Repository navigation
Validate replay-relevant source settings, not only the provider name #1443
Description
From the #1414 review: #1414 (comment)
build-sequence and download-sequence check that each build-order entry's recorded source_provider matches the current settings (#1209, #1433). This catches a change in how sources are downloaded, including a switch between legacy settings and source:.
It doesn't catch changes within the same provider's settings between bootstrap and replay. Only settings used after resolution matter here, since replay downloads from the saved URL:
| Setting | Affects replay |
|---|---|
build_sdist (pypi-git, github-tag-*, gitlab-tag-*, hook-sdist) |
Yes: the same source is packed differently |
download_kind (pypi-download) |
Yes: the file is saved as an sdist or a tarball |
index_url, download_url, clone_url, tag, project_url, matcher_factory, min_release_age |
No: only used to find the version and URL, which are already saved |
Possible approach
Record the replay-relevant settings in the build order and validate them during replay. This changes the build-order format, so it needs a proposal first.
Scope
Not a blocker for #1414. Legacy settings have no replay check at all, so the provider check is already stricter than current behavior. graph.json and build-parallel are tracked in #1436.
Activity