", python, brake="file"),
+        create_binding("PEX", pex, brake="file" if os.path.isfile(pex) else "dir"),
+    ]
+    if venv_bin_dir:
+        bindings.extend(
+            (
+                # N.B.: If we're in --venv mode, PEX is inside the VIRTUAL_ENV; so there is no need
+                # to check the directory's existence again: the PEX check succeeding confirms it.
+                create_binding("VIRTUAL_ENV", os.path.dirname(venv_bin_dir)),
+                create_binding("VENV_BIN_DIR_PLUS_SEP", venv_bin_dir + os.path.sep, brake="dir"),
+            )
+        )
+    if desktop_file:
+        bindings.append(create_binding("DESKTOP_FILE", desktop_file))
 
-        print("PYTHON=" + python, file=fp)
-        print("PEX=" + pex, file=fp)
-        if venv_bin_dir:
-            print("VIRTUAL_ENV=" + os.path.dirname(venv_bin_dir), file=fp)
-            print("VENV_BIN_DIR_PLUS_SEP=" + venv_bin_dir + os.path.sep, file=fp)
-        if desktop_file:
-            print("DESKTOP_FILE=" + desktop_file, file=fp)
+    with open(env_file, "w") as fp:
+        json.dump(bindings, fp)
 
 
 class PexDirNotFound(Exception):
@@ -238,7 +261,7 @@ if __name__ == "__main__":
             desktop_uninstall(desktop_file=desktop_install_path)
 
     write_bindings(
-        env_file=os.environ["SCIE_BINDING_ENV"],
+        env_file=os.environ["SCIE_BINDING_JSON"],
         pex=pex,
         venv_bin_dir=os.path.join(pex, options.venv_bin_dir) if options.venv_bin_dir else None,
         desktop_file=desktop_install_path,

{pex-2.98.2 → pex-2.98.4}/pex/scie/resource-binding.py

@@ -4,6 +4,7 @@
 from __future__ import print_function
 
 import importlib
+import json
 import os
 import sys
 from argparse import ArgumentParser
@@ -23,9 +24,12 @@ def write_bindings(
 ):
     # type: (...) -> None
 
-    with open(env_file, "a") as fp:
-        for env_name, resource_path in bound_resource_paths:
-            print("BIND_RESOURCE_" + env_name + "=" + resource_path, file=fp)
+    bindings = [
+        {"key": "BIND_RESOURCE_" + env_name, "value": resource_path, "brake": "file"}
+        for env_name, resource_path in bound_resource_paths
+    ]
+    with open(env_file, "w") as fp:
+        json.dump(bindings, fp)
 
 
 class ResourceBindingError(Exception):
@@ -106,6 +110,6 @@ if __name__ == "__main__":
         sys.exit(str(e))
 
     write_bindings(
-        env_file=os.environ["SCIE_BINDING_ENV"], bound_resource_paths=bound_resource_paths
+        env_file=os.environ["SCIE_BINDING_JSON"], bound_resource_paths=bound_resource_paths
     )
     sys.exit(0)

{pex-2.98.2 → pex-2.98.4}/pex/scie/science.py

@@ -86,7 +86,7 @@ def _science_binary_url(suffix=""):
 
 
 PTEX_VERSION = "1.7.0"
-SCIE_JUMP_VERSION = "1.12.0"
+SCIE_JUMP_VERSION = "1.13.0"
 
 
 class Filenames(Enum["Filenames.Value"]):

{pex-2.98.2 → pex-2.98.4}/pex/vendor/__init__.py

@@ -258,10 +258,12 @@ class VendorSpec(
 #     Automated update of Pip's vendored certifi's cacert.pem to that from certifi 2026.4.22.
 # 18.) https://github.com/pex-tool/pip/commit/cf6ef50395c26964787f1d13ae3de0f668fb2236
 #     Automated update of Pip's vendored certifi's cacert.pem to that from certifi 2026.6.17.
+# 19.) https://github.com/pex-tool/pip/commit/4f50d41b0b22e6c7444fb5914531614220468186
+#     Automated update of Pip's vendored certifi's cacert.pem to that from certifi 2026.7.22.
 
 PIP_SPEC = VendorSpec.git(
     repo="https://github.com/pex-tool/pip",
-    commit="cf6ef50395c26964787f1d13ae3de0f668fb2236",
+    commit="4f50d41b0b22e6c7444fb5914531614220468186",
     project_name="pip",
     rewrite=False,
 )

pex-2.98.4/pex/vendor/_vendored/pip/.layout.json

@@ -0,0 +1 @@
+{"fingerprint":"1b4386d3f4c102a2a9a54dcd3634306293f98ae41b95c717272b66a133dc65d3","record_relpath":"pip-20.3.4.dist-info/RECORD","root_is_purelib":true,"stash_dir":".prefix","sys_path_entries":["."]}

{pex-2.98.2 → pex-2.98.4}/pex/vendor/_vendored/pip/pip/_vendor/certifi/cacert.pem

@@ -1,4 +1,4 @@
-# Updated via `nox -e update-certifi-cacert-pem` using certifi 2026.6.17
+# Updated via `nox -e update-certifi-cacert-pem` using certifi 2026.7.22
 
 
 # Issuer: CN=COMODO ECC Certification Authority O=COMODO CA Limited
@@ -719,35 +719,6 @@ g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
 BSeOE6Fuwg==
 -----END CERTIFICATE-----
 
-# Issuer: CN=Atos TrustedRoot 2011 O=Atos
-# Subject: CN=Atos TrustedRoot 2011 O=Atos
-# Label: "Atos TrustedRoot 2011"
-# Serial: 6643877497813316402
-# MD5 Fingerprint: ae:b9:c4:32:4b:ac:7f:5d:66:cc:77:94:bb:2a:77:56
-# SHA1 Fingerprint: 2b:b1:f5:3e:55:0c:1d:c5:f1:d4:e6:b7:6a:46:4b:55:06:02:ac:21
-# SHA256 Fingerprint: f3:56:be:a2:44:b7:a9:1e:b3:5d:53:ca:9a:d7:86:4a:ce:01:8e:2d:35:d5:f8:f9:6d:df:68:a6:f4:1a:a4:74
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE
-AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG
-EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM
-FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp
-Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM
-VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+
-SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ
-4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L
-cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi
-eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV
-HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG
-A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3
-DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j
-vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP
-DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc
-maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D
-lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv
-KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
------END CERTIFICATE-----
-
 # Issuer: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited
 # Subject: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited
 # Label: "QuoVadis Root CA 1 G3"
@@ -3864,3 +3835,128 @@ C9p2x1L/Cx6AcCIwwzPbGO2E14vs7dOoY4G1VnxHx1YwlGhza9IuqbnZLBwpvQy6
 uWWL
 -----END CERTIFICATE-----
 
+# Issuer: CN=SECOM TLS RSA Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Subject: CN=SECOM TLS RSA Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Label: "SECOM TLS RSA Root CA 2024"
+# Serial: 17188327524208271538
+# MD5 Fingerprint: d0:a4:db:32:eb:44:98:d2:62:0b:3e:bc:4d:7c:5c:e9
+# SHA1 Fingerprint: fb:97:96:7c:ef:8d:98:63:06:c0:3b:b6:11:f8:e0:13:97:a2:98:d3
+# SHA256 Fingerprint: 14:35:f2:25:c5:d2:52:d7:a2:19:48:cc:3c:e6:2a:ec:fa:88:00:1e:3d:d7:2d:1c:c3:55:51:00:eb:37:2f:93
+-----BEGIN CERTIFICATE-----
+MIIFmjCCA4KgAwIBAgIJAO6JNNDLgOCyMA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNV
+BAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEj
+MCEGA1UEAxMaU0VDT00gVExTIFJTQSBSb290IENBIDIwMjQwHhcNMjQwMTMxMDUx
+MTU1WhcNNDkwMTE0MDUxMTU1WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VD
+T00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBS
+U0EgUm9vdCBDQSAyMDI0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+4TjizUwzxbInq8Tx11gaFYNk5fO+34y7TyM4neh0UgL5JIZbJNLTz2x//L/B71+5
+m6X6nGIr7d4lFJBGtjO677hXOz93zkcWaUTm3VbOAjBlt4YWxlcccBHXuZ7o3Q+4
+R+ormrBdHeJ1CTUEG8ttQbKIl3G7OZYbnH8/pP8cjPub/0kDVNuMzp7xsVRROOis
+Qt53fMoJLlYgoebbuMphOqMCtjkJ7R6efEMfLp8UAVi9ZaLRn76ET/CJkk925ndu
+uufC4BatS4mnXFmxN0vUXb0ij9B8O/D8gixQEsVSD4GK8FWRPh3bVd/6bzdkHGJj
+y21XI0yejVomZUbRrOfNuz0boPGV1pt18fFC39IHQEth3OFqb5NDO3L+A9bNqTgA
+yUgRmIn4ucgDc/Ri/Km3V51ueZjy1/yk0qwJVadAVVrCt56iNeXOyEvzJADGgDQ8
+E1Pdaqct8Cynz/47ReQM62vFYO08wcQkrjmX/tesiko1V1yyaf6EfPzUFzmaGy9x
+vkCwdbm15EdTolOjE0H2Vb5/APDOyCFEokiYGmXTLdAUl0wKZ4IyjkHGzy0jhpaX
+EXE/GJcEvI6VzEchjaBL03EJ0h9pG4OqeIOycKvAo3A+TbetyfsrgYyHzU0a7/qU
+jGat1AAq1nVljMpKqpinPTsf/d9H39FTUeJL7TpzzjUCAwEAAaNjMGEwHQYDVR0O
+BBYEFCzrchKOWHdkNRVWNQFXB6l9DTbmMB8GA1UdIwQYMBaAFCzrchKOWHdkNRVW
+NQFXB6l9DTbmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBDAUAA4ICAQAVwsvluSafaez5tFPR/hRTBzRxEyMMQF3XJXCVi3yegZyK
+oec7hmE6jx2ZM8KgM1kn2yJRwFXHX8zUW9nBLEDWc4wuE8LrlZqhGZM9pJQXGmGz
+ResDJV6JgRBna+j4sA1M7yIdlvL0sAfFXFCTRaWTD4E1V99RLrFzWfTcC+e180hD
+uNMpqOEo46+lMeW/Wvh7ifOQs+kiK0O2gHxQDNxslSavnCs4V7l8HRDJ2La10o70
+Bo7VLzf1W8MBvv0VTnxB+NjT5qTAbhGFh9Gvp4BaJpmdUf0C5CEP6dbQlfgxWfzY
+r69yVT6dPQB+GFEaY03IMY+AcBCs+om1fNxrQXt9zoofMBNFbLhvpNH/JsXWdGUz
+fNbO12uswTa5wah8LB18FTQN2/zPHYmvBEoLuyUgZ09VNLJo5YA0kXItVYkLjMe2
+SixzK4scUHv81IK99I91DWx7FwMVKw2xgFp+ZLYB2dnpQQrqwlW64glHUcK2N9BD
+snjLSxeZ+UPECh9RxH4WAcKiZW+cqaKMmhP2WBfR4IcR7NOL32ml11ds87hhV1CZ
+WWFCJAcCidYZz6CZa8exzHojP9SB5RH0/v1KdHAisqhSjtJl/UIAHIQ48elOn8wr
+TdFap4Yb5aHglmMeNx+fAIhDluWVfxTO7H4dTPU+SFVRMLAh+wwKZfqb94nMeQ==
+-----END CERTIFICATE-----
+
+# Issuer: CN=SECOM TLS ECC Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Subject: CN=SECOM TLS ECC Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Label: "SECOM TLS ECC Root CA 2024"
+# Serial: 9329818985461676612
+# MD5 Fingerprint: 99:d3:9d:e4:d2:b1:2d:f0:2a:04:67:85:f3:df:46:d6
+# SHA1 Fingerprint: 7a:1f:22:2d:72:b2:c3:19:87:44:db:61:69:e8:a6:4b:d7:0d:44:0e
+# SHA256 Fingerprint: 6a:b2:ab:75:f5:1c:b4:f4:f0:15:62:03:fb:f6:f6:46:23:2f:51:4b:e0:59:f6:28:33:30:8b:82:b4:d7:2d:b1
+-----BEGIN CERTIFICATE-----
+MIICTDCCAdGgAwIBAgIJAIF6LO+PI3pEMAoGCCqGSM49BAMDMFoxCzAJBgNVBAYT
+AkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEG
+A1UEAxMaU0VDT00gVExTIEVDQyBSb290IENBIDIwMjQwHhcNMjQwMTMxMDU1MjM0
+WhcNNDkwMTE0MDU1MjM0WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VDT00g
+VHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBFQ0Mg
+Um9vdCBDQSAyMDI0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE7NzFMtu9dzQXSNC1
+2fabk0+GlC5finB3R7XaZonRUd20aFiWObtuNBCLUZSfk6QXAE55BjEXsXQ/NG8y
+UqicXjsu9ksDK3JZBgCwLOVh6+nwJXTvso/dEj/GUYH5mBdoo2MwYTAdBgNVHQ4E
+FgQUO3YReyl04k4GTFaCQNAhL3qzydUwHwYDVR0jBBgwFoAUO3YReyl04k4GTFaC
+QNAhL3qzydUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZI
+zj0EAwMDaQAwZgIxAN3ib8fi1pMYtAPjMilB5e5/H+t5CL0xPL+cZ5oTTZuSCjpA
+n1v7F/VAr8bFxQXAowIxAKsBVO1ACFp7skwzPvdv1EUY5a897WGLT4lb+bjxFAWy
+l8wDcZJdwGZ/pAHxt1AJ1g==
+-----END CERTIFICATE-----
+
+# Issuer: CN=Telia EC TLS Root CA v3 O=Telia Company AB
+# Subject: CN=Telia EC TLS Root CA v3 O=Telia Company AB
+# Label: "Telia EC TLS Root CA v3"
+# Serial: 8028200332079443110287896228123317
+# MD5 Fingerprint: b6:fa:6a:5c:42:fb:c5:67:72:c0:e0:2f:72:fb:5a:44
+# SHA1 Fingerprint: b4:d6:07:c2:a5:95:bc:5b:f4:67:4d:c9:dc:6f:6f:0a:00:7a:a5:35
+# SHA256 Fingerprint: 09:8e:08:a9:1d:bb:f7:74:78:b9:6c:ce:b8:9b:14:13:a5:da:37:b7:c8:62:60:6a:95:5d:eb:07:17:9f:43:26
+-----BEGIN CERTIFICATE-----
+MIICMjCCAbegAwIBAgIPAYvSIlRjTQSLbOVHH9K1MAoGCCqGSM49BAMDMEoxCzAJ
+BgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdU
+ZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzAeFw0yMzExMTUwODU1MjZaFw00ODA1MjMx
+MTAwMDBaMEoxCzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFC
+MSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABMHIlhVDLbmFKUpW0iK4dpryT6emYOeS31JPwWnWPmkWRrAkTbPX
+40sQfHI9mpR7Rbktu3ngg6W+BBSXSechtMCnBmWXj/EaVlmV5cY1jD2HoTfhBQ3A
+acpCNMLJK4NpZaNjMGEwHwYDVR0jBBgwFoAU1GToQ4g6cy/QGnGCNgtehd7H3kMw
+HQYDVR0OBBYEFNRk6EOIOnMv0BpxgjYLXoXex95DMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2kAMGYCMQCXAUdS/9bbJ8A1JYaG
+f/bWt/s7Ta0ot5Ulno8OjSNYRWQIlS4tVWldvTAVA7heOFgCMQCvKr8+Z2Rn+OBr
+5UHzlgBObpad1LuwNTRcdNgUJxIWadcki+UBLEi1/AURKV5md2M=
+-----END CERTIFICATE-----
+
+# Issuer: CN=Telia RSA TLS Root CA v3 O=Telia Company AB
+# Subject: CN=Telia RSA TLS Root CA v3 O=Telia Company AB
+# Label: "Telia RSA TLS Root CA v3"
+# Serial: 8028214673410753541795188766939845
+# MD5 Fingerprint: f4:8b:9c:f3:f8:63:cf:dc:25:8f:b4:bb:a2:e9:9d:e2
+# SHA1 Fingerprint: b5:2e:88:4e:40:c1:11:fb:50:c7:e2:4f:ac:18:2b:bd:68:15:d2:34
+# SHA256 Fingerprint: d1:3d:b1:29:4c:45:eb:c6:fc:86:c6:bb:f6:9f:a2:9b:df:e6:92:df:f7:c7:13:c2:43:c7:a9:56:c6:a2:28:4c
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgIPAYvSUKtCVSxHWr2h3BrFMA0GCSqGSIb3DQEBDAUAMEsx
+CzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSEwHwYDVQQD
+DBhUZWxpYSBSU0EgVExTIFJvb3QgQ0EgdjMwHhcNMjMxMTE1MDk0NzQyWhcNNDgw
+NTIzMTEwMDAwWjBLMQswCQYDVQQGEwJTRTEZMBcGA1UECgwQVGVsaWEgQ29tcGFu
+eSBBQjEhMB8GA1UEAwwYVGVsaWEgUlNBIFRMUyBSb290IENBIHYzMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsV89KG19hCf4S1Fvk8D3TyDERhmcvx8F
+7Kmb4WATx3ije1id3KHxRE0TKmcNCbAQ57bvHFEYa4hR2l20VjVadExqOW+2ld99
+MbEiO+jRVOz+BbxLxJnmGwCqI+BfuTjjVReDxsxjQvjgBsClaO/sm5i70nlZcWGR
+tIkvWDK3NNkT5RtwXc/O8NTFVpbUqT6cRjIj3olAblR+lRf4Ffy5o+Q9fabjYn9Z
+9S4itruElcEFf9Ljk7fwdTycT/rvJW9w/B3G2a3r0f/zXNOVruIBcqE6pkSospAC
+U2bG42fYKrbM/GWnp7u+p9Frz4jaNwpb4YHuEeS8BratNcP8X62jXIvvKHxlsMDJ
+Cnb4U8JzFOLsU6mohVY58BdZrvi0Gk9UOuqmgoG6dskHoksjZTlK61D/InzmEoA1
+yAYJFDVysjRxDUOu9cAwANbqmq77WIFL6BpnZgVqPtMfG6wN8BrTKdapvilVsYR5
+9BFgIsAVBMxrGh+W+QcvmJafUpASvlArKvVG2FI4i6PiLjSBT0+6F6EQLrYqefOQ
+F/fBNEXb+njUQ0SUVrAqtH4Y+OjCI/a4/JJQppxeemZcQ0SUShgiI5AM5xHO5iya
+UrTjYH4zxUz9j+1FEbDH/xpstr1gXBykspup+hRTaJcbA+UbpJqtWZndAPddJmt6
+YJQ+dU3pDu8CAwEAAaNjMGEwHwYDVR0jBBgwFoAUsMep0t2yKFZzBJSMFFxIbzdS
+kqgwHQYDVR0OBBYEFLDHqdLdsihWcwSUjBRcSG83UpKoMA4GA1UdDwEB/wQEAwIB
+BjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQBdYzFsNGDRk7bR
+/AgRKq+5637YuOW+w6uhpoS0VnKMUpyHCwku86hEvqivakPtfmlm4bFwt++sb/8O
+XsWBqtfbXMaBNDTZl8XRMJuLWOW2JrbKkRzgG0eBUcvsadG1rrhbmZqYvFXaAZO7
+o4TdOZzxhBB5GOAWWXB3IeraNP4J63zyo9n8Gqw3sJBG44em5hoYjBffP+npibys
+lnslRi4L6xHsCYj/Pab+OlqbMCB6v+sTCLeEIukRVzoR9aQ45pEK7Z1QBnSsbAKQ
+tss0JKD9d/mX143H1xePjPhTXlv5JCkhrcj+SShz0P9+EHoWe6m9lyUEOIVn0rp+
+yVJWNbmyDv3VkwFxHC1ApSQsgSimjGQ4wtr6cSmordYxkV+Ro8lOIIhRksXPyDk2
+7gW6IjUXCkZKpxFjkL3jiBSc8SkxnwCWtXg8xwNwdFVNBGLCCuJnsneYXjJNqzRq
+UcoGwzsvF3Qi/ZnHUNvISdevlgIAXL4Wvrxaqvoa01wB+GCfs57RTGE4TvAGhKNK
+us8K3hRT1BSpigzMIRzSxtAOrqPN6j//QSmW9f8Jcncri4j2ihSpVrFU0NdNkMhZ
+eAKidTFPsxCVFuW4Aniz7jqiw5sWtjbQrlW035izIEU4sYwQoC1Nx0Svy+mMTRai
+50LqFQ+A1/Hq6xHHDNx7CI83d23Erw==
+-----END CERTIFICATE-----
+

{pex-2.98.2 → pex-2.98.4}/pex/vendor/_vendored/pip/pip-20.3.4.dist-info/RECORD

@@ -157,7 +157,7 @@ pip/_vendor/cachecontrol/caches/file_cache.py,sha256=nYVKsJtXh6gJXvdn1iWyrhxvkwp
 pip/_vendor/cachecontrol/caches/redis_cache.py,sha256=HxelMpNCo-dYr2fiJDwM3hhhRmxUYtB5tXm1GpAAT4Y,856
 pip/_vendor/certifi/__init__.py,sha256=TocBfHrqAkQK91W5jNYhRH8KKizxkkXZBk68DTHj0xo,62
 pip/_vendor/certifi/__main__.py,sha256=1k3Cr95vCxxGRGDljrW3wMdpZdL3Nhf0u1n-k2qdsCY,255
-pip/_vendor/certifi/cacert.pem,sha256=DWav_Pt1jsUWI2Kaf9HtyL1bG94VZHB7SqQ0fbwwUMM,234429
+pip/_vendor/certifi/cacert.pem,sha256=2Znzn7mG6K780pnARxfnN0ahE3VWK2XNYh4zE2bYzTU,240291
 pip/_vendor/certifi/core.py,sha256=jBrwKEWpG0IKcuozK0BQ2HHGp8adXAOyBPC7ddgR6vM,2315
 pip/_vendor/chardet/__init__.py,sha256=YsP5wQlsHJ2auF1RZJfypiSrCA7_bQiRm3ES_NI76-Y,1559
 pip/_vendor/chardet/big5freq.py,sha256=D_zK5GyzoVsRes0HkLJziltFQX0bKCLOrFe9_xDvO_8,31254

{pex-2.98.2 → pex-2.98.4}/pex/venv/venv_pex.py

@@ -166,6 +166,8 @@ def boot(
         except ImportError:
             pass
 
+    set_last_access = os.environ.pop("_PEX_CACHE_SET_LAST_ACCESS", "1").lower() in ("1", "true")
+
     ignored_pex_env_vars = [
         "{}={}".format(name, value)
         for name, value in os.environ.items()
@@ -326,6 +328,14 @@ def boot(
 
     replacements = Namespace(env=Namespace(os.environ, safe=True))
 
+    # Update last access time for proper pex3 cache prune behavior when run directly via a PEX
+    # `--sh-boot` script header or a PEX scie.
+    if set_last_access:
+        with open(os.path.join(os.path.dirname(__file__), ".last-access"), "a") as fp:
+            os.utime(fp.name, None)
+
+    # Now execute the appropriate PEX entry point.
+
     pex_script = pex_overrides.get("PEX_SCRIPT") if pex_overrides else script
     if pex_script:
         script_path = os.path.join(venv_bin_dir, pex_script)

{pex-2.98.2 → pex-2.98.4}/pex/version.py

@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.98.2"
+__version__ = "2.98.4"

{pex-2.98.2 → pex-2.98.4}/pyproject.toml

@@ -156,6 +156,8 @@ mypy = [
   # 0.10.6 stubs are not compatible with Python 2.7
   "types-toml==0.10.5; python_version >= '3.8'",
 
+  "typing_extensions",
+
   {include-group = "build-cache-image"},
   {include-group = "devpi-server"},
   {include-group = "docs"},

pex-2.98.4/tests/integration/test_issue_3223.py

@@ -0,0 +1,120 @@
+# Copyright 2026 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import
+
+import os
+import shutil
+import subprocess
+from uuid import uuid4
+
+import pytest
+
+from pex.cache import access
+from pex.cache.dirs import VenvDirs
+from pex.common import safe_open
+from pex.os import WINDOWS
+from pex.pex_info import PexInfo
+from pex.typing import TYPE_CHECKING
+from testing import run_pex_command
+from testing.pytest_utils.tmp import Tempdir
+from testing.scie import has_provider
+
+if TYPE_CHECKING:
+    from typing import Dict, List, Tuple
+
+
+def create_venv_pex(
+    tmpdir,  # type: Tempdir
+    extra_args,  # type: List[str]
+):
+    # type: (...) -> Tuple[str, str]
+
+    if WINDOWS and "--sh-boot" in extra_args:
+        pytest.skip("The direct execution of --sh-boot shebang PEXes does not work on Windows.")
+
+    if "--scie" in extra_args and not has_provider():
+        pytest.skip(
+            "Either A PBS or PyPy release must be available for the current interpreter to run "
+            "this test."
+        )
+
+    resources = tmpdir.join("resources")
+    with safe_open(os.path.join(resources, "generate-unique-pex-hash"), "w") as fp:
+        fp.write(uuid4().hex)
+
+    pex = tmpdir.join("pex")
+    run_pex_command(
+        args=["-D", resources, "cowsay==5.0", "-c", "cowsay", "-o", pex, "--venv", "prepend"]
+        + extra_args
+    ).assert_success()
+
+    pex_hash = PexInfo.from_pex(pex).pex_hash
+    assert pex_hash is not None
+
+    return pex, pex_hash
+
+
+@pytest.mark.parametrize(
+    "extra_args",
+    [
+        pytest.param([], id="PEX"),
+        pytest.param(["--sh-boot"], id="SH_BOOT"),
+        pytest.param(["--scie", "eager", "--scie-only"], id="SCIE"),
+    ],
+)
+def test_venv_direct_execution_prune_time(
+    tmpdir,  # type: Tempdir
+    extra_args,  # type: List[str]
+):
+    # type: (...) -> None
+
+    pex, pex_hash = create_venv_pex(tmpdir, extra_args)
+
+    def collect_venv_access_times():
+        # type: () -> Dict[VenvDirs, float]
+        return {
+            directory: access_time
+            for directory, access_time in access.iter_all_cached_pex_dirs()
+            if isinstance(directory, VenvDirs) and directory.pex_hash == pex_hash
+        }
+
+    assert b"| Moo! |" in subprocess.check_output(args=[pex, "Moo!"])
+    access_times = collect_venv_access_times()
+
+    assert b"| Moo! |" in subprocess.check_output(args=[pex, "Moo!"])
+    new_access_times = collect_venv_access_times()
+
+    for venv_dirs, access_time in access_times.items():
+        new_access_time = new_access_times.pop(venv_dirs)
+        assert (
+            new_access_time > access_time
+        ), "Expected direct execution to bump the access time for {venv_dir}".format(
+            venv_dir=venv_dirs.path
+        )
+    assert not new_access_times
+
+
+@pytest.mark.parametrize(
+    "extra_args",
+    [
+        pytest.param([], id="PEX"),
+        pytest.param(["--sh-boot"], id="SH_BOOT"),
+        pytest.param(["--scie", "eager", "--scie-only"], id="SCIE"),
+    ],
+)
+def test_venv_cache_robustness(
+    tmpdir,  # type: Tempdir
+    extra_args,  # type: List[str]
+):
+    # type: (...) -> None
+
+    pex, pex_hash = create_venv_pex(tmpdir, extra_args)
+
+    assert b"| Moo! |" in subprocess.check_output(args=[pex, "Moo!"])
+    venv_dirs = [venv_dirs for venv_dirs in VenvDirs.iter_all() if venv_dirs.pex_hash == pex_hash]
+    assert len(venv_dirs) == 1
+    venv_dir = venv_dirs[0].path
+
+    shutil.rmtree(venv_dir)
+    assert b"| Moo! |" in subprocess.check_output(args=[pex, "Moo!"])