diff mbox series

python3-build: verify that found dependencies are valid

Message ID 20260812113529.2829703-1-ross.burton@arm.com
State Under Review
Headers show
Series python3-build: verify that found dependencies are valid | expand

Commit Message

Ross Burton Aug. 12, 2026, 11:35 a.m. UTC 
Due to how recipes are removed from the sysroot, it is possible for
packages to be found by python's importlib when they do not exist. This
is because when a recipe is removed from the sysroot we only delete the
files and leave empty directories, so if a recipe that provides a python
package is removed then the foo-1.2.3.dist-info/ directory remains and
that is found by importlib.

Add a check to the dependency resolve in pypa/build so that it verifies
that found packages have some metadata (by checking for a name). This
will fail on these ghost packages as they have no metadata files.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 .../python3-build/check-valid-dist.patch      | 31 +++++++++++++++++++
 .../python/python3-build_1.5.1.bb             |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-build/check-valid-dist.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-build/check-valid-dist.patch b/meta/recipes-devtools/python/python3-build/check-valid-dist.patch
new file mode 100644
index 00000000000..dd6f256e266
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-build/check-valid-dist.patch
@@ -0,0 +1,31 @@ 
+Ignore invalid distributions when checking dependencies
+
+If there's an empty directory foo-1.2.dist-info/ on the search path then
+importlib will return that as a distribution called "foo".
+
+However it has no code and no metadata, so doesn't exist in any real way.
+Check that the found distribution is in some way valid by verifying that
+it has a name set.
+
+In Yocto this can happen if foo was removed as a dependency from the sysroot:
+the dist-info directory is empties but remains in the sysroot.
+
+Upstream-Status: Submitted [https://github.com/pypa/build/pull/1145]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+diff --git i/src/build/_util.py w/src/build/_util.py
+index c365003..ba047c7 100644
+--- i/src/build/_util.py
++++ w/src/build/_util.py
+@@ -67,6 +67,11 @@ def _check_dependency(
+         yield (*ancestral_req_strings, normalised_req_string)
+         return
+ 
++    if not dist.name:
++        # If the distribution doesn't have a name it has no metadata
++        yield (*ancestral_req_strings, normalised_req_string)
++        return
++
+     if req.specifier and not req.specifier.contains(dist.version, prereleases=True):
+         # the installed version is incompatible.
+         yield (*ancestral_req_strings, normalised_req_string)
diff --git a/meta/recipes-devtools/python/python3-build_1.5.1.bb b/meta/recipes-devtools/python/python3-build_1.5.1.bb
index dd741cb8623..d572ca846fc 100644
--- a/meta/recipes-devtools/python/python3-build_1.5.1.bb
+++ b/meta/recipes-devtools/python/python3-build_1.5.1.bb
@@ -3,6 +3,8 @@  HOMEPAGE = "https://github.com/pypa/build"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=310439af287b0fb4780b2ad6907c256c"
 
+SRC_URI += "file://check-valid-dist.patch"
+
 SRC_URI[sha256sum] = "94e17f1db803ab22f46049376c44c8437c52090f0dfdf1adc43df56542d644fb"
 
 inherit pypi python_flit_core