Validate built wheel project identity

[zaniebot]

Warning: truncated output (original token count: 5372)
Total output lines: 287

A project declaring configured-name==1.0 can emit an internally consistent different_name-9.0-py3-none-any.whl and report success because the direct-wheel build plan supplies no expected identity. Validate normalized static identity and stage the wheel until validation passes, preventing a rejected artifact from remaining publishable in dist/ while preserving existing output. Retain UV_SKIP_WHEEL_FILENAME_CHECK=1 and version.without_local() compatibility for malformed/nightly wheels (uv#16046); keep this distinct from filename/METADATA and sdist/wheel consistency.

Ordinary uv python install matches an existing managed installation only by its key and ignores an explicit UV_PYTHON_*_BUILD pin, so an outdated build is retained. Compare the requested build identity before reuse, completing the reproducible-build pinning requested in uv#14263 and the installed-build marker added in uv#15314. Managed install/download finalization is concurrently changing in uv#20286, uv#19840, and uv#20309.

A newline in uv venv --prompt can inject a second pyvenv.cfg key such as include-system-site-packages = true, silently changing environment isolation. Reject CR/LF before creating the environment so failure leaves no partial .venv. Keep newline containment independent from the overlapping prompt-evaluation work in uv#19812.

Centralized environment keys use lexical workspace paths, so reaching one project through a directory symlink creates a second environment and reinstalls its dependencies. Canonicalize workspace identity before selecting the centralized environment, preserving the single-environment expectation from the centralized-environment design in uv#14628 and uv#18214.

pyvenv.cfg keys are matched case-sensitively even though CPython lowercases them, so a case-variant Include-System-Site-Packages can be ignored and leak system dependencies. Normalize configuration keys without changing values.

Concrete equality requests such as uv python find --managed-python '==3.14t' lose the free-threaded/debug/GIL variant during specifier lowering and can select the wrong interpreter. Reapply the requested variant after equality parsing. Wildcard and range requests keep their existing semantics; this changes selection only for explicit equality requests that include a variant. uv#16434 tracks related free-threaded requirement compatibility.

Environment discovery silently skips a broken child .venv symlink and continues walking upward, allowing pip to mutate an unrelated ancestor environment. Treat the explicit broken child boundary as an error and report its exact path, preserving the broken-link diagnostic established in uv#12168. Coordinate the related invalid-.venv fallback work in uv#20333.

Host-platform support treats Emscripten as supported everywhere, so an explicit cpython-3.14-emscripten request can select native CPython unless an architecture is also supplied. Require the requested target operating system to match, complementing the PyEmscripten/PEP 783 platform support introduced in uv#19629.

A UTF-8 BOM reaches PythonRequest::parse from .python-version, causing a valid pin to be treated as an unsupported executable name and discovery to select another interpreter. Strip a leading BOM while preserving the file's other parsing semantics.

Publish and auth-login settings diagnostics can render raw tokens, passwords, or credential-bearing URLs despite hidden environment values. Redact all secret-bearing fields and nested URLs in --show-settings output without obscuring non-secret configuration; uv#8840 demonstrates that settings diagnostics can expose a PAT in pipeline logs.

Publish renders raw arguments before settings resolution, so --show-settings omits the configured publish URL, trusted-publishing policy, check URL, and keyring settings. Render the resolved settings and redact publish tokens and credentials embedded in check or configured-index URLs while retaining useful diagnostics; uv#8840 demonstrates that settings diagnostics can expose a PAT in pipeline logs. This overlaps the proxy-index publish settings work in #20218.

Requirements-file --no-binary/--only-binary a,b is rejected even though pip and uv's CLI accept comma-separated package policies. Parse the package list consistently, including :all: and :none: resets, completing the pip-compatibility work introduced in uv#2680 for uv#1461. Coordinate the active requirements-option rewrite in uv#16489.

Repeated --no-binary/--only-binary directives across nested requirements can lose ordering: a child :none: reset may leave the parent's policy active. Replay policy events in source order so reset and last-wins semantics match pip, extending the compatibility work introduced in uv#2680 for uv#1461. Coordinate the active requirements-option rewrite in uv#16489.

Valid attached pip forms such as -rfile, -cfile, -fpath, -iURL, and -epath require an unnecessary separator in uv. Accept attached short-option values and resolve local -f paths against the parser working directory, preserving the existing -r/-c declaring-file and -e working-directory semantics established in uv#1421.

Include, index, and find-links values containing a literal # are truncated as comments when no whitespace precedes the hash. Preserve hashes within option values while retaining normal whitespace-delimited comments.

pip permits replacement --index-url directives, including across nested includes, while uv rejects repetition. Apply ordered last-wins handling consistently. This reverses uv's deliberate ambiguity error from uv#1146: an included requirements/constraints file can override an operator-controlled index, a previously identified security concern (uv#6407). Coordinate the active parser rewrite (uv#16489).

Unknown prefixes such as --prefixed-option can be interpreted as --pre, while --no-indexed can become an ed requirement. Require complete option-name matches before dispatch so unsupported flags cannot silently change resolution, preserving the warn-and-ignore behavior introduced in uv#10420. Coordinate the active requirements-option rewrite in uv#16489.

PEP 508 marker parsing incorrectly requires whitespace before an opening parenthesis and rejects valid and(/or( grouped expressions. Accept the grammar form without changing ordinary marker tokenization.

python_version in "3.12.1" on Python 3.12 evaluates incorrectly because version/range lowering discards PEP 508 substring-membership semantics. Preserve string membership; this intentionally revisits the algebra/performance tradeoff in uv#6172, which documented the divergence to keep marker operations tractable. Raw substring BDD nodes change universal-lock/fork representation and performance, so keep that compatibility tradeoff explicit.

Universal compile drops markers from editable requirements such as -e ./project ; sys_platform == "linux", making them unconditional on other platforms. Preserve editable environment markers through lowering and simplification. This touches the same editable-requirements lowering path as active uv#19151.

An exclusive prerelease bound such as >1a1 can incorrectly reject an installed 1.post1 even though the post-release is compatible. Correct the greater-than prerelease/post-release comparison while preserving local-version normalization, complementing the earlier exclusive-comparison fix in uv#12836 for uv#12834.

Legacy .egg-info uninstalls need to read entry_points.txt to remove console and GUI launchers, but loading and parsing currently live in the wheel reader. Add an EntryPoints reader that owns missing-file handling and parsing while preserving existing script and versioned pip-launcher behavior from uv#1593. This is a behavior-neutral prerequisite for completing the legacy-uninstall support introduced in uv#3380.

Moved to: astral-sh/uv-dev#203.