Extract DownloadUrl from uv.lock file - #1852
Closed
ryanbrandenburg wants to merge 1 commit into
Closed
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds extraction of a preferred artifact download URL from uv.lock packages (favoring sdist.url with a wheels[].url fallback) and surfaces it on detected PipComponents to improve package provenance in Component Detection’s Python/uv ecosystem support.
Changes:
- Parse
sdist.urland, when missing, fall back to the firstwheels[].urlinUvLockparsing. - Propagate the parsed URL onto
PipComponent.DownloadUrlwhen convertingUvPackageto a typed component. - Add unit tests covering URL parsing and detector-level behavior.
Show a summary per file
| File | Description |
|---|---|
| test/Microsoft.ComponentDetection.Detectors.Tests/UvLockTests.cs | Adds parsing tests for DownloadUrl from sdist and wheels. |
| test/Microsoft.ComponentDetection.Detectors.Tests/UvLockDetectorTests.cs | Adds detector test asserting PipComponent.DownloadUrl is populated from sdist. |
| src/Microsoft.ComponentDetection.Detectors/uv/UvPackage.cs | Stores parsed URL on UvPackage and applies it to PipComponent. |
| src/Microsoft.ComponentDetection.Detectors/uv/UvLock.cs | Extends TOML parsing to extract sdist/wheels URLs with helper methods. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 2
- Review effort level: Low
Comment on lines
+158
to
+161
| private static string? TryGetUrlFromArtifactTable(TomlTable artifactTable) | ||
| { | ||
| return artifactTable.TryGetValue("url", out var urlObj) && urlObj is string url ? url : null; | ||
| } |
Comment on lines
+35
to
+41
| var component = new PipComponent(this.Name, this.Version); | ||
| if (Uri.TryCreate(this.DownloadUrl, UriKind.Absolute, out var downloadUri)) | ||
| { | ||
| component.DownloadUrl = downloadUri; | ||
| } | ||
|
|
||
| return component; |
Contributor
Author
|
CoPilot makes a good point, if the DownloadUrl is used to make identity decisions than selecting it from a wheels list of even a sdist may be inappropriate since neither of those are proport to be "canonical" links. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This gets us extracting a DownloadUrl from packages in uv.lock files using either sdist (source distribution) or wheel (a pre-built distribution format).
Because the
wheelsfield is an array that may contain many links (per-build-environement compilations) I thought it was preferable to offer the singular and platform-agnostic sdist as the primary download location.The DTO PR and this will conflict with each other.