Read recovered uv/pdm wheel pins through the shared lock model (#1079)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1079 (slice 1: ledger recovery)

Summary

repair and re-vendor rebuild a missing PyPI artifact from the uv / pdm [[package]] unit recorded in the vendor ledger. That unit was read by a third uv.lock reader, a string scanner (pure_wheel_from_uv_unit). It paired a pure wheel's URL with the first hash = "sha256: after it, even when that hash belonged to a later platform wheel. It also kept its own -none-any.whl suffix rule, which drifted from the shared wheel classifier once #1053 (#1048) landed. Recovery now reads the unit through the shared lock model and the shared classifier.

Why (leverage)

• Issue #1079, register row E89 (register), living document doc/06-discovery-vex.md {{E89}}.
• B 1 (p1 bug, recovery half), U 1 (slice 2 reuses the same pieces), D 2 (recovery's scanner and its suffix rule deleted), R L. Score ≈ 9.
• Every higher-scoring candidate (Finish every vendored revert through one shared helper with an explicit keep policy instead of 12 copied finish blocks #990, Build npm-family vendor ledger entries through one constructor instead of seven literal VendorEntry blocks #922, Compute sha256, sha1 and sha512-SRI digests through utils::digest instead of inline copies #706 slice 2) changes files that open PRs change. This slice stays inside files no open PR touches.

What changed

• vendor/pypi_distribution.rs: new is_portable_wheel_url(url). It strips ?/#, takes the last path segment, requires .whl, and asks wheel_platform_from_filename, the rule vendored (vendor_platform_locked) and hosted (redirect_pypi_platform_wheel) mode already use.
• vendor/lock_inventory/recover.rs: pure_wheel_from_uv_unit parses the unit as TOML ([[package]] unit, or a bare artifact-array fragment). It reads artifacts through utils::python_lock::package_artifacts (archive, wheels, wheel, files), so each URL keeps its own hash, and keeps the http(s) gate (http_url).
• .github/workflows/ci.yml: the setup-php pin comment # v2 → # 2.37.2, ported from Label the setup-php pin in ci.yml with its real tag #1118 because zizmor fails every PR on main without it. It no-ops once Label the setup-php pin in ci.yml with its real tag #1118 merges.

Deleted

• The string scanner body (≈25 lines) and recovery's private -none-any.whl suffix rule.
• git diff --stat: production +36 / −24 (recover.rs, pypi_distribution.rs), tests +88 (recover_tests.rs), CI +1 / −1.

Remaining (slice 2, after #1058 / #1009 / #1045 / #768 land)

• lock_inventory/pypi.rs python_package_archive and the poetry site still use ends_with("-none-any.whl"). Both move onto is_portable_wheel_url, and the inventory and recovery selectors become one function.
• Rename pure_wheel_from_uv_unit and move its old test out of lock_inventory/{mod,tests}.rs.
  These files are changed by open PRs, so they're left alone here.

Behavior

Recovery only (repair / re-vendor of a missing vendored PyPI artifact from a uv or pdm static_urls fragment):

• A hashless pure wheel followed by a hashed wheel now fails with the existing "no fetchable registry URL" message. Before, it fetched the pure wheel against the other wheel's digest and failed with a hash mismatch.
• cp311-none-any, pp310-none-any and py2-none-any wheels are no longer picked as portable, matching vendored and hosted mode since Hosted Pipenv scan still pins an interpreter-bound cp311-none-any patched wheel into Pipfile.lock with no warning, so pipenv sync fails on every other Python version (gap in the #932 fix) #1048.
• A #sha256=… or ?query URL is classified by its file name. Before, it was never recognised as pure.
• url="…" with no spaces now parses. The old scanner needed url = ".
  No change to inventory, lockfile bytes, JSON shape, error codes or exit codes.

Test evidence

• New tests in recover_tests.rs:
  • recover_uv_never_pairs_a_pure_wheel_with_another_wheels_hash: the Vendored uv repair pairs a hashless pure wheel with another wheel's hash, because ledger recovery re-parses uv.lock with its own scanner #1079 repro through recover_lock_entry.
  • recovery_pure_wheel_matches_the_shared_portability_rule: an 11-row table, each row through a uv wheels unit and a pdm files unit, checked against wheel_platform_from_filename.
  • recovery_pure_wheel_pairs_each_url_with_its_own_hash: the full unit with sdist, [package.metadata] and an uppercase digest, plus a non-TOML requirements_line.
• Red→green: with main's recover.rs, all 3 fail. On the branch, all pass. The existing composer_gem_uv_fragments_recover, recover_pypi_pdm_static_urls_recovers_pure_wheel, recover_pypi_urlless_locks_report_no_fetchable_url and pure_wheel_rejects_short_hash_missing_hash_and_non_http_url pass unchanged.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --lib: 5742 passed, 4 failed. The 4 failures fail on main too because the sandbox runs as root (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_maps_error_and_leaves_lock_untouched, pypi_requirements::wire_failure_rolls_back_already_written_files).
• cargo test -p socket-patch-cli --all-features --test repair: 125 passed, 2 failed. Both are the known root-only chmod tests.

Risk

Low. The change is confined to the ledger-recovery path, which is rare and fail-closed: the fetch layer still verifies every digest. Recovery now parses the unit with toml_edit, which costs ≈80 µs per call; it runs once per missing artifact.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are limited to rare ledger-recovery code; fetches still verify digests, and unpinned or ambiguous cases remain fail-closed.

Overview
Fixes #1079 in the vendor-ledger recovery path (repair / re-vendor when a PyPI artifact is missing): uv and pdm [[package]] units are no longer read with a string scanner that could bind a portable wheel URL to another wheel’s sha256.

Recovery now parses the unit as TOML and walks artifacts through package_artifacts, so each URL keeps its own hash. Portable wheel selection uses a new is_portable_wheel_url helper (same wheel_platform_from_filename rule as vendored/hosted mode) instead of a -none-any.whl suffix check—so interpreter-tagged “any” wheels are excluded and query/fragment URLs classify correctly. Unpinned or non-portable wheels still fail closed with the existing “no fetchable registry URL” behavior.

CI only updates the setup-php pin comment (# v2 → # 2.37.2) for zizmor. New tests cover the mis-pairing repro, portability matrix, and per-artifact hashing.

^{Reviewed by Cursor Bugbot for commit fd8b7e6. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[agent] Audit GitHub Actions failed on the first commit with zizmor ref-version-mismatch on .github/workflows/ci.yml:1400 (the setup-php pin labelled # v2). This PR doesn't cause it; main's ci.yml does. Open PR #1118 fixes it, so I ported the same one-line change in fd8b7e6. It no-ops once #1118 merges.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fd8b7e6. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[agent] e2e (ubuntu-latest, e2e_vendor_maven_build, maven, 3.8.9) failed during fixture warm-up, before any test body ran. Maven Central didn't serve maven-dependency-plugin:3.6.1 on all 3 tries ("Could not find artifact … in central"). This PR only changes PyPI ledger recovery and doesn't touch Maven or the e2e harness, so the failure isn't this PR's and there's no fix to port. I'll re-run the failed jobs once when the run completes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: fd8b7e6060eb8c7b58854c0b91de08246522eccb
• CI: 472/472 check runs green (success/skipped/neutral) on this head, mergeable, no conflicts.
• Bugbot: reviewed this head (Cursor Bugbot check: success), no unresolved review threads.
• Changelog: untouched.

Nothing specific flagged for the reviewer beyond the PR description.

---

Generated by Claude Code