astral-sh / astral-sh/python-build-standalone

In --require-hashes mode, pygithub -> pyjwt fails to build

Open
#975 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
4.4k
Forks
314
Avg merge
1d 9h
Merged PRs (30d)
27

Description

It seems like [pygithub version ](https://github.com/astral-sh/python-build-standalone/blob/main/requirements.txt#L308)that python-build-standalone relies on is 2.6.1, which then [transitively relies ](https://github.com/PyGithub/PyGithub/blob/da30d6e793ffb4fbe70383b59d2eb7026fe2d8c7/pyproject.toml#L33)on pyjwt[crypto].

The issue I'm running into is represented in the following logs when I try to build a standalone python :

```
25hCollecting pyjwt[crypto]>=2.4.0
ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
pyjwt[crypto]>=2.4.0 from [https://files.pythonhosted.org/packages/6f/01/c26ce75ba460d5cd503da9e13b21a33804d38c2165dec7b716d06b13010c/pyjwt-2.11.0-py3-none-any.whl#sha256=94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469](https://www.google.com/url?q=https://files.pythonhosted.org/packages/6f/01/c26ce75ba460d5cd503da9e13b21a33804d38c2165dec7b716d06b13010c/pyjwt-2.11.0-py3-none-any.whl%23sha256%3D94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469&sa=D) (from pygithub==2.6.1->-r /python-build-standalone/requirements.txt (line 308))
```

After investigating a bit, I saw that the generated requirements.txt contains pyjwt, but without the crypto extra, which probably caused pip to not pick pinned version. Trying out the change i.e. s/pyjwt/pyjwt[crypto] in requirements.txt and updating hashes, I was able to successfully build standalone python.

I'm wondering if this is something that I fix by patching in my environment, or does the fix belong upstream?

Contributor guide

Open the contributing guide

Research direction

Inspect requirements.txt at line 308 and compare the generated PyGithub dependency with PyGithub's pyproject.toml dependency at the linked line. Reproduce the standalone Python build in --require-hashes mode, then verify that the generated requirement preserves the crypto extra, has matching hashes, and builds successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.