Loop 8: PyPI production depth — inventory, artifact inspection, build-backend risk - #32
Merged
Merged
Conversation
…d-backend risk
Lockfile parsers:
- Table-aware poetry.lock/uv.lock parsing: sub-tables ([package.dependencies],
[package.source]) can no longer clobber name/version; records artifact
hashes (poetry files, uv wheels/sdist), explicit registries, and git/url
sources; uv.lock virtual/editable/path entries (the project itself) are
marked local and never scanned against PyPI.
- requirements.txt: backslash continuations and --hash capture
(pip-compile --generate-hashes layout), PEP 508 'name @ url' direct
references, URL/path lines no longer produce bogus scan targets.
- Pipfile.lock: hashes, index-name-to-URL resolution, git sources.
- PEP 503 name canonicalization and package-name validation.
- Dedupe(): one scan target per name@version across manifests+lockfiles;
unpinned manifest entries collapse into their lockfile-resolved pin and
keep direct-dependency provenance.
Artifact inspection:
- Orphaned compiled bytecode detection (.pyc/.pyo without matching source).
- Wheel RECORD checks: missing RECORD and extracted-but-unlisted files.
- Wheel {name}.data/scripts/ analyzed as an install execution surface.
Build-backend risk:
- Section-aware [build-system] parsing replaces line-based BuildBackend().
- New findings: in-tree backend-path backends and direct URL/VCS build
requirements. Both wired into policy defaults and default-policy.yaml.
CI scan (pypi):
- Discovers Pipfile/Pipfile.lock; dedups inventory before scanning; direct
URL/VCS dependencies surface as UNKNOWN (fail closed) instead of scanning
a same-named index package; Direct flag now reflects manifest provenance.
Calibration fix: only the artifact-root setup.py/pyproject.toml participates
in build/install; nested example/test manifests are inert and no longer
score (click 8.1.7 false-blocked at 100 from 11 example setup.py files;
now ALLOW at 20). Hermetic-test hardening: PyPI CI tests isolate the
home-keyed artifact cache.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PyPI is promoted in documentation from bare preview to preview (GA-candidate). evidence/pypi/pypi-ga-readiness.md records the depth matrix, validation results, live-scan calibration evidence, and the three named gates that must close before a GA claim (pip-parity version resolution, large-artifact handling, real-repo Python benchmark). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PkgSafe Dependency GateDecision: ALLOW Counts
Warn / Block FindingsNo blocked or warning dependencies found. Recommended ActionAll scanned packages are allowed by policy. Governance Evidence
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Loop 8 of the loop-engineering roadmap: PyPI Production Depth. Deepens Python dependency inventory and artifact analysis while keeping PyPI preview (now documented as GA-candidate) until the named readiness gates pass.
Dependency inventory (
internal/deps/python)poetry.lock/uv.lockparsing (sub-tables can no longer clobber entries); records lockfile hashes, explicit registries, git/url sourcesrequirements.txt: backslash continuations +--hashcapture (pip-compile --generate-hashes), PEP 508name @ urldirect references, URL/path lines can't become bogus scan targetsPipfile.lockhashes + index-name→URL resolution; PEP 503 name canonicalization + validationDedupe(): one scan target pername@versionacross manifests+lockfiles; unpinned manifest entries collapse into their lockfile pin and keep direct provenanceArtifact inspection (
internal/analyzer/pypi).pycwithout source), wheel RECORD missing/unlisted-files checks, wheel*.data/scripts/analyzed as install surface[build-system]parsing; new findings for in-treebackend-pathbackends and direct-URL build requirespolicy.Default()+default-policy.yamlCI scan
Pipfile/Pipfile.lock; dedups inventory; direct URL/VCS deps surface as UNKNOWN (fail closed);directflag now reflects manifest provenanceCalibration fix
Nested example/test
setup.py/pyproject.tomlno longer score as install surfaces —click==8.1.7false-blocked at 100 (11 inert example setup.py files × 15), now ALLOW at 20. Verified live against real PyPI.Evidence
evidence/pypi/pypi-ga-readiness.md— depth matrix, full-suite/race/corpus results, live-scan calibration table, and the three remaining GA gates (pip-parity version resolution, large-artifact caps, real-repo Python benchmark).Test plan
go vet ./...,go test ./...greengo test -raceon all touched packages🤖 Generated with Claude Code