ENH: add support for symbolic links in package repository

mesonpy/__init__.py

@@ -14,6 +14,7 @@
 import argparse
 import collections
 import contextlib
+import copy
 import difflib
 import functools
 import importlib.machinery
@@ -23,6 +24,7 @@
 import os
 import pathlib
 import platform
+import posixpath
 import re
 import shutil
 import subprocess
@@ -937,6 +939,29 @@ def sdist(self, directory: Path) -> pathlib.Path:
 
         with tarfile.open(meson_dist_path, 'r:gz') as meson_dist, mesonpy._util.create_targz(sdist_path) as sdist:
             for member in meson_dist.getmembers():
+                # Recursively resolve symbolic links.  The source distribution
+                # archive format specification allows for symbolic links as
+                # long as the target path does not include a '..' component.
+                # This makes symbolic links support unusable in most cases,
+                # therefore include the symbolic link targets as regular files
+                # in all cases.
+                while member.issym():
+                    name = member.name
+                    target = posixpath.normpath(posixpath.join(posixpath.dirname(member.name), member.linkname))
+                    try:
+                        # This can be implemented using the .replace() method
+                        # in Python 3.12 and later. The .replace() method was
+                        # added as part of PEP 706 and back-ported to Python
+                        # 3.9 and later in patch releases, thus it cannot be
+                        # relied upon until the minimum supported Python
+                        # version is 3.12.
+                        member = copy.copy(meson_dist.getmember(target))
+                        member.name = name
+                    except KeyError:
+                        # Symbolic link with absolute path target, pointing
+                        # outside the archive, or dangling: ignore.
+                        break
+
                 if member.isfile():
                     file = meson_dist.extractfile(member.name)
 

tests/packages/symlinks/__init__.py

@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT

tests/packages/symlinks/baz.py

@@ -0,0 +1 @@
+/__init__.py

tests/packages/symlinks/meson.build

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+project('symlinks', version: '1.0.0')
+
+py = import('python').find_installation()
+
+py.install_sources(
+    '__init__.py',
+    'submodule/__init__.py',
+    'submodule/aaa.py',
+    'submodule/bbb.py',
+    subdir: 'symlinks',
+    preserve_path: true,
+)

tests/packages/symlinks/pyproject.toml

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2021 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+[build-system]
+build-backend = 'mesonpy'
+requires = ['meson-python']

tests/packages/symlinks/qux.py

@@ -0,0 +1 @@
+../__init__.py

tests/packages/symlinks/submodule/__init__.py

@@ -0,0 +1 @@
+../__init__.py

tests/packages/symlinks/submodule/aaa.py

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2025 The meson-python developers
+#
+# SPDX-License-Identifier: MIT
+
+def foo():
+    return 42

tests/packages/symlinks/submodule/bbb.py

@@ -0,0 +1 @@
+aaa.py

tests/test_sdist.py

@@ -216,3 +216,22 @@ def test_reproducible(package_pure, tmp_path):
 
     assert sdist_path_a == sdist_path_b
     assert tmp_path.joinpath('a', sdist_path_a).read_bytes() == tmp_path.joinpath('b', sdist_path_b).read_bytes()
+
+
+def test_symlinks(sdist_symlinks):
+    with tarfile.open(sdist_symlinks, 'r:gz') as sdist:
+        names = {member.name for member in sdist.getmembers()}
+        mtimes = {member.mtime for member in sdist.getmembers()}
+
+    assert names == {
+        'symlinks-1.0.0/PKG-INFO',
+        'symlinks-1.0.0/meson.build',
+        'symlinks-1.0.0/pyproject.toml',
+        'symlinks-1.0.0/__init__.py',
+        'symlinks-1.0.0/submodule/__init__.py',
+        'symlinks-1.0.0/submodule/aaa.py',
+        'symlinks-1.0.0/submodule/bbb.py',
+    }
+
+    # All the archive members have a valid mtime.
+    assert 0 not in mtimes