cachi2 wheels: allow dependencies with only wheel distributions

[slimreaper35]

If a user enables allow_binary option, reject only those distributions which have no source and no
wheel distributions

STONEBLD-1641

Maintainers will complete the following section

• Commit messages are descriptive enough
• Code coverage from testing does not decrease and new code is covered
• n/a Docs updated (if applicable)
• n/a Docs links in the code are still valid (if docs were updated)

[slimreaper35]

repo for manual testing

[chmeliik]

Hmm, being yanked is another thing we handle for sdists but not for wheels.

It might be hard to come up with any sane way to handle yanked-ness in an allow_binary context. Maybe we should just log a warning and download yanked things anyway (for consistency: even when allow_binary=False). That's how 'yanked' is supposed to work when the version is pinned, after all. https://peps.python.org/pep-0592/#installers

[chmeliik]

But that's probably something for a follow-up story

[brunoapimentel]

So, in the scenario that a package has wheels but all sdists are yanked, the request would still fail, right?

Should we file the follow-up story right away so we don't forget about it?

[chmeliik]

yeah yeah https://issues.redhat.com/browse/STONEBLD-1811

[chmeliik]

After adding a hash to your requirements.txt:

tensorflow==2.13.0 --hash=sha256:b2978b39e8b3919059b5fd9e28508d50a77965d06ed0b537ed71c97de22dabdf

tensorflow is still reported with missing_hash

    {
      "name": "tensorflow",
      "purl": "pkg:pypi/tensorflow@2.13.0",
      "version": "2.13.0",
      "properties": [
        {
          "name": "cachi2:found_by",
          "value": "cachi2"
        },
        {
          "name": "cachi2:missing_hash:in_file",
          "value": "requirements.txt"
        }
      ],
      "type": "library"
    }

[slimreaper35]

I refactored almost the whole function _process_package_distributions , to make it (hopefully) easier to understand. Currently:

1. Find all packages on PyPI
2. Filter those packages
3. Log the warnings based on the results, or possibly raise exception

Did not update unit tests yet.

[chmeliik]

I refactored almost the whole function _process_package_distributions , to make it (hopefully) easier to understand. Currently:

1. Find all packages on PyPI

2. Filter those packages

3. Log the warnings based on the results, or possibly raise exception

Did not update unit tests yet.

Nice, for me it's a lot easier to understand now 👍

[chmeliik]

LGTM 👍

I think there's a corner case where we delete all the wheels after downloading because of checksum mismatches so there are 0 archives left for a package, but that should be extremely rare. Probably not worth handling.

[chmeliik]

marking docs as N/A since there's a separate docs story

[ben-alkov]

LGTM