Skip to content

Comments

Fix uv_build wheel hashes#15400

Merged
konstin merged 1 commit intoastral-sh:mainfrom
anuraaga:fix-hash
Aug 21, 2025
Merged

Fix uv_build wheel hashes#15400
konstin merged 1 commit intoastral-sh:mainfrom
anuraaga:fix-hash

Conversation

@anuraaga
Copy link
Contributor

@anuraaga anuraaga commented Aug 21, 2025

Summary

Currently record hashes are the hex encoded sha-256 sum. However, they're supposed to be urlsafe-base64-nopad.

https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file

Fixes #15398

Test Plan

Build any wheel

uv build --wheel

Unpack the wheel

uvx wheel unpack dist/*.whl

Before this change, it will fail with a hash mismatch. I could confirm with a local build that now the wheel can be unpacked with the wheel command. While I don't enable hash checking when syncing, presumably it would also currently fail.

.unwrap()
.read_to_string(&mut record)
.unwrap();
assert_snapshot!(record, @r###"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed the tests in wheel.rs don't exercise write_hashed, so I added this integration test

Copy link
Member

@konstin konstin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@konstin konstin merged commit 8d6ea3f into astral-sh:main Aug 21, 2025
230 of 242 checks passed
@konstin konstin added the bug Something isn't working label Aug 21, 2025
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Aug 22, 2025
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.8.12` -> `0.8.13` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

### [`v0.8.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0813)

[Compare Source](astral-sh/uv@0.8.12...0.8.13)

##### Enhancements

- Add `--no-install-*` arguments to `uv add` ([#&#8203;15375](astral-sh/uv#15375))
- Initialize Git prior to reading author in `uv init` ([#&#8203;15377](astral-sh/uv#15377))
- Add CUDA 129 to available torch backends ([#&#8203;15416](astral-sh/uv#15416))
- Update Pyodide to 0.28.2 ([#&#8203;15385](astral-sh/uv#15385))

##### Preview features

- Add an experimental `uv format` command ([#&#8203;15017](astral-sh/uv#15017))
- Allow version specifiers in `extra-build-dependencies` if match-runtime is explicitly `false` ([#&#8203;15420](astral-sh/uv#15420))

##### Bug fixes

- Add `triton` to `torch-backend` manifest ([#&#8203;15405](astral-sh/uv#15405))
- Avoid panicking when resolver returns stale distributions ([#&#8203;15389](astral-sh/uv#15389))
- Fix `uv_build` wheel hashes ([#&#8203;15400](astral-sh/uv#15400))
- Treat `--upgrade-package` on the command-line as overriding `upgrade = false` in configuration ([#&#8203;15395](astral-sh/uv#15395))
- Restore DockerHub publishing ([#&#8203;15381](astral-sh/uv#15381))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS44Mi4xIiwidXBkYXRlZEluVmVyIjoiNDEuODIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uv-build v0.8.12 does not properly encode RECORD hashes

2 participants