ENH: add support for symbolic links in package repository

mesonpy/__init__.py

@@ -14,6 +14,7 @@
 import argparse
 import collections
 import contextlib
+import copy
 import difflib
 import functools
 import importlib.machinery
@@ -23,6 +24,7 @@
 import os
 import pathlib
 import platform
+import posixpath
 import re
 import shutil
 import subprocess
@@ -937,6 +939,33 @@
 
         with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist_path) as sdist:
             for member in meson_dist.getmembers():
+                # Recursively resolve symbolic links.  The source distribution
+                # archive format specification allows for symbolic links as
+                # long as the target path does not include a '..' component.
+                # This makes symbolic links support unusable in most cases,
+                # therefore include the symbolic link targets as regular files
+                # in all cases.
+                while member.issym():
+                    name = member.name
+                    target = posixpath.normpath(posixpath.join(posixpath.dirname(member.name), member.linkname))
+                    try:
+                        # This can be implemented using the .replace() method
+                        # in Python 3.12 and later. The .replace() method was
+                        # added as part of PEP 706 and back-ported to Python
+                        # 3.9 and later in patch releases, thus it cannot be
+                        # relied upon until the minimum supported Python
+                        # version is 3.12.
+                        member = copy.copy(meson_dist.getmember(target))
+                        member.name = name
+                    except KeyError:
+                        warnings.warn(
+                            'symbolic link with absolute path target, pointing outside the '
+                            f'archive, or dangling ignored: {name}', stacklevel=1)
+                        break
+                    if member.isdir():
+                        warnings.warn(
+                            f'symbolic link pointing to a directory ignored: {name}', stacklevel=1)
+
                 if member.isfile():
                     file = meson_dist.extractfile(member.name)
 
@@ -971,6 +1000,10 @@
 
                     sdist.addfile(member, file)
 
+                elif not member.isdir() and not member.issym():
+                    warnings.warn(
+                        f'special file in the source archive ignored: {member.name}', stacklevel=1)
+
             # Add 'PKG-INFO'.
             member = tarfile.TarInfo(f'{dist_name}/PKG-INFO')
             member.uid = member.gid = 0

tests/packages/symlinks/__init__.py

@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT

tests/packages/symlinks/baz.py

@@ -0,0 +1 @@
+/__init__.py

tests/packages/symlinks/meson.build

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+project('symlinks', version: '1.0.0')
+
+py = import('python').find_installation()
+
+py.install_sources(
+    '__init__.py',
+    'submodule/__init__.py',
+    'submodule/aaa.py',
+    'submodule/bbb.py',
+    subdir: 'symlinks',
+    preserve_path: true,
+)

tests/packages/symlinks/pyproject.toml

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2021 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+[build-system]
+build-backend = 'mesonpy'
+requires = ['meson-python']

tests/packages/symlinks/qux.py

@@ -0,0 +1 @@
+../__init__.py

tests/packages/symlinks/submodule/__init__.py

@@ -0,0 +1 @@
+../__init__.py

tests/packages/symlinks/submodule/aaa.py

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+def foo():
+    return 42

tests/packages/symlinks/submodule/bbb.py

@@ -0,0 +1 @@
+aaa.py

tests/test_sdist.py

@@ -216,3 +216,22 @@ def test_reproducible(package_pure, tmp_path):
 
     assert sdist_path_a == sdist_path_b
     assert tmp_path.joinpath('a', sdist_path_a).read_bytes() == tmp_path.joinpath('b', sdist_path_b).read_bytes()
+
+@pytest.mark.filterwarnings('ignore:symbolic link')
+def test_symlinks(tmp_path, sdist_symlinks):
+    with tarfile.open(sdist_symlinks, 'r:gz') as sdist:
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
+
+    assert names == {
+        'symlinks-1.0.0/PKG-INFO',
+        'symlinks-1.0.0/meson.build',
+        'symlinks-1.0.0/pyproject.toml',
+        'symlinks-1.0.0/__init__.py',
+        'symlinks-1.0.0/submodule/__init__.py',
+        'symlinks-1.0.0/submodule/aaa.py',
+        'symlinks-1.0.0/submodule/bbb.py',
+    }
+
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes