Skip to content

pip gets the package in place of its metadata through a pull-through link once the package is cached #1453

Open

Description

@aevnsvi

Version
pulp_python 3.36.2 with pulpcore 3.120.0; the same code is on main.

Describe the bug
For a package that is not in the repository yet, the simple page links
<base>/<file>?redirect=<upstream URL> and announces its PEP 658 metadata on that
link (data-core-metadata / core-metadata). pip builds the metadata URL by
appending .metadata to the whole link, so the suffix lands in the redirect
parameter and the path still names the package:
<base>/<file>?redirect=<upstream URL>.metadata.

PythonRemote.get_remote_artifact_url() handles that form, but only on the
pull-through branch of the content handler. When the package is already in the
repository, because another client fetched it in the meantime, the handler finds it
by its path first and answers the metadata request with the package itself. pip then
fails the metadata's hash check. A client gets into this whenever it read the simple
page before the package was cached, for example two CI jobs installing the same new
package at the same time.

To Reproduce

  1. A distribution with a Python repository and a PyPI remote (pull-through).
  2. On simple/<project>/, take the link of a wheel that is not cached yet; it carries
    ?redirect= and announces metadata.
  3. GET the link: the wheel is downloaded and added to the repository.
  4. GET the same link with .metadata appended: the response is the wheel (its sha256),
    not the metadata.

Expected behavior
A link either announces metadata that is served at the URL pip derives from it, or
announces none.

Additional context
Fixing it on the serving side would need the query string where the package is looked
up by path, which Distribution.content_handler() does not get. Not announcing
metadata on pull-through links avoids the request altogether: installers fall back to
the metadata in the package they download, and once the package is in the repository
its local link has no query string and announces the metadata again. A pull request
doing that follows.

Activity

  1. added 2 commits that reference this issue on Oct 29, 2026
    d4cbe62
    9550d81
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions