[aevnsvi]

Closes #1371

On a pull-through distribution with a repository, a file already in the repository replaced the remote's entry on the simple page completely. Its upload time became the time it was cached, so uv --exclude-newer and pip --uploaded-prior-to saw old files as new. A yank on the remote, before or after the file was cached, no longer showed either, so resolvers could pick a yanked release.

When the remote lists the same file (same name and sha256), the entry now keeps the remote's upload time and is yanked when the remote yanked it; a local yank still applies. The URL and everything else still come from the repository, so clients download Pulp's copy.

Testing

• Unit tests for merge_pull_through_releases: remote upload time kept, remote yank applied, local yank kept, a different file under the same name takes nothing from the remote, a missing remote upload time keeps the local one.
• The pulp_python unit suite passes.

Checklist

• Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
• A changelog entry or entries has been added for any significant changes
• Follows the Pulp policy on AI Usage
• (For new features) - User documentation and test coverage has been added

Summary by CodeRabbit

• Bug Fixes
  • Pull-through package pages now show the remote upload time for matching files already cached locally.
  • Cached files now reflect the remote package’s yanked status and, when available, its yank reason. Locally yanked files remain marked yanked when the remote package is not yanked.
  • Files that do not match the remote version retain their local details.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Pull-through simple pages now merge cached releases with remote release metadata. Matching files with equal SHA-256 digests can retain the remote upload time and inherit remote yank metadata. Unit tests cover matching and non-matching releases, missing upload times, and entries present on only one side.

Changes: Pull-through release metadata

Layer / File(s)	Summary
Merge metadata for cached releases pulp_python/app/pypi/views.py, pulp_python/tests/unit/test_pull_through_releases.py, CHANGES/1371.bugfix	The merge keeps local release entries. For matching filenames with equal SHA-256 digests, it uses the remote upload time when available and applies remote yank metadata unless the local release is already yanked. Tests cover metadata precedence and unmatched entries. The changelog describes the upload-time and yank behavior.
Connect the merge to simple-page retrieval pulp_python/app/pypi/views.py	SimpleView.retrieve now uses the merge function instead of directly updating the remote release mapping.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: gerrod3

Merge Risk: Minimal · up to d7040

Pull-through simple pages will show the remote upload time and yank state for cached files whose name and SHA-256 match the remote. The change is localized and covered by unit tests, and no merge-blocking risk was found.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title states the main change: cached pull-through files now keep the remote's upload time and yank state. It matches the raw summary, the PR objectives, and the description. It is specific and con…
Description check		The description covers the problem, the fix, and testing. It links issue #1371 and the changelog checkbox is ticked. The template's commit-squash and AI policy items are checked or unchecked as the au…
Linked Issues check		Issue #1371 asks that pull-through packages keep the source upload-time after they are cached, so --uploaded-prior-to and --exclude-newer filter by the source time. At head d7040eb, merge_pull_through…
Out of Scope Changes check		The whole-PR diff against merge base 2e1ce32 touches three areas. pulp_python/app/pypi/views.py adds merge_pull_through_releases and uses it in SimpleView.retrieve. The unit tests in pulp_python/tests…

Full details: Title check

Explanation

The title states the main change: cached pull-through files now keep the remote's upload time and yank state. It matches the raw summary, the PR objectives, and the description. It is specific and concise, and it names the primary behavior change.

Full details: Description check

Explanation

The description covers the problem, the fix, and testing. It links issue #1371 and the changelog checkbox is ticked. The template's commit-squash and AI policy items are checked or unchecked as the author set them. The user documentation and test coverage item is unchecked, which is acceptable because this is a bugfix, not a new feature. The AI policy checkbox is unchecked, so the author has not confirmed compliance with it.

Full details: Linked Issues check

Explanation

Issue #1371 asks that pull-through packages keep the source upload-time after they are cached, so --uploaded-prior-to and --exclude-newer filter by the source time. At head d7040eb, merge_pull_through_releases in pulp_python/app/pypi/views.py copies the remote upload_time onto the local entry when the remote lists the same file (matched by filename and sha256). SimpleView.retrieve now calls this merge instead of dict.update, so the cached copy keeps the source time. The issue does not require a specific mechanism. The PR also applies a remote yank, which is extra behavior that the issue does not request. Unit tests for the merge function are listed in the PR description and the changelog entry is present. I did not run the test suite. The fallback to the local upload_time applies only when the remote does not list the file or gives no upload time. The issue does not specify that case.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff against merge base 2e1ce32 touches three areas. pulp_python/app/pypi/views.py adds merge_pull_through_releases and uses it in SimpleView.retrieve. The unit tests in pulp_python/tests/unit/test_pull_through_releases.py cover that function. CHANGES/1371.bugfix documents the behavior. All three support objective #1371. The extra remote-yank behavior is described in the PR and tested. It is part of the same merge logic, so it is not unrelated scope.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 32e0912f-8d3a-4c46-bc76-e0da9dc91746

Commits

Reviewing files that changed from the base of the PR and between 2e1ce32 and d7040eb.

Files selected for processing: 3

• CHANGES/1371.bugfix
• pulp_python/app/pypi/views.py
• pulp_python/tests/unit/test_pull_through_releases.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.