fix(deps): resolve Pillow from piwheels on ARM32

contributors/emails/me@arasmehmet.com

@@ -0,0 +1,2 @@
+arasovic
+# PR #72134

pyproject.toml

@@ -371,7 +371,25 @@ override-dependencies = [
 exclude-newer = "14 days"
 # h2: temporary exclude-newer exception for the CVE-2026-71554 (GHSA-6hr6-w5qg-qmwg,
 # request-smuggling) fix in 4.4.1, published 2026-08-03. Remove after 2026-08-17.
-exclude-newer-package = { vercel = false, nemo-relay = false, huggingface_hub = false, h2 = false }
+# piwheels omits upload timestamps, so uv cannot apply the age gate to Pillow.
+# Pillow remains exact-pinned, index-scoped, and hash-locked in uv.lock.
+exclude-newer-package = { vercel = false, nemo-relay = false, huggingface_hub = false, h2 = false, pillow = false }
+
+# PyPI publishes native aarch64 Pillow wheels, so only 32-bit ARM needs
+# piwheels. piwheels publishes Pillow 12.3.0 for CPython 3.11 and 3.13 but
+# not 3.12. Keep the index explicit so no other dependency can resolve from it.
+# ARM32 Python 3.12 still uses the PyPI sdist and needs libjpeg/zlib headers.
+# On matching versions, a missing piwheels wheel is a hard resolution failure;
+# uv does not fall back to the sdist. See #72132.
+[tool.uv.sources]
+pillow = [
+  { index = "piwheels", marker = "(platform_machine == 'armv6l' or platform_machine == 'armv7l') and (python_version == '3.11' or python_version == '3.13')" },
+]
+
+[[tool.uv.index]]
+name = "piwheels"
+url = "https://www.piwheels.org/simple"
+explicit = true
 
 [tool.setuptools]
 # Top-level single-file modules (not packages). Without this, uv2nix's

tests/test_install_sh_uv_sources.py

@@ -0,0 +1,206 @@
+"""Behavioral coverage for the installer's uv fallback configuration."""
+
+from functools import partial
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import threading
+from zipfile import ZIP_DEFLATED, ZipFile
+
+import pytest
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+INSTALL_SH = REPO_ROOT / "scripts" / "install.sh"
+
+
+class _QuietHandler(SimpleHTTPRequestHandler):
+    def log_message(self, _format, *_args):
+        pass
+
+
+def _write_wheel(path: Path) -> None:
+    dist_info = "fallback_proof-1.0.0.dist-info"
+    with ZipFile(path, "w", ZIP_DEFLATED) as wheel:
+        wheel.writestr("fallback_proof/__init__.py", '__version__ = "1.0.0"\n')
+        wheel.writestr(
+            f"{dist_info}/METADATA",
+            "Metadata-Version: 2.1\nName: fallback-proof\nVersion: 1.0.0\n",
+        )
+        wheel.writestr(
+            f"{dist_info}/WHEEL",
+            "Wheel-Version: 1.0\n"
+            "Generator: hermes-test\n"
+            "Root-Is-Purelib: true\n"
+            "Tag: py3-none-any\n",
+        )
+        wheel.writestr(f"{dist_info}/RECORD", "")
+
+
+def _write_uv_wrapper(path: Path) -> None:
+    """Fail Tier 0, then delegate fallback resolution to real uv as a dry run."""
+    path.write_text(
+        """#!/bin/sh
+printf 'UV_NO_CONFIG=%s UV_NO_SOURCES=%s %s\\n' \\
+    "${UV_NO_CONFIG:-}" "${UV_NO_SOURCES:-}" "$*" >> "$UV_WRAPPER_LOG"
+if [ "$1" = "sync" ]; then
+    exit 42
+fi
+if [ "$1" = "pip" ] && [ "$2" = "install" ]; then
+    "$REAL_UV" "$@" --dry-run
+    status=$?
+    printf 'pip-status=%s\\n' "$status" >> "$UV_WRAPPER_LOG"
+    exit "$status"
+fi
+exec "$REAL_UV" "$@"
+""",
+        encoding="utf-8",
+    )
+    path.chmod(0o755)
+
+
+def _run_python_deps_stage(
+    *, project: Path, hermes_home: Path, env: dict[str, str]
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [
+            "bash",
+            str(INSTALL_SH),
+            "--stage",
+            "python-deps",
+            "--dir",
+            str(project),
+            "--hermes-home",
+            str(hermes_home),
+        ],
+        env=env,
+        capture_output=True,
+        text=True,
+        timeout=90,
+    )
+
+
+@pytest.mark.linux_only
+def test_installer_fallback_uses_project_sources_with_uv_no_config(tmp_path):
+    """The real python-deps fallback must retain package-scoped uv sources."""
+    uv = shutil.which("uv")
+    assert uv is not None, "uv must be available for installer integration tests"
+
+    index_root = tmp_path / "index"
+    package_index = index_root / "simple" / "fallback-proof"
+    package_index.mkdir(parents=True)
+    wheel_name = "fallback_proof-1.0.0-py3-none-any.whl"
+    _write_wheel(package_index / wheel_name)
+    (package_index / "index.html").write_text(
+        f'<a href="{wheel_name}">{wheel_name}</a>\n', encoding="utf-8"
+    )
+    (index_root / "empty").mkdir()
+
+    handler = partial(_QuietHandler, directory=str(index_root))
+    server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+
+    try:
+        base_url = f"http://127.0.0.1:{server.server_port}"
+        project = tmp_path / "project"
+        project.mkdir()
+        (project / "pyproject.toml").write_text(
+            f"""
+[project]
+name = "fallback-fixture"
+version = "0.1.0"
+requires-python = ">=3.11"
+dependencies = ["fallback-proof==1.0.0"]
+
+[project.optional-dependencies]
+all = []
+
+[tool.uv.sources]
+fallback-proof = {{ index = "fixture" }}
+
+[[tool.uv.index]]
+name = "fixture"
+url = "{base_url}/simple"
+explicit = true
+""".strip()
+            + "\n",
+            encoding="utf-8",
+        )
+        # Presence enters Tier 0; the wrapper forces that locked sync to fail so
+        # install.sh must execute its real uv-pip recovery tier.
+        (project / "uv.lock").write_text("", encoding="utf-8")
+
+        venv = project / "venv"
+        subprocess.run(
+            [uv, "venv", str(venv), "--python", sys.executable],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+
+        hermes_home = tmp_path / "hermes-home"
+        managed_bin = hermes_home / "bin"
+        managed_bin.mkdir(parents=True)
+        wrapper = managed_bin / "uv"
+        _write_uv_wrapper(wrapper)
+        wrapper_log = tmp_path / "uv-wrapper.log"
+
+        tool_bin = tmp_path / "tool-bin"
+        tool_bin.mkdir()
+        dpkg = tool_bin / "dpkg"
+        dpkg.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
+        dpkg.chmod(0o755)
+
+        env = {
+            key: value
+            for key, value in os.environ.items()
+            if not key.startswith("UV_")
+            and key not in {"CONDA_DEFAULT_ENV", "CONDA_PREFIX", "VIRTUAL_ENV"}
+        }
+        env.update({
+            "HOME": str(tmp_path / "home"),
+            "PATH": os.pathsep.join([
+                str(tool_bin),
+                str(Path(sys.executable).parent),
+                env["PATH"],
+            ]),
+            "REAL_UV": uv,
+            "UV_CACHE_DIR": str(tmp_path / "cache"),
+            "UV_DEFAULT_INDEX": f"{base_url}/empty",
+            "UV_WRAPPER_LOG": str(wrapper_log),
+        })
+
+        negative_env = {**env, "UV_NO_SOURCES": "1"}
+        negative = _run_python_deps_stage(
+            project=project, hermes_home=hermes_home, env=negative_env
+        )
+        negative_calls = wrapper_log.read_text(encoding="utf-8")
+        negative_statuses = [
+            line.removeprefix("pip-status=")
+            for line in negative_calls.splitlines()
+            if line.startswith("pip-status=")
+        ]
+
+        assert negative.returncode != 0
+        assert "UV_NO_CONFIG=1 UV_NO_SOURCES=1 pip install -e .[all]" in negative_calls
+        assert negative_statuses
+        assert all(status != "0" for status in negative_statuses)
+
+        wrapper_log.write_text("", encoding="utf-8")
+        result = _run_python_deps_stage(
+            project=project, hermes_home=hermes_home, env=env
+        )
+        calls = wrapper_log.read_text(encoding="utf-8")
+
+        assert result.returncode == 0, result.stdout + result.stderr
+        assert "UV_NO_CONFIG=1 UV_NO_SOURCES= sync --extra all --locked" in calls
+        assert "UV_NO_CONFIG=1 UV_NO_SOURCES= pip install -e .[all]" in calls
+        assert "pip-status=0" in calls
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)

tests/test_project_metadata.py

@@ -3,11 +3,119 @@
 from pathlib import Path
 import tomllib
 
-def _load_optional_dependencies():
+from packaging.markers import Marker, default_environment
+
+
+def _load_pyproject():
     pyproject_path = Path(__file__).resolve().parents[1] / "pyproject.toml"
     with pyproject_path.open("rb") as handle:
-        project = tomllib.load(handle)["project"]
-    return project["optional-dependencies"]
+        return tomllib.load(handle)
+
+
+def _load_optional_dependencies():
+    return _load_pyproject()["project"]["optional-dependencies"]
+
+
+def test_pillow_source_is_explicit_and_scoped_to_available_arm32_wheels():
+    """Keep piwheels limited to Pillow where it publishes compatible wheels."""
+    data = _load_pyproject()
+    uv_config = data["tool"]["uv"]
+    pillow_sources = uv_config["sources"]["pillow"]
+    piwheels = next(
+        index for index in uv_config["index"] if index["name"] == "piwheels"
+    )
+
+    assert piwheels["url"].rstrip("/") == "https://www.piwheels.org/simple"
+    assert piwheels["explicit"] is True
+    assert uv_config["exclude-newer-package"]["pillow"] is False
+    piwheels_source_keys = {
+        name
+        for name, sources in uv_config["sources"].items()
+        for source in (sources if isinstance(sources, list) else [sources])
+        if source.get("index") == "piwheels"
+    }
+    assert piwheels_source_keys == {"pillow"}
+    assert len(pillow_sources) == 1
+    assert pillow_sources[0]["index"] == "piwheels"
+
+    marker = Marker(pillow_sources[0]["marker"])
+    environment = default_environment()
+    supported_machines = {"armv6l", "armv7l"}
+    supported_pythons = {"3.11", "3.13"}
+    for machine in ("armv6l", "armv7l", "aarch64", "arm64", "x86_64"):
+        for python_version in ("3.11", "3.12", "3.13"):
+            environment["platform_machine"] = machine
+            environment["python_version"] = python_version
+            environment["python_full_version"] = f"{python_version}.0"
+            expected = (
+                machine in supported_machines and python_version in supported_pythons
+            )
+            assert marker.evaluate(environment) is expected
+
+
+def test_arm32_pillow_wheels_are_hash_locked():
+    """The trusted ARM32 artifacts must stay inside uv's SHA256 lock chain."""
+    lock_path = Path(__file__).resolve().parents[1] / "uv.lock"
+    with lock_path.open("rb") as handle:
+        packages = tomllib.load(handle)["package"]
+
+    pillow = next(
+        package
+        for package in packages
+        if package["name"] == "pillow"
+        and package["source"].get("registry", "").rstrip("/")
+        == "https://www.piwheels.org/simple"
+    )
+    wheels = pillow["wheels"]
+
+    assert any(wheel["url"].endswith("linux_armv6l.whl") for wheel in wheels)
+    assert any(wheel["url"].endswith("linux_armv7l.whl") for wheel in wheels)
+    assert all(wheel["hash"].startswith("sha256:") for wheel in wheels)
+
+
+def test_locked_pillow_edges_preserve_expected_source_routing():
+    """Hermes must route Pillow to the intended source for each platform."""
+    lock_path = Path(__file__).resolve().parents[1] / "uv.lock"
+    with lock_path.open("rb") as handle:
+        packages = tomllib.load(handle)["package"]
+
+    assert any(
+        package["name"] == "pillow"
+        and package["source"].get("registry", "").rstrip("/")
+        == "https://pypi.org/simple"
+        for package in packages
+    ), "PyPI Pillow entry must remain for non-ARM32 platforms"
+    hermes = next(package for package in packages if package["name"] == "hermes-agent")
+    pillow_edges = [
+        dependency
+        for dependency in hermes["dependencies"]
+        if dependency["name"] == "pillow"
+    ]
+    edges_by_registry = {
+        edge["source"].get("registry", "").rstrip("/"): edge for edge in pillow_edges
+    }
+    assert set(edges_by_registry) == {
+        "https://pypi.org/simple",
+        "https://www.piwheels.org/simple",
+    }
+
+    pypi_marker = Marker(edges_by_registry["https://pypi.org/simple"]["marker"])
+    piwheels_marker = Marker(
+        edges_by_registry["https://www.piwheels.org/simple"]["marker"]
+    )
+    environment = default_environment()
+
+    for machine in ("armv6l", "armv7l", "aarch64", "arm64", "x86_64"):
+        for python_version in ("3.11", "3.12", "3.13"):
+            environment["platform_machine"] = machine
+            environment["python_version"] = python_version
+            environment["python_full_version"] = f"{python_version}.0"
+            use_piwheels = machine in {"armv6l", "armv7l"} and python_version in {
+                "3.11",
+                "3.13",
+            }
+            assert pypi_marker.evaluate(environment) is not use_piwheels
+            assert piwheels_marker.evaluate(environment) is use_piwheels
 
 
 def _load_package_data():