From 953da60c8e161b1edac9e6057d20a5551ebb414a Mon Sep 17 00:00:00 2001 From: ARI WG Git Bot Date: Tue, 20 Oct 2026 17:21:55 +0000 Subject: [PATCH 1/4] Add pip 26.2.2 for stack(s) cflinuxfs4, cflinuxfs5 --- manifest.yml | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/manifest.yml b/manifest.yml index a8d92b58..549dc9f6 100644 --- a/manifest.yml +++ b/manifest.yml @@ -89,20 +89,28 @@ dependencies: source_sha256: 578283f006390f85bb6282dffb876454593d637f5d1be494b5202ce4877e71f2 - name: pip version: 26.2.1 - uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.1_linux_noarch_cflinuxfs4_22e7a825.tgz + uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.1_linux_noarch_cflinuxfs5_22e7a825.tgz sha256: 22e7a8258b20b0f50f713d1e506c228c1ca7620aa3b483b67266b90392eeb91e cf_stacks: - - cflinuxfs4 + - cflinuxfs5 source: https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz source_sha256: f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f - name: pip - version: 26.2.1 - uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.1_linux_noarch_cflinuxfs5_22e7a825.tgz - sha256: 22e7a8258b20b0f50f713d1e506c228c1ca7620aa3b483b67266b90392eeb91e + version: 26.2.2 + uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.2_linux_noarch_cflinuxfs4_d876df6b.tgz + sha256: d876df6b58ea3264950a319c11d4d98e9a4095a774ae9b6d98edec1563a98679 + cf_stacks: + - cflinuxfs4 + source: https://files.pythonhosted.org/packages/fa/e8/0842d757e483e895e670f655084cfe8b8c72580c6769a76b30b2789a0608/pip-26.2.2.tar.gz + source_sha256: 3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f +- name: pip + version: 26.2.2 + uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.2_linux_noarch_cflinuxfs5_94205d18.tgz + sha256: 94205d18befb483e86afe50f75cd7a48a019da986af57d77330c0f446e8f5415 cf_stacks: - cflinuxfs5 - source: https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz - source_sha256: f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f + source: https://files.pythonhosted.org/packages/fa/e8/0842d757e483e895e670f655084cfe8b8c72580c6769a76b30b2789a0608/pip-26.2.2.tar.gz + source_sha256: 3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f - name: pipenv version: 2024.4.1 uri: https://buildpacks.cloudfoundry.org/dependencies/pipenv/pipenv_2024.4.1_linux_noarch_cflinuxfs3_b3c74c78.tgz From ad148331fbdbfda6633a657930ff82d642f57a4f Mon Sep 17 00:00:00 2001 From: tnikolova82 <97507942+tnikolova82@users.noreply.github.com> Date: Thu, 22 Oct 2026 11:21:04 +0300 Subject: [PATCH 2/4] Update manifest.yml --- manifest.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/manifest.yml b/manifest.yml index 549dc9f6..8a6b8622 100644 --- a/manifest.yml +++ b/manifest.yml @@ -87,14 +87,6 @@ dependencies: - cflinuxfs3 source: https://files.pythonhosted.org/packages/20/16/650289cd3f43d5a2fadfd98c68bd1e1e7f2550a1a5326768cddfbcedb2c5/pip-25.2.tar.gz source_sha256: 578283f006390f85bb6282dffb876454593d637f5d1be494b5202ce4877e71f2 -- name: pip - version: 26.2.1 - uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.1_linux_noarch_cflinuxfs5_22e7a825.tgz - sha256: 22e7a8258b20b0f50f713d1e506c228c1ca7620aa3b483b67266b90392eeb91e - cf_stacks: - - cflinuxfs5 - source: https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz - source_sha256: f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f - name: pip version: 26.2.2 uri: https://buildpacks.cloudfoundry.org/dependencies/pip/pip_26.2.2_linux_noarch_cflinuxfs4_d876df6b.tgz From 2a8456b9be27c18dd1dae297bcae7404c2102183 Mon Sep 17 00:00:00 2001 From: i343759 Date: Thu, 22 Oct 2026 12:31:35 +0300 Subject: [PATCH 3/4] Fix pip install failure when flit-core >=4 is in manifest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pip's pyproject.toml declares 'flit-core >=3.11,<4' as a build dependency. When BP_PIP_VERSION=latest triggers InstallPip(), the existing code runs 'pip install pip' with build isolation enabled, which tries to satisfy the flit-core <4 constraint. Since the manifest now carries flit-core 4.1.0, the constraint cannot be satisfied and staging fails with: ERROR: Could not find a version that satisfies the requirement flit-core<4,>=3.11 (from versions: 4.1.0) Add --no-build-isolation to skip build-dependency resolution, matching the existing pattern used by InstallCommonBuildDependencies() for the vendored sdist path. This is safe because pip's source tarball can be built with flit-core 4.x — the <4 upper bound in pyproject.toml is a conservative constraint, not a hard incompatibility. --- src/python/supply/supply.go | 7 ++++++- src/python/supply/supply_test.go | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/python/supply/supply.go b/src/python/supply/supply.go index 44cb9499..d26aecd9 100644 --- a/src/python/supply/supply.go +++ b/src/python/supply/supply.go @@ -341,12 +341,18 @@ func (s *Supplier) InstallPip() error { return err } + // Use --no-build-isolation to avoid resolving build dependencies from + // pip's pyproject.toml (which requires flit-core <4). Without this flag, + // pip tries to create an isolated build environment and fails when the + // manifest carries flit-core >=4. This matches the approach used by + // InstallCommonBuildDependencies() for the vendored sdist path. if err := s.Command.Execute(s.Stager.BuildDir(), indentWriter(os.Stdout), indentWriter(os.Stderr), "python", "-m", "pip", "install", "pip", "--exists-action=w", "--no-index", + "--no-build-isolation", "--ignore-installed", fmt.Sprintf("--find-links=%s", tempPath), ); err != nil { @@ -765,7 +771,6 @@ func (s *Supplier) InstallCommonBuildDependencies() error { } } - return nil } diff --git a/src/python/supply/supply_test.go b/src/python/supply/supply_test.go index a8d15d41..88c2dee1 100644 --- a/src/python/supply/supply_test.go +++ b/src/python/supply/supply_test.go @@ -154,7 +154,7 @@ var _ = Describe("Supply", func() { It("installs latest from manifest", func() { mockInstaller.EXPECT().InstallOnlyVersion("pip", "/tmp/pip") - mockCommand.EXPECT().Execute(buildDir, gomock.Any(), gomock.Any(), "python", "-m", "pip", "install", "pip", "--exists-action=w", "--no-index", "--ignore-installed", "--find-links=/tmp/pip") + mockCommand.EXPECT().Execute(buildDir, gomock.Any(), gomock.Any(), "python", "-m", "pip", "install", "pip", "--exists-action=w", "--no-index", "--no-build-isolation", "--ignore-installed", "--find-links=/tmp/pip") mockStager.EXPECT().LinkDirectoryInDepDir(filepath.Join(filepath.Join(depDir, "python"), "bin"), "bin") Expect(supplier.InstallPip()).To(Succeed()) From 48861b7110c6a387b2fcb43978f5f7b559c3d84a Mon Sep 17 00:00:00 2001 From: i343759 Date: Thu, 22 Oct 2026 13:15:05 +0300 Subject: [PATCH 4/4] Fix pip install: bootstrap flit-core before installing pip The previous --no-build-isolation fix changed the failure from a version constraint error to ModuleNotFoundError: No module named 'flit_core'. With --no-build-isolation, pip skips the isolated build environment but still needs flit_core importable in the system Python to build pip from its source tarball. The flit-core wheel is bundled inside the pip dependency tarball (/tmp/pip) but was never installed into the Python environment. Fix by bootstrapping flit-core from the bundled wheel before installing pip. The sequence is now: 1. Extract pip dependency to /tmp/pip (contains pip sdist + flit-core wheel) 2. pip install flit-core --no-index --no-build-isolation --find-links=/tmp/pip 3. pip install pip --no-index --no-build-isolation --find-links=/tmp/pip This matches the existing pattern in InstallCommonBuildDependencies() which bootstraps flit-core before using it for the vendored sdist path. --- src/python/supply/supply.go | 27 ++++++++++++++++++++++----- src/python/supply/supply_test.go | 5 ++++- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/src/python/supply/supply.go b/src/python/supply/supply.go index d26aecd9..613c055d 100644 --- a/src/python/supply/supply.go +++ b/src/python/supply/supply.go @@ -341,11 +341,28 @@ func (s *Supplier) InstallPip() error { return err } - // Use --no-build-isolation to avoid resolving build dependencies from - // pip's pyproject.toml (which requires flit-core <4). Without this flag, - // pip tries to create an isolated build environment and fails when the - // manifest carries flit-core >=4. This matches the approach used by - // InstallCommonBuildDependencies() for the vendored sdist path. + // The pip dependency tarball bundles a flit-core wheel (the build backend + // required by pip's pyproject.toml). We must bootstrap flit-core into the + // Python environment before installing pip, because: + // - pip's pyproject.toml declares build-requires: flit-core >=3.11,<4 + // - With build isolation, pip would try to install flit-core into a + // temporary venv, but --no-index prevents network access and the + // bundled flit-core version may not satisfy the <4 constraint + // - With --no-build-isolation, pip skips the isolated env but needs + // flit_core importable in the current environment + // This matches the pattern used by InstallCommonBuildDependencies(). + s.Log.Info("Installing build backend flit-core (bootstrap)") + if err := s.Command.Execute(s.Stager.BuildDir(), indentWriter(os.Stdout), indentWriter(os.Stderr), + "python", + "-m", "pip", + "install", "flit-core", + "--no-index", + "--no-build-isolation", + fmt.Sprintf("--find-links=%s", tempPath), + ); err != nil { + return fmt.Errorf("could not bootstrap flit-core: %v", err) + } + if err := s.Command.Execute(s.Stager.BuildDir(), indentWriter(os.Stdout), indentWriter(os.Stderr), "python", "-m", "pip", diff --git a/src/python/supply/supply_test.go b/src/python/supply/supply_test.go index 88c2dee1..b6533dee 100644 --- a/src/python/supply/supply_test.go +++ b/src/python/supply/supply_test.go @@ -154,7 +154,10 @@ var _ = Describe("Supply", func() { It("installs latest from manifest", func() { mockInstaller.EXPECT().InstallOnlyVersion("pip", "/tmp/pip") - mockCommand.EXPECT().Execute(buildDir, gomock.Any(), gomock.Any(), "python", "-m", "pip", "install", "pip", "--exists-action=w", "--no-index", "--no-build-isolation", "--ignore-installed", "--find-links=/tmp/pip") + gomock.InOrder( + mockCommand.EXPECT().Execute(buildDir, gomock.Any(), gomock.Any(), "python", "-m", "pip", "install", "flit-core", "--no-index", "--no-build-isolation", "--find-links=/tmp/pip"), + mockCommand.EXPECT().Execute(buildDir, gomock.Any(), gomock.Any(), "python", "-m", "pip", "install", "pip", "--exists-action=w", "--no-index", "--no-build-isolation", "--ignore-installed", "--find-links=/tmp/pip"), + ) mockStager.EXPECT().LinkDirectoryInDepDir(filepath.Join(filepath.Join(depDir, "python"), "bin"), "bin") Expect(supplier.InstallPip()).To(Succeed())