Reuse URL-provided hashes during resolution

[charliermarsh]

Summary

We reuse hashes from direct URL fragments when collecting resolution hashes, avoiding full wheel downloads when metadata can be fetched separately. URLs without a usable hash, including MD5-only URLs, still fall back to computing SHA-256 hashes.

The resolver reads declared hashes from the URL, while ArchiveMetadata.hashes contains only hashes computed from archive contents. Existing lockfile hashes and explicit verification requirements retain precedence.

Wheel archive hashes are checked during installation. Source archive hashes are checked before executing a build backend; user-provided metadata can avoid downloading the archive.

[astral-sh-bot]

uv test inventory changes

This PR changes the tests when compared with the main base revision.

• Added tests: 5
• Removed tests: 0
• Changed suites: 1

uv::pip_compile: +5 / -0

Added:

• uv::pip_compile::pip_compile::generate_hashes_url_fragment
• uv::pip_compile::pip_compile::generate_hashes_url_fragment_dependency_metadata
• uv::pip_compile::pip_compile::generate_hashes_url_fragment_no_range_requests
• uv::pip_compile::pip_compile::generate_hashes_url_fragment_source_mismatch
• uv::pip_compile::pip_compile::generate_hashes_url_fragment_source_subdirectory

Removed: none

[zanieb]

I'm fixing the HashPolicy as a prereq for this

[charliemarsh-oai]

Ok let me know what I should do

[EliteTK]

Neat!

[EliteTK]

Suggested change

	let declared_hashes = if hashes.collection == HashCollection::None
	|| hashes.validation != HashValidation::None
	{
	None
	} else if let BuildableSource::Dist(SourceDist::DirectUrl(dist)) = source {
	parse_url_hashes(&dist.url)
	} else if let BuildableSource::Url(SourceUrl::Direct(source)) = source {
	parse_url_hashes(source.url)
	} else {
	None
	};
	// If resolving metadata requires a build, validate the declared hashes before executing
	// the backend, even when the caller only requested hash collection.
	let build_hash_policy = match hashes.validation {
	HashValidation::None => match hashes.collection {
	HashCollection::None => ArchiveHashPolicy::None,
	HashCollection::Url | HashCollection::All => ArchiveHashPolicy::Generate,
	},
	HashValidation::None => {
	if let Some(hashes) = declared_hashes.as_ref() {
	ArchiveHashPolicy::All(hashes.as_slice())
	} else if hashes.collection != HashCollection::None {
	ArchiveHashPolicy::Generate
	} else {
	ArchiveHashPolicy::None
	}
	}
	let url_hashes = if let BuildableSource::Dist(SourceDist::DirectUrl(dist)) = source {
	parse_url_hashes(&dist.url)
	} else if let BuildableSource::Url(SourceUrl::Direct(url)) = source {
	parse_url_hashes(url.url)
	} else {
	None
	};
	let build_hash_policy = match hashes.validation {
	HashValidation::None => match hashes.collection {
	HashCollection::None => ArchiveHashPolicy::None,
	// If resolving metadata requires a build, validate any URL hash before executing
	// the backend, even when the caller only requested hash collection.
	HashCollection::Url | HashCollection::All => match url_hashes.as_ref() {
	Some(digests) => ArchiveHashPolicy::All(digests.as_slice()),
	None => ArchiveHashPolicy::Generate,
	},
	},
	HashValidation::Any(_) | HashValidation::All(_) => hashes.validation.into(),
	};

This makes the diff much smaller and I think it's clearer what is going on.

[EliteTK]

This works but it relies on us erroring out for a non-existent build backend package before we report the hash mismatch.

A stronger guarantee is a build backend which is real and would have a side-effect if we ever imported it.

See for example: https://github.com/astral-sh/uv/blob/100842334c1b9a55320f961a8cfe608c3f5794ec/crates/uv/tests/lock/lock.rs#L2036-L2051

[EliteTK]

This test doesn't check the case of a hash mismatch with a subdirectory and it's not covered elsewhere. Seems like it should be included for completeness.

[EliteTK]

nit: example.invalid is used in a few other places and is reserved as an invalid domain name which seems more appropriate here.

Chances that example.org starts serving python packages and --offline fails are slim but still...