pypilot-cli 1.0.4__tar.gz → 1.0.5__tar.gz

pypilot_cli-1.0.5/.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    name: py${{ matrix.python }} (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+        include:
+          # The oldest and newest supported Pythons on the other platforms the
+          # engine ships for, since archive handling differs between them.
+          - { os: windows-latest, python: "3.8" }
+          - { os: windows-latest, python: "3.14" }
+          - { os: macos-latest, python: "3.8" }
+          - { os: macos-latest, python: "3.14" }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      # Warnings are errors so a deprecation that a new Python release turns
+      # into a behaviour change (as 3.14 did for tarfile) fails here first.
+      - name: Test
+        run: uv run --python ${{ matrix.python }} python -m pytest -W error

{pypilot_cli-1.0.4 → pypilot_cli-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pypilot-cli
-Version: 1.0.4
+Version: 1.0.5
 Summary: Deterministic Python environment doctor, dependency solver, and hardware compatibility manager.
 Project-URL: Homepage, https://github.com/Abdullah-Masood-05/pypilot
 Project-URL: Repository, https://github.com/Abdullah-Masood-05/pypilot
@@ -31,7 +31,7 @@ Description-Content-Type: text/markdown
 [![PyPI version](https://img.shields.io/pypi/v/pypilot-cli?color=blue&logo=pypi&logoColor=white)](https://pypi.org/project/pypilot-cli/)
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE)
 [![Rust](https://img.shields.io/badge/Engine-Rust-orange.svg?logo=rust&logoColor=white)](https://github.com/Abdullah-Masood-05/pypilot)
-[![Python](https://img.shields.io/badge/Python-3.8+-green.svg?logo=python&logoColor=white)](https://python.org)
+[![Python](https://img.shields.io/badge/Python-3.8%20to%203.14-green.svg?logo=python&logoColor=white)](https://python.org)
 
 **PyPilot** is a deterministic Python environment doctor, dependency solver, and toolchain manager. Powered by a high-speed compiled **Rust engine**, PyPilot calculates dependency intersections directly from PyPI wheel metadata, resolves hardware and CUDA build compatibility, and sets up working virtual environments without external AI or API keys.
 

{pypilot_cli-1.0.4 → pypilot_cli-1.0.5}/README.md

@@ -3,7 +3,7 @@
 [![PyPI version](https://img.shields.io/pypi/v/pypilot-cli?color=blue&logo=pypi&logoColor=white)](https://pypi.org/project/pypilot-cli/)
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE)
 [![Rust](https://img.shields.io/badge/Engine-Rust-orange.svg?logo=rust&logoColor=white)](https://github.com/Abdullah-Masood-05/pypilot)
-[![Python](https://img.shields.io/badge/Python-3.8+-green.svg?logo=python&logoColor=white)](https://python.org)
+[![Python](https://img.shields.io/badge/Python-3.8%20to%203.14-green.svg?logo=python&logoColor=white)](https://python.org)
 
 **PyPilot** is a deterministic Python environment doctor, dependency solver, and toolchain manager. Powered by a high-speed compiled **Rust engine**, PyPilot calculates dependency intersections directly from PyPI wheel metadata, resolves hardware and CUDA build compatibility, and sets up working virtual environments without external AI or API keys.
 

{pypilot_cli-1.0.4 → pypilot_cli-1.0.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pypilot-cli"
-version = "1.0.4"
+version = "1.0.5"
 description = "Deterministic Python environment doctor, dependency solver, and hardware compatibility manager."
 readme = "README.md"
 requires-python = ">=3.8"

{pypilot_cli-1.0.4 → pypilot_cli-1.0.5}/src/pypilot/__init__.py

@@ -10,7 +10,7 @@ from typing import List, Optional
 
 from .binary import ensure_binary, get_cache_dir
 
-__version__ = "1.0.4"
+__version__ = "1.0.5"
 
 
 def run(args: Optional[List[str]] = None, capture_output: bool = False) -> subprocess.CompletedProcess[str]:

{pypilot_cli-1.0.4 → pypilot_cli-1.0.5}/src/pypilot/binary.py

@@ -97,6 +97,23 @@ def probe_binary(path: Path | str) -> tuple[int, int, int] | None:
     return None
 
 
+def extract_archive(archive: Path | str, dest: Path | str) -> None:
+    """Extract a downloaded `.zip` or `.tar.gz` release archive into `dest`."""
+    if str(archive).endswith(".zip"):
+        with zipfile.ZipFile(archive, "r") as zf:
+            zf.extractall(dest)
+        return
+    with tarfile.open(archive, "r:gz") as tf:
+        # Python 3.14 filters tar members by default and 3.12/3.13 warn that it
+        # is coming. Ask for the same behaviour everywhere it is available (it
+        # was backported to the late 3.8-3.11 releases): plain files only, and
+        # nothing may land outside `dest`.
+        if hasattr(tarfile, "data_filter"):
+            tf.extractall(dest, filter="data")
+        else:
+            tf.extractall(dest)
+
+
 def download_binary(tag: str = DEFAULT_TAG) -> Path:
     """Download prebuilt native binary from GitHub releases."""
     slug, ext = get_platform_slug()
@@ -115,12 +132,7 @@ def download_binary(tag: str = DEFAULT_TAG) -> Path:
         with urllib.request.urlopen(req) as resp, open(tmp_archive, "wb") as f:
             shutil.copyfileobj(resp, f)
 
-        if ext == "zip":
-            with zipfile.ZipFile(tmp_archive, "r") as zf:
-                zf.extractall(tmpdir)
-        else:
-            with tarfile.open(tmp_archive, "r:gz") as tf:
-                tf.extractall(tmpdir)
+        extract_archive(tmp_archive, tmpdir)
 
         extracted_bin = Path(tmpdir) / bin_name
         if not extracted_bin.exists():

pypilot_cli-1.0.5/tests/test_cli.py

@@ -0,0 +1,89 @@
+import subprocess
+import pypilot
+from pypilot.binary import ensure_binary, get_platform_slug
+
+
+def test_platform_slug():
+    slug, ext = get_platform_slug()
+    assert slug in ("linux-x64", "darwin-x64", "darwin-arm64", "windows-x64")
+    assert ext in ("tar.gz", "zip")
+
+
+def test_ensure_binary():
+    bin_path = ensure_binary()
+    assert bin_path.exists()
+
+
+def test_pypilot_version():
+    res = pypilot.run(["--version"], capture_output=True)
+    assert res.returncode == 0
+    assert "pypilot" in res.stdout
+
+
+def test_bundled_version_matches_default_tag():
+    from pypilot.binary import BUNDLED_VERSION, DEFAULT_TAG, MIN_VERSION
+
+    assert DEFAULT_TAG == "v" + ".".join(map(str, BUNDLED_VERSION))
+    assert BUNDLED_VERSION >= MIN_VERSION
+
+
+def test_extract_archive_reads_tar_gz_without_warnings(tmp_path):
+    import io
+    import tarfile
+    import warnings
+
+    from pypilot.binary import extract_archive
+
+    archive = tmp_path / "pypilot-linux-x64.tar.gz"
+    payload = b"#!/bin/sh\n"
+    with tarfile.open(archive, "w:gz") as tf:
+        info = tarfile.TarInfo("pypilot")
+        info.size = len(payload)
+        info.mode = 0o755
+        tf.addfile(info, io.BytesIO(payload))
+
+    out = tmp_path / "out"
+    out.mkdir()
+    with warnings.catch_warnings():
+        warnings.simplefilter("error")  # 3.12/3.13 warn about the 3.14 default
+        extract_archive(archive, out)
+    assert (out / "pypilot").read_bytes() == payload
+
+
+def test_extract_archive_reads_zip(tmp_path):
+    import zipfile
+
+    from pypilot.binary import extract_archive
+
+    archive = tmp_path / "pypilot-windows-x64.zip"
+    with zipfile.ZipFile(archive, "w") as zf:
+        zf.writestr("pypilot.exe", b"MZ")
+
+    out = tmp_path / "out"
+    out.mkdir()
+    extract_archive(archive, out)
+    assert (out / "pypilot.exe").read_bytes() == b"MZ"
+
+
+def test_extract_archive_refuses_members_outside_the_destination(tmp_path):
+    import io
+    import tarfile
+
+    import pytest
+
+    from pypilot.binary import extract_archive
+
+    if not hasattr(tarfile, "data_filter"):
+        pytest.skip("this Python predates tarfile extraction filters")
+
+    archive = tmp_path / "evil.tar.gz"
+    with tarfile.open(archive, "w:gz") as tf:
+        info = tarfile.TarInfo("../escaped")
+        info.size = 1
+        tf.addfile(info, io.BytesIO(b"x"))
+
+    out = tmp_path / "out"
+    out.mkdir()
+    with pytest.raises(tarfile.TarError):
+        extract_archive(archive, out)
+    assert not (tmp_path / "escaped").exists()

{pypilot_cli-1.0.4 → pypilot_cli-1.0.5}/uv.lock

@@ -1157,7 +1157,7 @@ wheels = [
 
 [[package]]
 name = "pypilot-cli"
-version = "1.0.4"
+version = "1.0.5"
 source = { editable = "." }
 
 [package.dev-dependencies]

pypilot_cli-1.0.4/tests/test_cli.py

@@ -1,27 +0,0 @@
-import subprocess
-import pypilot
-from pypilot.binary import ensure_binary, get_platform_slug
-
-
-def test_platform_slug():
-    slug, ext = get_platform_slug()
-    assert slug in ("linux-x64", "darwin-x64", "darwin-arm64", "windows-x64")
-    assert ext in ("tar.gz", "zip")
-
-
-def test_ensure_binary():
-    bin_path = ensure_binary()
-    assert bin_path.exists()
-
-
-def test_pypilot_version():
-    res = pypilot.run(["--version"], capture_output=True)
-    assert res.returncode == 0
-    assert "pypilot" in res.stdout
-
-
-def test_bundled_version_matches_default_tag():
-    from pypilot.binary import BUNDLED_VERSION, DEFAULT_TAG, MIN_VERSION
-
-    assert DEFAULT_TAG == "v" + ".".join(map(str, BUNDLED_VERSION))
-    assert BUNDLED_VERSION >= MIN_VERSION