fix(candidate): use exact dist-info path in `get_metadata_for_wheel()` by rd4398 · Pull Request #1224 · python-wheel-build/fromager

rd4398 · 2026-06-29T19:29:02Z

get_metadata_for_wheel() returned the first zip entry matching *.dist-info/METADATA, which could be a vendored package's metadata when a wheel bundles multiple dist-info directories. Derive the correct {name}-{version}.dist-info/METADATA path from the wheel URL instead and read it directly.

Closes: #1146

coderabbitai · 2026-06-29T19:29:19Z

Warning

Review limit reached

@rd4398, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 67205cc5-fc22-441f-85dd-e423631de824

📥 Commits

Reviewing files that changed from the base of the PR and between 7bd33b7 and 97758f6.

📒 Files selected for processing (4)

src/fromager/candidate.py
src/fromager/dependencies.py
src/fromager/wheels.py
tests/test_pep658_support.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/fromager/candidate.py`:
- Around line 149-152: The exception handling in the wheel metadata lookup
currently suppresses the original ZipFile member lookup context by using from
None in the KeyError handler. Update the KeyError branch in the candidate
metadata lookup logic to capture the caught exception (for example in the code
path around the metadata_path lookup) and re-raise the ValueError using
exception chaining with from err so the original lookup failure is preserved.
- Around line 163-166: The wheel filename validation in candidate.py is too
permissive, allowing malformed names like pkg-1.0-bad.whl to pass into
_wheel_metadata_path() and later produce misleading errors in
get_metadata_for_wheel(). Tighten the parsing in the URL filename handling so
only valid wheel filenames are accepted before deriving dist-info, and fail fast
with a ValueError for malformed inputs. Use the existing filename parsing logic
around urlparse(url).path and the wheel metadata path derivation in
_wheel_metadata_path() as the place to enforce the stricter check.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 24d86223-c631-4e46-8dc4-6fdaaed43579

📥 Commits

Reviewing files that changed from the base of the PR and between cc322cd and 7bd33b7.

📒 Files selected for processing (2)

src/fromager/candidate.py
tests/test_pep658_support.py

smoparth · 2026-06-30T16:42:00Z

+        return Metadata.from_email(metadata_content, validate=validate)
+
+
+def _wheel_metadata_path(url: str) -> str:


Consider using parse_wheel_filename() from packaging.utils instead of manually parsing the wheel filename. Note that it returns canonicalized names, so use filename.split("-", 1)[0] for the dist name (needed for case-sensitive ZIP lookups):

filename = posixpath.basename(urlparse(url).path) _, dist_version, _, _ = parse_wheel_filename(filename) dist_name = filename.split("-", 1)[0] return f"{dist_name}-{dist_version}.dist-info/METADATA"

Fromager has four implementations of mapping a wheel filename to a dist-info directory. The PR is adding the third implementation of extracting dist name and version from a wheel filename. I would prefer to have a single implementation of these algorithms.

Done, latest commit now has:

New dist_info_name() in candidate.py — single source of truth for {name}-{version}.dist-info, uses parse_wheel_filename() for validation, preserves verbatim casing

wheels.py — extract_info_from_wheel_file() now delegates to dist_info_name() instead of reimplementing name extraction

dependencies.py — _get_metadata_from_wheel() replaced 4 lines of inline parsing with one dist_info_name() call; removed unused parse_wheel_filename import

Tests — added TestDistInfoName class with direct tests; kept existing URL-integration and wheel-extraction tests

`get_metadata_for_wheel()` returned the first zip entry matching `*.dist-info/METADATA`, which could be a vendored package's metadata when a wheel bundles multiple dist-info directories. Derive the correct `{name}-{version}.dist-info/METADATA` path from the wheel URL instead and read it directly. Closes: python-wheel-build#1146 Co-Authored-By: Claude <claude@anthropic.com> Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>

tiran · 2026-07-07T09:36:15Z

+    dist_name, dist_version_str = wheel_file.name.split("-", 2)[:2]
+    _, _, build_tag, wheel_tags = parse_wheel_filename(wheel_file.name)
+    return (dist_name, Version(dist_version_str), build_tag, wheel_tags)


Call parse_wheel_filename first to validate the wheel filename. This results in a better error message than ValueError: not enough values to unpack (expected 2, got 1) for a completely broken wheel file name.

You can use the version object from parse_wheel_filename:

Suggested change

dist_name, dist_version_str = wheel_file.name.split("-", 2)[:2]

_, _, build_tag, wheel_tags = parse_wheel_filename(wheel_file.name)

return (dist_name, Version(dist_version_str), build_tag, wheel_tags)

_, version, build_tag, wheel_tags = parse_wheel_filename(wheel_file.name)

dist_name = wheel_file.name.split("-", 1)[0]

return (dist_name, version, build_tag, wheel_tags)

tiran · 2026-07-07T09:40:55Z

+        return Metadata.from_email(metadata_content, validate=validate)
+
+
+def dist_info_name(wheel_filename: str) -> str:


fromager.candidate is a weird place for PEP 376 dist-info handling. How about fromager.pkgmetadata.pep376 instead?

Background: We have defined helper methods where they were used first, then imported them into other modules later. It's sometimes causing circular import issues.

rd4398 requested a review from a team as a code owner June 29, 2026 19:29

mergify Bot added the ci label Jun 29, 2026

coderabbitai Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread src/fromager/candidate.py Outdated

Comment thread src/fromager/candidate.py Outdated

rd4398 force-pushed the incorrect-metadata branch from cbbae11 to d2c0d71 Compare June 29, 2026 19:42

smoparth reviewed Jun 30, 2026

View reviewed changes

smoparth previously approved these changes Jun 30, 2026

View reviewed changes

rd4398 dismissed smoparth’s stale review via 75d6d95 July 1, 2026 13:46

rd4398 force-pushed the incorrect-metadata branch from 75d6d95 to ff7dfe3 Compare July 1, 2026 13:46

rd4398 force-pushed the incorrect-metadata branch from f6e6559 to 97758f6 Compare July 6, 2026 14:19

tiran reviewed Jul 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(candidate): use exact dist-info path in `get_metadata_for_wheel()`#1224

fix(candidate): use exact dist-info path in `get_metadata_for_wheel()`#1224
rd4398 wants to merge 1 commit into
python-wheel-build:mainfrom
rd4398:incorrect-metadata

rd4398 commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading

Review limit reached

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

smoparth Jun 30, 2026

Uh oh!

tiran Jul 1, 2026

Uh oh!

rd4398 Jul 1, 2026

Uh oh!

tiran Jul 7, 2026

Uh oh!

tiran Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		return Metadata.from_email(metadata_content, validate=validate)


		def _wheel_metadata_path(url: str) -> str:

		return Metadata.from_email(metadata_content, validate=validate)


		def dist_info_name(wheel_filename: str) -> str:

Uh oh!

Conversation

rd4398 commented Jun 29, 2026

Uh oh!

coderabbitai Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

smoparth Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

tiran Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

rd4398 Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

tiran Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

tiran Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jun 29, 2026 •

edited

Loading