Allow unpinned requirements to use hashes from constraints - #13887
Conversation
5ce88cb to
dac19f2
Compare
| hash_options = { | ||
| alg: [v for v in other.hash_options[alg] if v in self.hash_options[alg]] | ||
| for alg in self.hash_options.keys() & other.hash_options.keys() | ||
| } |
There was a problem hiding this comment.
Should multiple entries for the same requirement get unioned or intersected?
Right now, this mirrors Hashes.__and__: uses as-is when one side is empty, intersection of them when both are present.
There was a problem hiding this comment.
Though choice. Maybe unioned in case users combine constraints files for different platforms?
There was a problem hiding this comment.
Let's get this in people's hands and see what they say? 👀
It's easier to start restrictive and relax this, so I'm leaning towards the intersection for the first iteration that we release.
Constraints with `==version --hash=...` correctly narrow the candidate set, but the per-candidate `InstallRequirement` still reflected the original unpinned and hashless requirement. In such a configuration, plumb through the hashes from the constraints to the per-candidate `InstallRequirement`, and pin it to the version from the link (which is informed by the constraint). This makes hashes get correctly used for candidate selection and verification, at the cost of a few copies at the start of the resolve in such cases.
dac19f2 to
3cd1be1
Compare
| hash_options = { | ||
| alg: [v for v in other.hash_options[alg] if v in self.hash_options[alg]] | ||
| for alg in self.hash_options.keys() & other.hash_options.keys() | ||
| } |
There was a problem hiding this comment.
Though choice. Maybe unioned in case users combine constraints files for different platforms?
| template = copy.copy(template) | ||
| template.hash_options = { | ||
| k: list(v) for k, v in constraint_hash_options.items() | ||
| } |
There was a problem hiding this comment.
Yea, I could do a deepcopy directly too; if that'd be clearer. 😅
2 participants
Closes #9243, I think?
This is now a tomorrow thing for me. Gotta go to PyCon US stuff now.