diff mbox series

[2/3] pypi.bbclass: improve UPSTREAM_CHECK_REGEX

Message ID 20260809231901.366919-4-tim.orling@konsulko.com
State Under Review
Headers show
Series [1/3] python3-git: fix CVE_PRODUCT | expand

Commit Message

Tim Orling Aug. 9, 2026, 11:19 p.m. UTC 
From: Tim Orling <tim.orling@konsulko.com>

UPSTREAM_CHECK_REGEX was case-sensitive, but PyPI's simple index now lists
lowercase sdist filenames (e.g. gitpython-*.tar.gz) for packages whose
PYPI_PACKAGE is mixed-case (e.g. GitPython).

Added an (?i) inline flag so the regex matches regardless of case — this
fixes AUH detection for python3-git and any other pypi.bbclass recipe hit
by the same upstream lowercase-normalization trend, without needing
per-recipe overrides.

This will not magically fix fetching, but WILL at least mean AUH will
detect more upstream releases and maintainers will see when the
resulting default PYPI_SRC_URI is failing.

A fix for some recipes might be to set:

PYPI_SRC_URI = ""${@pypi_src_uri(d).lower()}"

but it is premature to set that globally, as legacy recipes with
releases before the PEP-625 normalization still exist.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 meta/classes-recipe/pypi.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/classes-recipe/pypi.bbclass b/meta/classes-recipe/pypi.bbclass
index bd21557c60..0897994bb6 100644
--- a/meta/classes-recipe/pypi.bbclass
+++ b/meta/classes-recipe/pypi.bbclass
@@ -51,7 +51,7 @@  UPSTREAM_CHECK_PYPI_PACKAGE ?= "${PYPI_PACKAGE}"
 #
 # NOTE: All URLs for the simple API MUST request canonical normalized URLs per the spec
 UPSTREAM_CHECK_URI ?= "https://pypi.org/simple/${@pypi_normalize(d)}/"
-UPSTREAM_CHECK_REGEX ?= "${UPSTREAM_CHECK_PYPI_PACKAGE}-(?P<pver>(\d+[\.\-_]*)+).(tar\.gz|tgz|zip|tar\.bz2)"
+UPSTREAM_CHECK_REGEX ?= "(?i)${UPSTREAM_CHECK_PYPI_PACKAGE}-(?P<pver>(\d+[\.\-_]*)+).(tar\.gz|tgz|zip|tar\.bz2)"
 
 CVE_PRODUCT ?= "python:${PYPI_PACKAGE}"