ENH: add support for symbolic links in package repository

Symbolic links are included as regular files in the sdist archive.
Only symbolic links pointing to files withing the archive are
supported.

Author: dnicolodi

mesonpy/__init__.py

@@ -23,6 +23,7 @@
 import os
 import pathlib
 import platform
+import posixpath
 import re
 import shutil
 import subprocess
@@ -937,6 +938,21 @@ def sdist(self, directory: Path) -> pathlib.Path:
 
         with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist_path) as sdist:
             for member in meson_dist.getmembers():
+                # Recursively resolve symbolic links.  The source distribution
+                # archive format specification allows for symbolic links as
+                # long as the target path does not include a '..' component.
+                # This makes symbolic links support unusable in most cases,
+                # therefore include the symbolic link targets as regular files
+                # in all cases.
+                while member.issym():
+                    target = posixpath.normpath(posixpath.join(posixpath.dirname(member.name), member.linkname))
+                    try:
+                        member = meson_dist.getmember(target).replace(name=member.name)
+                    except KeyError:
+                        # Symbolic link with absolute path target, pointing
+                        # outside the archive, or dangling: ignore.
+                        break
+
                 if member.isfile():
                     file = meson_dist.extractfile(member.name)
 

tests/packages/symlinks/__init__.py

@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT

tests/packages/symlinks/baz.py

@@ -0,0 +1 @@
+/__init__.py

tests/packages/symlinks/meson.build

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2021 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+project('symlinks', version: '1.0.0')
+
+py = import('python').find_installation()
+
+py.install_sources(
+    '__init__.py',
+    'submodule/__init__.py',
+    'submodule/aaa.py',
+    'submodule/bbb.py',
+    subdir: 'symlinks',
+    preserve_path: true,
+)

tests/packages/symlinks/pyproject.toml

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2021 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+[build-system]
+build-backend = 'mesonpy'
+requires = ['meson-python']

tests/packages/symlinks/qux.py

@@ -0,0 +1 @@
+../__init__.py

tests/packages/symlinks/submodule/__init__.py

@@ -0,0 +1 @@
+../__init__.py

tests/packages/symlinks/submodule/aaa.py

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2024 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+def foo():
+    return 42

tests/packages/symlinks/submodule/bbb.py

@@ -0,0 +1 @@
+aaa.py

tests/test_sdist.py

@@ -216,3 +216,22 @@ def test_reproducible(package_pure, tmp_path):
 
     assert sdist_path_a == sdist_path_b
     assert tmp_path.joinpath('a', sdist_path_a).read_bytes() == tmp_path.joinpath('b', sdist_path_b).read_bytes()
+
+
+def test_symlinks(sdist_symlinks):
+    with tarfile.open(sdist_symlinks, 'r:gz') as sdist:
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
+
+    assert names == {
+        'symlinks-1.0.0/PKG-INFO',
+        'symlinks-1.0.0/meson.build',
+        'symlinks-1.0.0/pyproject.toml',
+        'symlinks-1.0.0/__init__.py',
+        'symlinks-1.0.0/submodule/__init__.py',
+        'symlinks-1.0.0/submodule/aaa.py',
+        'symlinks-1.0.0/submodule/bbb.py',
+    }
+
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes