feat: remove input hash from lockfile#5011
Merged
ruben-arts merged 26 commits intoprefix-dev:bas/wip/develop-dependenciesfrom Dec 16, 2025
Merged
feat: remove input hash from lockfile#5011ruben-arts merged 26 commits intoprefix-dev:bas/wip/develop-dependenciesfrom
ruben-arts merged 26 commits intoprefix-dev:bas/wip/develop-dependenciesfrom
Conversation
eec42c7 to
0e2c540
Compare
tdejager
reviewed
Dec 1, 2025
baszalmstra
reviewed
Dec 3, 2025
...e__satisfiability__tests__failing_satisiability@source-dependency-changed-project-model.snap
Show resolved
Hide resolved
2 tasks
baszalmstra
reviewed
Dec 5, 2025
Contributor
baszalmstra
left a comment
There was a problem hiding this comment.
I tested this and it seems to work as expected, great work!
The only thing missing for me, is that some of the satisfiability tests are now a bit nonsense. I would like to see a test that is satisfiable where the source locked information is satisfiable and another where it is not. You can use the passthrough backend.
Contributor
|
What I've been testing with this new feature:
Full `operation was cancelled` error``` ❯ pixi i -vv WARN pixi_core::workspace::discovery: Using local manifest /Users/rubenarts/envs/demos/pixi.toml rather than /Users/rubenarts/dev/pixi/pixi.toml from environment variable `PIXI_PROJECT_MANIFEST` DEBUG pixi_config: Loading config from /etc/pixi/config.toml DEBUG pixi_config: Loading config from /Users/rubenarts/Library/Application Support/pixi/config.toml DEBUG pixi_config: Loaded config from: /Users/rubenarts/Library/Application Support/pixi/config.toml DEBUG pixi_config: Loading config from /Users/rubenarts/.pixi/config.toml DEBUG pixi_config: Loaded config from: /Users/rubenarts/.pixi/config.toml DEBUG pixi_config: Loading config from /Users/rubenarts/envs/demos/.pixi/config.toml DEBUG pixi_config: Failed to load local config: /Users/rubenarts/envs/demos/.pixi/config.toml (error: no file was found at /Users/rubenarts/envs/demos/.pixi/config.toml) DEBUG pixi_core::environment: verifying prefix location is unchanged, with prefix file: /Users/rubenarts/envs/demos/.pixi/envs/conda-meta/pixi_env_prefix DEBUG pixi_utils::reqwest: Using mirrors: {Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("my.private-channel")), port: None, path: "/", query: None, fragment: None }: [Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("prefix.dev")), port: None, path: "/ruben-arts", query: None, fragment: None }]} DEBUG backend-metadata{manifest_source=Path(PinnedPathSpec { path: Unix(Utf8PathBuf { _encoding: "unix", inner: "action_tutorials/action_tutorials_cpp" }) }) build_source=None platform=osx-arm64}: pixi_command_dispatcher::build_backend_metadata: metadata cache disabled for backend backend=pixi-build-ros reason="mutable-environment" command_kind="mutable-environment" WARN backend-metadata{manifest_source=Path(PinnedPathSpec { path: Unix(Utf8PathBuf { _encoding: "unix", inner: "action_tutorials/action_tutorials_cpp" }) }) build_source=None platform=osx-arm64}: pixi_command_dispatcher::build_backend_metadata: metadata cache disabled for build backend 'pixi-build-ros' (system/path-based backends always regenerate metadata) DEBUG pixi_command_dispatcher::instantiate_tool_env: Installing tool env for: pixi-build-ros DEBUG pixi_command_dispatcher::instantiate_tool_env: Installing tool env for: pixi-build-ros DEBUG solve{name="pixi-build-ros" platform=osx-arm64}: pixi_utils::reqwest: instantiating reqwest Client took 88.785042ms DEBUG pixi_glob::glob_set::walk: Determining hidden folder handling: user_includes_hidden=false has_negation_for_all_folders=false search_all_hidden=false requested_everything=false DEBUG pixi_glob::glob_set::walk: Determining hidden folder handling: user_includes_hidden=false has_negation_for_all_folders=false search_all_hidden=false requested_everything=false DEBUG pixi_glob::glob_set::walk: glob pass completed include="recipe.yaml, variants.yaml" excludes="" matched=1 elapsed_ms=2 root="/Users/rubenarts/dev/pixi-build-backends/recipe/pixi-build-api-version" DEBUG pixi_glob::glob_set::walk: glob pass completed include="pyproject.toml" excludes="" matched=1 elapsed_ms=2 root="/Users/rubenarts/dev/pixi-build-backends/backends/pixi-build-ros" INFO source-metadata{manifest_source=~/dev/pixi-build-backends/recipe/pixi-build-api-version preferred_build_source=None name=pixi-build-api-version platform=osx-arm64}: pixi_command_dispatcher::source_metadata: Retrieving source metadata for package pixi-build-api-version INFO source-metadata{manifest_source=/Users/rubenarts/dev/pixi-build-backends/backends/pixi-build-ros preferred_build_source=None name=pixi-build-ros platform=osx-arm64}: pixi_command_dispatcher::source_metadata: Retrieving source metadata for package pixi-build-ros DEBUG source-metadata{manifest_source=/Users/rubenarts/dev/pixi-build-backends/backends/pixi-build-ros preferred_build_source=None name=pixi-build-ros platform=osx-arm64}: pixi_command_dispatcher::source_metadata: no cached metadata passed. DEBUG source-metadata{manifest_source=~/dev/pixi-build-backends/recipe/pixi-build-api-version preferred_build_source=None name=pixi-build-api-version platform=osx-arm64}: pixi_command_dispatcher::source_metadata: Using cached source metadata for package pixi-build-api-version DEBUG pixi_core::lock_file::satisfiability: Source package metadata changed for '~/dev/pixi-build-backends/recipe/pixi-build-api-version'. Rebuild may be needed. INFO pixi_core::lock_file::outdated: the dependencies of environment 'default' for platform osx-arm64 are out of date because the locked metadata of 'pixi-build-api-version' package changed DEBUG backend-metadata{manifest_source=Path(PinnedPathSpec { path: Unix(Utf8PathBuf { _encoding: "unix", inner: "action_tutorials/action_tutorials_cpp" }) }) build_source=None platform=linux-64}: pixi_command_dispatcher::build_backend_metadata: metadata cache disabled for backend backend=pixi-build-ros reason="mutable-environment" command_kind="mutable-environment" INFO pixi_core::lock_file::outdated: the dependencies of environment 'default' for platform linux-64 are out of date because the operation was cancelled Error: × failed to solve requirements of environment 'default' for platform 'osx-arm64' ╰─▶ ⚠ the operation was cancelled ```As not blocking issues are found I'm going to approve this! Great work! |
ruben-arts
approved these changes
Dec 9, 2025
cc2d335
into
prefix-dev:bas/wip/develop-dependencies
37 checks passed
|
@nichmor I'm happy that this PR got merged, thanks! Are there already plans to also omit the hash for pypi dependencies in the lockfile, because this seems to only change it for conda dependencies. I couldn't find anything in the issues and open PRs. |
Contributor
|
@uwu-420 for sure! As you saw we just removed editable and the input hash will be next :) It's a bit more difficult though :) |
nichmor
pushed a commit
that referenced
this pull request
Dec 19, 2025
Replace hash-based validation for path-based PyPI packages with metadata-based validation. Instead of computing and storing a hash of pyproject.toml, setup.py, and setup.cfg, we now: 1. Don't store any hash in the lock file for path-based packages 2. During satisfiability checks, parse pyproject.toml and compare the name and version with the locked metadata This approach is similar to how PR #5011 removed input_hash for conda packages. The metadata comparison is more explicit about what changed (name vs version) rather than just indicating "something changed via hash mismatch". Changes: - pypi.rs: Stop computing and storing hash for SourceDist::Path and SourceDist::Directory - satisfiability/mod.rs: Replace PypiSourceTreeHashable hash comparison with metadata parsing and comparison - Add PypiSourceMetadataMismatch and PypiSourceMetadataError types - Remove SourceTreeHashMismatch type and related imports
8 tasks
nichmor
pushed a commit
that referenced
this pull request
Jan 3, 2026
Replace hash-based validation for path-based PyPI packages with metadata-based validation. Instead of computing and storing a hash of pyproject.toml, setup.py, and setup.cfg, we now: 1. Don't store any hash in the lock file for path-based packages 2. During satisfiability checks, parse pyproject.toml and compare the name and version with the locked metadata This approach is similar to how PR #5011 removed input_hash for conda packages. The metadata comparison is more explicit about what changed (name vs version) rather than just indicating "something changed via hash mismatch". Changes: - pypi.rs: Stop computing and storing hash for SourceDist::Path and SourceDist::Directory - satisfiability/mod.rs: Replace PypiSourceTreeHashable hash comparison with metadata parsing and comparison - Add PypiSourceMetadataMismatch and PypiSourceMetadataError types - Remove SourceTreeHashMismatch type and related imports
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The general idea is that we remove writing/reading the input_hash in the lockfile.
Instead, we compute/ask for the source metadata, and then compare if
depends,build_string, andversionare the same as the locked source record.Also, in this PR, we change the locking of the build metadata cache because we are having a deadlock. Instead, we are using
optimistic lockinginstead ofpessimistic one- this means that we don't hold the rwlock anymore, but instead record acache versionand verify it when trying to write.How Has This Been Tested?
AI Disclosure
Tools: Claude
Checklist: