Rebase

crates/uv-client/src/cached_client.rs

@@ -300,7 +300,6 @@ impl CachedClient {
     }
 
     /// Make a request without checking whether the cache is fresh.
-    #[instrument(skip_all)]
     pub async fn skip_cache<
         Payload: Serialize + DeserializeOwned + Send + 'static,
         CallBackError,

crates/uv-client/src/flat_index.rs

@@ -2,17 +2,17 @@ use std::path::PathBuf;
 
 use futures::{FutureExt, StreamExt};
 use reqwest::Response;
-use tracing::{debug, info_span, Instrument, warn};
+use tracing::{debug, info_span, warn, Instrument};
 use url::Url;
 
 use distribution_filename::DistFilename;
 use distribution_types::{File, FileLocation, FlatIndexLocation, IndexUrl};
 use pep508_rs::VerbatimUrl;
 use uv_cache::{Cache, CacheBucket};
 
-use crate::{Connectivity, Error, ErrorKind, RegistryClient};
 use crate::cached_client::{CacheControl, CachedClientError};
 use crate::html::SimpleHtml;
+use crate::{Connectivity, Error, ErrorKind, RegistryClient};
 
 #[derive(Debug, thiserror::Error)]
 pub enum FlatIndexError {

crates/uv-dispatch/src/lib.rs

@@ -3,8 +3,8 @@
 //! implementing [`BuildContext`].
 
 use std::ffi::OsStr;
+use std::ffi::OsString;
 use std::path::Path;
-use std::{ffi::OsString, future::Future};
 
 use anyhow::{bail, Context, Result};
 use futures::FutureExt;
@@ -164,7 +164,7 @@ impl<'a> BuildContext for BuildDispatch<'a> {
             venv = ?venv.root()
         )
     )]
-    fn install<'data>(
+    async fn install<'data>(
         &'data self,
         resolution: &'data Resolution,
         venv: &'data PythonEnvironment,

crates/uv-distribution/src/distribution_database.rs

@@ -621,8 +621,8 @@ impl<'a, Context: BuildContext + Send + Sync> DistributionDatabase<'a, Context>
             Ok(LocalWheel {
                 dist: Dist::Built(dist.clone()),
                 archive: archive.path,
-                filename: filename.clone(),
                 hashes: archive.hashes,
+                filename: filename.clone(),
             })
         } else if hashes.is_empty() {
             // Otherwise, unzip the wheel.
@@ -632,8 +632,8 @@ impl<'a, Context: BuildContext + Send + Sync> DistributionDatabase<'a, Context>
             Ok(LocalWheel {
                 dist: Dist::Built(dist.clone()),
                 archive: archive.path,
+                hashes: archive.hashes,
                 filename: filename.clone(),
-                hashes: vec![],
             })
         } else {
             // If necessary, compute the hashes of the wheel.
@@ -676,8 +676,8 @@ impl<'a, Context: BuildContext + Send + Sync> DistributionDatabase<'a, Context>
             Ok(LocalWheel {
                 dist: Dist::Built(dist.clone()),
                 archive: archive.path,
-                filename: filename.clone(),
                 hashes: archive.hashes,
+                filename: filename.clone(),
             })
         }
     }

crates/uv-distribution/src/error.rs

@@ -84,7 +84,7 @@ pub enum Error {
     Join(#[from] JoinError),
 
     /// An I/O error that occurs while exhausting a reader to compute a hash.
-    #[error("Failed to exhaust hash reader")]
+    #[error("Failed to hash distribution")]
     HashExhaustion(#[source] std::io::Error),
 
     #[error("Hash mismatch for {distribution}\n\nExpected:\n{expected}\n\nComputed:\n{actual}")]

crates/uv-extract/src/hash.rs

@@ -117,7 +117,7 @@ where
 
     /// Exhaust the underlying reader.
     pub async fn finish(&mut self) -> Result<(), std::io::Error> {
-        while self.read(&mut [0; 8192]).await? > 0 {}
+        while self.read(&mut vec![0; 8192]).await? > 0 {}
 
         Ok(())
     }

crates/uv-resolver/src/flat_index.rs

@@ -11,9 +11,11 @@ use distribution_types::{
 };
 use pep440_rs::Version;
 use platform_tags::Tags;
+use pypi_types::HashDigest;
 use uv_client::FlatIndexEntries;
 use uv_configuration::{NoBinary, NoBuild};
 use uv_normalize::PackageName;
+use uv_types::RequiredHashes;
 
 /// A set of [`PrioritizedDist`] from a `--find-links` entry, indexed by [`PackageName`]
 /// and [`Version`].
@@ -32,6 +34,7 @@ impl FlatIndex {
     pub fn from_entries(
         entries: FlatIndexEntries,
         tags: &Tags,
+        required_hashes: &RequiredHashes,
         no_build: &NoBuild,
         no_binary: &NoBinary,
     ) -> Self {
@@ -44,6 +47,7 @@ impl FlatIndex {
                 file,
                 filename,
                 tags,
+                required_hashes,
                 no_build,
                 no_binary,
                 url,
@@ -56,11 +60,13 @@ impl FlatIndex {
         Self { index, offline }
     }
 
+    #[allow(clippy::too_many_arguments)]
     fn add_file(
         distributions: &mut FlatDistributions,
         file: File,
         filename: DistFilename,
         tags: &Tags,
+        required_hashes: &RequiredHashes,
         no_build: &NoBuild,
         no_binary: &NoBinary,
         index: IndexUrl,
@@ -71,7 +77,13 @@ impl FlatIndex {
             DistFilename::WheelFilename(filename) => {
                 let version = filename.version.clone();
 
-                let compatibility = Self::wheel_compatibility(&filename, tags, no_binary);
+                let compatibility = Self::wheel_compatibility(
+                    &filename,
+                    &file.hashes,
+                    tags,
+                    required_hashes,
+                    no_binary,
+                );
                 let dist = Dist::Built(BuiltDist::Registry(RegistryBuiltDist {
                     filename,
                     file: Box::new(file),
@@ -87,7 +99,12 @@ impl FlatIndex {
                 }
             }
             DistFilename::SourceDistFilename(filename) => {
-                let compatibility = Self::source_dist_compatibility(&filename, no_build);
+                let compatibility = Self::source_dist_compatibility(
+                    &filename,
+                    &file.hashes,
+                    required_hashes,
+                    no_build,
+                );
                 let dist = Dist::Source(SourceDist::Registry(RegistrySourceDist {
                     filename: filename.clone(),
                     file: Box::new(file),
@@ -107,6 +124,8 @@ impl FlatIndex {
 
     fn source_dist_compatibility(
         filename: &SourceDistFilename,
+        hashes: &[HashDigest],
+        required_hashes: &RequiredHashes,
         no_build: &NoBuild,
     ) -> SourceDistCompatibility {
         // Check if source distributions are allowed for this package.
@@ -120,12 +139,28 @@ impl FlatIndex {
             return SourceDistCompatibility::Incompatible(IncompatibleSource::NoBuild);
         }
 
+        // Check if hashes line up
+        if let Some(required_hashes) = required_hashes.get(&filename.name) {
+            if !required_hashes.is_empty() {
+                if hashes.is_empty() {
+                    return SourceDistCompatibility::Incompatible(IncompatibleSource::MissingHash);
+                }
+                if !hashes.iter().any(|hash| required_hashes.contains(hash)) {
+                    return SourceDistCompatibility::Incompatible(
+                        IncompatibleSource::MismatchedHash,
+                    );
+                }
+            }
+        }
+
         SourceDistCompatibility::Compatible
     }
 
     fn wheel_compatibility(
         filename: &WheelFilename,
+        hashes: &[HashDigest],
         tags: &Tags,
+        required_hashes: &RequiredHashes,
         no_binary: &NoBinary,
     ) -> WheelCompatibility {
         // Check if binaries are allowed for this package.
@@ -139,6 +174,18 @@ impl FlatIndex {
             return WheelCompatibility::Incompatible(IncompatibleWheel::NoBinary);
         }
 
+        // Check if hashes line up
+        if let Some(required_hashes) = required_hashes.get(&filename.name) {
+            if !required_hashes.is_empty() {
+                if hashes.is_empty() {
+                    return WheelCompatibility::Incompatible(IncompatibleWheel::MissingHash);
+                }
+                if !hashes.iter().any(|hash| required_hashes.contains(hash)) {
+                    return WheelCompatibility::Incompatible(IncompatibleWheel::MismatchedHash);
+                }
+            }
+        }
+
         // Determine a compatibility for the wheel based on tags.
         WheelCompatibility::from(filename.compatibility(tags))
     }

crates/uv-resolver/src/resolver/mod.rs

@@ -55,7 +55,7 @@ pub use crate::resolver::provider::{
 use crate::resolver::reporter::Facade;
 pub use crate::resolver::reporter::{BuildId, Reporter};
 use crate::yanks::AllowedYanks;
-use crate::{DependencyMode, Exclusions, Options};
+use crate::{DependencyMode, Exclusions, FlatIndex, Options};
 
 mod batch_prefetch;
 mod index;

crates/uv-resolver/tests/resolver.rs

@@ -19,9 +19,11 @@ use uv_configuration::{BuildKind, Constraints, NoBinary, NoBuild, Overrides, Set
 use uv_interpreter::{find_default_python, Interpreter, PythonEnvironment};
 use uv_resolver::{
     DisplayResolutionGraph, Exclusions, FlatIndex, InMemoryIndex, Manifest, Options,
-    OptionsBuilder, Preference, PreReleaseMode, ResolutionGraph, ResolutionMode, Resolver,
+    OptionsBuilder, PreReleaseMode, Preference, ResolutionGraph, ResolutionMode, Resolver,
+};
+use uv_types::{
+    BuildContext, BuildIsolation, EmptyInstalledPackages, RequiredHashes, SourceBuildTrait,
 };
-use uv_types::{BuildContext, BuildIsolation, EmptyInstalledPackages, RequiredHashes, SourceBuildTrait};
 
 // Exclude any packages uploaded after this date.
 static EXCLUDE_NEWER: Lazy<DateTime<Utc>> = Lazy::new(|| {

crates/uv/src/commands/pip_install.rs

@@ -36,7 +36,10 @@ use uv_requirements::{
     ExtrasSpecification, LookaheadResolver, NamedRequirementsResolver, RequirementsSource,
     RequirementsSpecification, SourceTreeResolver,
 };
-use uv_resolver::{DependencyMode, Exclusions, FlatIndex, InMemoryIndex, Manifest, Options, OptionsBuilder, PreReleaseMode, Preference, ResolutionGraph, ResolutionMode, Resolver, HashCheckingMode};
+use uv_resolver::{
+    DependencyMode, Exclusions, FlatIndex, HashCheckingMode, InMemoryIndex, Manifest, Options,
+    OptionsBuilder, PreReleaseMode, Preference, ResolutionGraph, ResolutionMode, Resolver,
+};
 use uv_types::{BuildIsolation, InFlight, RequiredHashes};
 use uv_warnings::warn_user;
 

crates/uv/src/commands/pip_sync.rs

@@ -30,7 +30,9 @@ use uv_requirements::{
     ExtrasSpecification, NamedRequirementsResolver, RequirementsSource, RequirementsSpecification,
     SourceTreeResolver,
 };
-use uv_resolver::{DependencyMode, FlatIndex, HashCheckingMode, InMemoryIndex, Manifest, OptionsBuilder, Resolver};
+use uv_resolver::{
+    DependencyMode, FlatIndex, HashCheckingMode, InMemoryIndex, Manifest, OptionsBuilder, Resolver,
+};
 use uv_types::{BuildIsolation, EmptyInstalledPackages, InFlight, RequiredHashes};
 use uv_warnings::warn_user;