Fix edge case when creating metadata file

fixes #1101

Author: jobselko

CHANGES/1101.bugfix

@@ -0,0 +1 @@
+Fixed edge case where metadata file did not match wheel metadata.

pulp_python/app/models.py

@@ -216,8 +216,10 @@ def init_from_artifact_and_relative_path(artifact, relative_path):
         """Used when downloading package from pull-through cache."""
         path = PurePath(relative_path)
         data = artifact_to_python_content_data(path.name, artifact, domain=get_domain())
+        name = data["name"]
+        version = data["version"]
         artifacts = {path.name: artifact}
-        if metadata_artifact := artifact_to_metadata_artifact(path.name, artifact):
+        if metadata_artifact := artifact_to_metadata_artifact(path.name, artifact, name, version):
             artifacts[f"{path.name}.metadata"] = metadata_artifact
         return PythonPackageContent(**data), artifacts
 

pulp_python/app/serializers.py

@@ -410,7 +410,11 @@ def deferred_validate(self, data):
 
         # Create metadata artifact for wheel files
         if filename.endswith(".whl"):
-            if metadata_artifact := artifact_to_metadata_artifact(filename, artifact):
+            name = data["name"]
+            version = data["version"]
+            if metadata_artifact := artifact_to_metadata_artifact(
+                filename, artifact, name, version
+            ):
                 data["metadata_artifact"] = metadata_artifact
                 data["metadata_sha256"] = metadata_artifact.sha256
 
@@ -552,9 +556,11 @@ def validate(self, data):
             )
         # Create metadata artifact for wheel files
         if filename.endswith(".whl"):
+            name = data["name"]
+            version = data["version"]
             with tempfile.TemporaryDirectory(dir=settings.WORKING_DIRECTORY) as temp_dir:
                 if metadata_artifact := artifact_to_metadata_artifact(
-                    filename, artifact, tmp_dir=temp_dir
+                    filename, artifact, name, version, tmp_dir=temp_dir
                 ):
                     data["metadata_artifact"] = metadata_artifact
                     data["metadata_sha256"] = metadata_artifact.sha256

pulp_python/app/tasks/upload.py

@@ -98,7 +98,9 @@ def create():
         content = PythonPackageContent.objects.create(**data)
         ContentArtifact.objects.create(artifact=artifact, content=content, relative_path=filename)
 
-        if metadata_artifact := artifact_to_metadata_artifact(filename, artifact):
+        name = data["name"]
+        version = data["version"]
+        if metadata_artifact := artifact_to_metadata_artifact(filename, artifact, name, version):
             ContentArtifact.objects.create(
                 artifact=metadata_artifact, content=content, relative_path=f"{filename}.metadata"
             )

pulp_python/app/utils.py

@@ -197,7 +197,9 @@ def get_project_metadata_from_file(filename):
     packagetype = DIST_EXTENSIONS[extensions[pkg_type_index]]
 
     metadata = DIST_TYPES[packagetype](filename)
-    metadata.metadata_sha256 = compute_metadata_sha256(filename)
+    name = metadata.name
+    version = metadata.version
+    metadata.metadata_sha256 = compute_metadata_sha256(filename, name, version)
     metadata.packagetype = packagetype
     if packagetype == "sdist":
         metadata.python_version = "source"
@@ -210,31 +212,53 @@ def get_project_metadata_from_file(filename):
     return metadata
 
 
-def extract_wheel_metadata(filename: str) -> bytes | None:
+def extract_non_normalized_pkg_name_with_version(
+    filename: str, name: str, version: str
+) -> str | None:
+    """
+    Search `filename` for a package name that normalizes to `name` and is followed by `version`.
+
+    Returns the original (non-normalized) name with version if found, otherwise None.
+    """
+    # Ensure the package name is normalized
+    normalized = re.sub(r"[-_.]+", "-", name).lower()
+
+    parts = normalized.split("-")
+    name_pattern = r"[-_.]+".join(map(re.escape, parts))
+    pattern = rf"({name_pattern})-{re.escape(version)}"
+
+    match = re.search(pattern, filename, re.IGNORECASE)
+    if match:
+        return match.group(0)
+    return None
+
+
+def extract_wheel_metadata(filename: str, name: str, version: str) -> bytes | None:
     """
     Extract the metadata file content from a wheel file.
 
     Returns the raw metadata content as bytes or None if metadata cannot be extracted.
     """
     if not filename.endswith(".whl"):
         return None
+
+    original_name_version = extract_non_normalized_pkg_name_with_version(filename, name, version)
+    metadata_path = f"{original_name_version}.dist-info/METADATA"
     try:
         with zipfile.ZipFile(filename, "r") as f:
-            for file_path in f.namelist():
-                if file_path.endswith(".dist-info/METADATA"):
-                    return f.read(file_path)
+            return f.read(metadata_path)
     except (zipfile.BadZipFile, KeyError, OSError) as e:
         log.warning(f"Failed to extract metadata file from {filename}: {e}")
     return None
 
 
-def compute_metadata_sha256(filename: str) -> str | None:
+def compute_metadata_sha256(filename: str, name: str, version: str) -> str | None:
     """
     Compute SHA256 hash of the metadata file from a Python package.
 
     Returns SHA256 hash or None if metadata cannot be extracted.
     """
-    metadata_content = extract_wheel_metadata(filename)
+    metadata_content = extract_wheel_metadata(filename, name, version)
     return hashlib.sha256(metadata_content).hexdigest() if metadata_content else None
 
 
@@ -260,7 +284,7 @@ def artifact_to_python_content_data(filename, artifact, domain=None):
 
 
 def artifact_to_metadata_artifact(
-    filename: str, artifact: Artifact, tmp_dir: str = "."
+    filename: str, artifact: Artifact, name: str, version: str, tmp_dir: str = "."
 ) -> Artifact | None:
     """
     Creates artifact for metadata from the provided wheel artifact.
@@ -274,7 +298,7 @@ def artifact_to_metadata_artifact(
         shutil.copyfileobj(artifact.file, temp_file)
         temp_file.flush()
 
-    metadata_content = extract_wheel_metadata(temp_wheel_path)
+    metadata_content = extract_wheel_metadata(temp_wheel_path, name, version)
     if not metadata_content:
         return None
 

pulp_python/tests/functional/api/test_upload.py

@@ -3,6 +3,7 @@
 from pulp_python.tests.functional.constants import (
     PYTHON_EGG_FILENAME,
     PYTHON_EGG_URL,
+    PYTHON_FIXTURES_URL,
     PYTHON_WHEEL_FILENAME,
     PYTHON_WHEEL_URL,
     PYTHON_EGG_SHA256,
@@ -61,7 +62,9 @@ def test_synchronous_package_upload_with_metadata(
     """
     Test that the synchronous upload of a Python wheel package creates a metadata artifact.
     """
-    python_file = download_python_file(PYTHON_WHEEL_FILENAME, PYTHON_WHEEL_URL)
+    wheel_filename = "setuptools-80.9.0-py3-none-any.whl"
+    wheel_url = urljoin(urljoin(PYTHON_FIXTURES_URL, "packages/"), wheel_filename)
+    python_file = download_python_file(wheel_filename, wheel_url)
     content_body = {"file": python_file}
     content = python_bindings.ContentPackagesApi.upload(**content_body)
 
@@ -70,7 +73,7 @@ def test_synchronous_package_upload_with_metadata(
     distro = python_distribution_factory(repository=python_repo)
 
     # Test that metadata is accessible
-    ensure_metadata(pulp_content_url, distro.base_path, PYTHON_WHEEL_FILENAME)
+    ensure_metadata(pulp_content_url, distro.base_path, wheel_filename)
 
 
 @pytest.mark.parallel

pulp_python/tests/functional/utils.py

@@ -1,3 +1,4 @@
+import re
 import requests
 
 from urllib.parse import urljoin
@@ -127,9 +128,18 @@ def ensure_metadata(pulp_content_url, distro_base_path, filename):
     """
     Tests that metadata is accessible for a given wheel package filename.
     """
+    from pulp_python.app.utils import DIST_REGEXES
+
     relative_path = f"{distro_base_path}/{filename}.metadata"
     metadata_url = urljoin(pulp_content_url, relative_path)
     metadata_response = requests.get(metadata_url)
     assert metadata_response.status_code == 200
     assert len(metadata_response.content) > 0
-    assert "Name: " in metadata_response.text
+
+    regex = DIST_REGEXES[f".{filename.rsplit('.', 1)[1]}"]
+    match = regex.match(filename)
+    name = match.group(1)
+    normalized = re.sub(r"[-_.]+", "-", name).lower()
+    version = match.group(2)
+    assert f"Name: {normalized}" in metadata_response.text
+    assert f"Version: {version}" in metadata_response.text