You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
pip gets the package in place of its metadata through a pull-through link once the package is cached #1453
Version
pulp_python 3.36.2 with pulpcore 3.120.0; the same code is on main.
Describe the bug
For a package that is not in the repository yet, the simple page links <base>/<file>?redirect=<upstream URL> and announces its PEP 658 metadata on that
link (data-core-metadata / core-metadata). pip builds the metadata URL by
appending .metadata to the whole link, so the suffix lands in the redirect
parameter and the path still names the package: <base>/<file>?redirect=<upstream URL>.metadata.
PythonRemote.get_remote_artifact_url() handles that form, but only on the
pull-through branch of the content handler. When the package is already in the
repository, because another client fetched it in the meantime, the handler finds it
by its path first and answers the metadata request with the package itself. pip then
fails the metadata's hash check. A client gets into this whenever it read the simple
page before the package was cached, for example two CI jobs installing the same new
package at the same time.
To Reproduce
A distribution with a Python repository and a PyPI remote (pull-through).
On simple/<project>/, take the link of a wheel that is not cached yet; it carries ?redirect= and announces metadata.
GET the link: the wheel is downloaded and added to the repository.
GET the same link with .metadata appended: the response is the wheel (its sha256),
not the metadata.
Expected behavior
A link either announces metadata that is served at the URL pip derives from it, or
announces none.
Additional context
Fixing it on the serving side would need the query string where the package is looked
up by path, which Distribution.content_handler() does not get. Not announcing
metadata on pull-through links avoids the request altogether: installers fall back to
the metadata in the package they download, and once the package is in the repository
its local link has no query string and announces the metadata again. A pull request
doing that follows.
Activity
Announce no metadata on pull-through links
Announce no metadata on pull-through links