Fix edge case when creating metadata file

fixes #1101

Author: jobselko

CHANGES/1101.bugfix

@@ -0,0 +1 @@
+Fixed edge case where metadata file did not match wheel metadata.

pulp_python/app/models.py

@@ -216,8 +216,10 @@ def init_from_artifact_and_relative_path(artifact, relative_path):
         """Used when downloading package from pull-through cache."""
         path = PurePath(relative_path)
         data = artifact_to_python_content_data(path.name, artifact, domain=get_domain())
+        name = data["name"]
+        version = data["version"]
         artifacts = {path.name: artifact}
-        if metadata_artifact := artifact_to_metadata_artifact(path.name, artifact):
+        if metadata_artifact := artifact_to_metadata_artifact(path.name, artifact, name, version):
             artifacts[f"{path.name}.metadata"] = metadata_artifact
         return PythonPackageContent(**data), artifacts
 

pulp_python/app/serializers.py

@@ -410,7 +410,11 @@ def deferred_validate(self, data):
 
         # Create metadata artifact for wheel files
         if filename.endswith(".whl"):
-            if metadata_artifact := artifact_to_metadata_artifact(filename, artifact):
+            name = data["name"]
+            version = data["version"]
+            if metadata_artifact := artifact_to_metadata_artifact(
+                filename, artifact, name, version
+            ):
                 data["metadata_artifact"] = metadata_artifact
                 data["metadata_sha256"] = metadata_artifact.sha256
 
@@ -552,9 +556,11 @@ def validate(self, data):
             )
         # Create metadata artifact for wheel files
         if filename.endswith(".whl"):
+            name = data["name"]
+            version = data["version"]
             with tempfile.TemporaryDirectory(dir=settings.WORKING_DIRECTORY) as temp_dir:
                 if metadata_artifact := artifact_to_metadata_artifact(
-                    filename, artifact, tmp_dir=temp_dir
+                    filename, artifact, name, version, tmp_dir=temp_dir
                 ):
                     data["metadata_artifact"] = metadata_artifact
                     data["metadata_sha256"] = metadata_artifact.sha256

pulp_python/app/tasks/upload.py

@@ -98,7 +98,9 @@ def create():
         content = PythonPackageContent.objects.create(**data)
         ContentArtifact.objects.create(artifact=artifact, content=content, relative_path=filename)
 
-        if metadata_artifact := artifact_to_metadata_artifact(filename, artifact):
+        name = data["name"]
+        version = data["version"]
+        if metadata_artifact := artifact_to_metadata_artifact(filename, artifact, name, version):
             ContentArtifact.objects.create(
                 artifact=metadata_artifact, content=content, relative_path=f"{filename}.metadata"
             )

pulp_python/app/utils.py

@@ -197,7 +197,9 @@ def get_project_metadata_from_file(filename):
     packagetype = DIST_EXTENSIONS[extensions[pkg_type_index]]
 
     metadata = DIST_TYPES[packagetype](filename)
-    metadata.metadata_sha256 = compute_metadata_sha256(filename)
+    name = metadata.name
+    version = metadata.version
+    metadata.metadata_sha256 = compute_metadata_sha256(filename, name, version)
     metadata.packagetype = packagetype
     if packagetype == "sdist":
         metadata.python_version = "source"
@@ -210,31 +212,53 @@ def get_project_metadata_from_file(filename):
     return metadata
 
 
-def extract_wheel_metadata(filename: str) -> bytes | None:
+def extract_non_normalized_pkg_name_with_version(
+    filename: str, name: str, version: str
+) -> str | None:
+    """
+    Search `filename` for a package name that normalizes to `name` and is followed by `version`.
+
+    Returns the original (non-normalized) name with version if found, otherwise None.
+    """
+    # Ensure the package name is normalized
+    normalized = re.sub(r"[-_.]+", "-", name).lower()
+
+    parts = normalized.split("-")
+    name_pattern = r"[-_.]+".join(map(re.escape, parts))
+    pattern = rf"({name_pattern})-{re.escape(version)}"
+
+    match = re.search(pattern, filename, re.IGNORECASE)
+    if match:
+        return match.group(0)
+    return None
+
+
+def extract_wheel_metadata(filename: str, name: str, version: str) -> bytes | None:
     """
     Extract the metadata file content from a wheel file.
 
     Returns the raw metadata content as bytes or None if metadata cannot be extracted.
     """
     if not filename.endswith(".whl"):
         return None
+
+    original_name_version = extract_non_normalized_pkg_name_with_version(filename, name, version)
+    metadata_path = f"{original_name_version}.dist-info/METADATA"
     try:
         with zipfile.ZipFile(filename, "r") as f:
-            for file_path in f.namelist():
-                if file_path.endswith(".dist-info/METADATA"):
-                    return f.read(file_path)
+            return f.read(metadata_path)
     except (zipfile.BadZipFile, KeyError, OSError) as e:
         log.warning(f"Failed to extract metadata file from {filename}: {e}")
     return None
 
 
-def compute_metadata_sha256(filename: str) -> str | None:
+def compute_metadata_sha256(filename: str, name: str, version: str) -> str | None:
     """
     Compute SHA256 hash of the metadata file from a Python package.
 
     Returns SHA256 hash or None if metadata cannot be extracted.
     """
-    metadata_content = extract_wheel_metadata(filename)
+    metadata_content = extract_wheel_metadata(filename, name, version)
     return hashlib.sha256(metadata_content).hexdigest() if metadata_content else None
 
 
@@ -260,7 +284,7 @@ def artifact_to_python_content_data(filename, artifact, domain=None):
 
 
 def artifact_to_metadata_artifact(
-    filename: str, artifact: Artifact, tmp_dir: str = "."
+    filename: str, artifact: Artifact, name: str, version: str, tmp_dir: str = "."
 ) -> Artifact | None:
     """
     Creates artifact for metadata from the provided wheel artifact.
@@ -274,7 +298,7 @@ def artifact_to_metadata_artifact(
         shutil.copyfileobj(artifact.file, temp_file)
         temp_file.flush()
 
-    metadata_content = extract_wheel_metadata(temp_wheel_path)
+    metadata_content = extract_wheel_metadata(temp_wheel_path, name, version)
     if not metadata_content:
         return None