feat(pypi): environment markers are opaque conditions; build tools and backends come from the plan's generation; bundles keep patches and configopts

A PEP 508 marker becomes an opaque condition so the row is solver-excluded
instead of an Always edge, a build backend or overlay build tool is named
only when the plan's own toolchain hierarchy provides it, the request's
package index reaches the plan in prepare, and a language bundle renders
its patches, their checksums and configopts. Ported from develop.

Author: HaoZeke

src/package_emit.rs

@@ -258,6 +258,8 @@ fn render_easyconfig(
                 versionsuffix_line: &versionsuffix_line,
                 toolchain_options_line: &toolchain_options_line,
                 easyconfig_parameter_lines: &easyconfig_parameter_lines,
+                patch_line: &patch_line,
+                config_line: &config_line,
                 build_dependencies: &build_dependencies,
                 runtime_dependencies: &runtime_dependencies,
                 moduleclass,
@@ -276,6 +278,8 @@ fn render_easyconfig(
                 versionsuffix_line: &versionsuffix_line,
                 toolchain_options_line: &toolchain_options_line,
                 easyconfig_parameter_lines: &easyconfig_parameter_lines,
+                patch_line: &patch_line,
+                config_line: &config_line,
                 build_dependencies: &build_dependencies,
                 runtime_dependencies: &runtime_dependencies,
                 moduleclass,
@@ -333,6 +337,8 @@ struct BundleFragments<'a> {
     versionsuffix_line: &'a str,
     toolchain_options_line: &'a str,
     easyconfig_parameter_lines: &'a str,
+    patch_line: &'a str,
+    config_line: &'a str,
     build_dependencies: &'a [String],
     runtime_dependencies: &'a [String],
     moduleclass: &'a str,
@@ -351,6 +357,8 @@ fn render_language_bundle(
         versionsuffix_line,
         toolchain_options_line,
         easyconfig_parameter_lines,
+        patch_line,
+        config_line,
         build_dependencies,
         runtime_dependencies,
         moduleclass,
@@ -382,6 +390,9 @@ fn render_language_bundle(
     };
     let exts = render_exts_list(plan, materialized, kind);
     let default_ext_opts = overlay_exts_default_options(plan, kind);
+    // Bundle sources carry checksums inside exts_list. Top-level checksums
+    // must still line up with `patches`, or EasyBuild has nothing to verify.
+    let checksum_line = render_patch_checksums(&materialized.build.patches);
     let rendered = format!(
         "{easyblock_line}name = '{name}'\n\
 version = '{version}'\n\
@@ -393,6 +404,9 @@ toolchain = {{'name': '{toolchain_name}', 'version': '{toolchain_version}'}}\n\
 {easyconfig_parameter_lines}\
 {default_class}\
 {default_ext_opts}\
+{patch_line}\
+{checksum_line}\
+{config_line}\
 exts_list = {exts}\n\n\
 {build_dependencies}\
 {runtime_dependencies}\
@@ -916,6 +930,24 @@ fn is_tar_archive(filename: &str) -> bool {
     .any(|suffix| filename.ends_with(suffix))
 }
 
+fn checksum_slot(digest: Option<&str>) -> String {
+    match digest {
+        Some(checksum) => format!("'{}'", escape_single(checksum)),
+        None => "None".into(),
+    }
+}
+
+fn render_patch_checksums(patches: &[crate::package::PatchArtifact]) -> String {
+    if patches.is_empty() {
+        return String::new();
+    }
+    let checksums = patches
+        .iter()
+        .map(|patch| checksum_slot(patch.sha256.as_deref()))
+        .collect::<Vec<_>>();
+    format!("checksums = {}\n", render_multiline_list(&checksums))
+}
+
 fn render_dependency(
     dependency: &crate::package::LockedDependency,
     package_toolchain: &Toolchain,

src/package_workflow.rs

@@ -228,6 +228,7 @@ pub fn prepare_new_package_plan(
         sbom = package_plan_to_cyclonedx(&plan)
             .map_err(|error| PackageWorkflowError::Sbom(error.to_string()))?;
     }
+    plan.package_index = request.package_index.clone();
     Ok((plan, sbom))
 }
 
@@ -292,16 +293,21 @@ pub fn complete_package_bundle_with_options(
     if matches!(plan.origin, PackageOrigin::Pypi | PackageOrigin::Cran) {
         promote_language_overlay_extras(&mut plan, candidates, stack_policy, hierarchy_fixture)?;
     }
+    // Availability is generation-scoped: the later solve admits only
+    // hierarchy members, so a CMake that exists only on foss-2023a must
+    // not look available to a foss-2026.1 plan.
+    let available = candidates_available_for_plan(&plan, candidates, hierarchy_fixture);
+    let providers = crate::provides::language_provider_index(&available);
     if plan.origin == PackageOrigin::Pypi {
-        inject_overlay_build_tools(&mut plan, candidates);
+        inject_overlay_build_tools(&mut plan, &providers);
     }
     if plan.origin == PackageOrigin::Cargo {
         pin_binutils_to_gcccore(&mut plan, candidates, hierarchy_fixture);
     }
     adopt_moduleclass_from_tree(&mut plan, candidates);
     note_inferred_moduleclass(&mut plan);
     add_gcccore_binutils(&mut plan);
-    add_build_backend_dependency(&mut plan, candidates);
+    add_build_backend_dependency(&mut plan, &providers);
     drop_unavailable_build_requirements(&mut plan, candidates);
     let mut locks = Vec::new();
     for output in &plan.outputs {
@@ -453,7 +459,10 @@ fn drop_unavailable_build_requirements(
 /// names it: archspec declares `poetry.core.masonry.api` and its recipe
 /// carries `('poetry', '2.1.2')` beside binutils. `setuptools` is the
 /// exception, because the Python module already ships it.
-fn add_build_backend_dependency(plan: &mut PackagePlan, candidates: &[crate::domain::Candidate]) {
+fn add_build_backend_dependency(
+    plan: &mut PackagePlan,
+    providers: &std::collections::HashMap<String, &crate::domain::Candidate>,
+) {
     const BACKEND_MODULES: &[(&str, &str)] = &[
         ("poetry", "poetry"),
         ("hatchling", "hatchling"),
@@ -486,12 +495,10 @@ fn add_build_backend_dependency(plan: &mut PackagePlan, candidates: &[crate::dom
                 .unwrap_or(dependency.name.as_str()),
         ) == crate::provides::overlay_package_identity(module)
     });
-    // Only what the tree can actually provide: naming a module the site does
-    // not carry turns a buildable recipe into an unsatisfiable one.
-    let available = candidates.iter().any(|candidate| {
-        crate::provides::overlay_package_identity(&candidate.name)
-            == crate::provides::overlay_package_identity(module)
-    });
+    // Only what this generation can actually provide: a backend shipped
+    // only as a bundle extension still counts, and a first-class recipe
+    // on another generation does not.
+    let available = crate::provides::existing_language_provider_in(module, providers).is_some();
     if already || !available {
         return;
     }
@@ -642,7 +649,22 @@ fn pin_binutils_to_gcccore(
     }
 }
 
-fn inject_overlay_build_tools(plan: &mut PackagePlan, candidates: &[crate::domain::Candidate]) {
+/// Candidates the plan's generation admits: its toolchain hierarchy only.
+fn candidates_available_for_plan(
+    plan: &PackagePlan,
+    candidates: &[crate::domain::Candidate],
+    hierarchy_fixture: Option<&Path>,
+) -> Vec<crate::domain::Candidate> {
+    match hierarchy_for_with_tree(&plan.build.toolchain, hierarchy_fixture, candidates) {
+        Ok(hierarchy) => filter_candidates_in_hierarchy(candidates, &hierarchy),
+        Err(_) => Vec::new(),
+    }
+}
+
+fn inject_overlay_build_tools(
+    plan: &mut PackagePlan,
+    providers: &std::collections::HashMap<String, &crate::domain::Candidate>,
+) {
     let meson = plan.build.build_systems.iter().any(|hint| {
         let hint = hint.to_ascii_lowercase();
         hint.contains("meson")
@@ -667,11 +689,7 @@ fn inject_overlay_build_tools(plan: &mut PackagePlan, candidates: &[crate::domai
                     .unwrap_or(dependency.name.as_str()),
             ) == crate::provides::overlay_package_identity(name)
         });
-        let available = crate::provides::existing_language_provider(name, candidates).is_some()
-            || candidates.iter().any(|candidate| {
-                crate::provides::overlay_package_identity(&candidate.name)
-                    == crate::provides::overlay_package_identity(name)
-            });
+        let available = crate::provides::existing_language_provider_in(name, providers).is_some();
         if already || !available {
             continue;
         }
@@ -818,8 +836,7 @@ pub fn plan_new_package_with(
     if request.easyconfig_roots.is_empty() {
         return Err(PackageWorkflowError::NoEasyconfigRoots);
     }
-    let (mut plan, sbom) = prepare_new_package_plan(request)?;
-    plan.package_index = request.package_index.clone();
+    let (plan, sbom) = prepare_new_package_plan(request)?;
     let roots = request
         .easyconfig_roots
         .iter()

src/provides.rs

@@ -13,6 +13,7 @@
 
 use crate::domain::{Candidate, DepReq, ExtEntry};
 use std::collections::HashSet;
+use std::collections::HashMap;
 
 /// Marker embedded in `easyconfig_path` for a virtual extension provide.
 pub const EXT_PROVIDE_MARKER: &str = "#ext:";
@@ -345,6 +346,45 @@ pub fn existing_language_provider<'a>(
     })
 }
 
+/// Overlay-identity map for [`existing_language_provider_in`].
+///
+/// Bundle `exts_list` parents are keyed first so they win over a standalone
+/// first-class recipe, matching [`existing_language_provider`]. First-class
+/// names only fill identities no bundle already provides.
+pub fn language_provider_index(candidates: &[Candidate]) -> HashMap<String, &Candidate> {
+    let mut index = HashMap::new();
+    for candidate in candidates {
+        if candidate.is_extension_provide() {
+            continue;
+        }
+        for ext in &candidate.exts_list {
+            if ext.version.is_empty() {
+                continue;
+            }
+            index
+                .entry(overlay_package_identity(&ext.name))
+                .or_insert(candidate);
+        }
+    }
+    for candidate in candidates {
+        if candidate.is_extension_provide() {
+            continue;
+        }
+        index
+            .entry(overlay_package_identity(&candidate.name))
+            .or_insert(candidate);
+    }
+    index
+}
+
+/// [`existing_language_provider`] against a prebuilt index.
+pub fn existing_language_provider_in<'a>(
+    name: &str,
+    index: &HashMap<String, &'a Candidate>,
+) -> Option<&'a Candidate> {
+    index.get(&overlay_package_identity(name)).copied()
+}
+
 /// Collapse a selected extension provide to its parent bundle candidate.
 pub fn resolve_extension_provider<'a>(
     selected: &'a Candidate,

src/pypi.rs

@@ -135,15 +135,20 @@ fn recipe_from_warehouse(value: &Value) -> Result<ForeignRecipe, ForeignError> {
                 marker,
                 original,
             } => {
-                if let Some(marker) = marker {
+                let condition = if let Some(marker) = marker {
                     residuals.push(ForeignResidual {
                         category: "pypi-marker".into(),
                         severity: ResidualSeverity::Judgment,
-                        summary: format!("kept {name} with environment marker {marker}"),
+                        summary: format!(
+                            "{name} is gated by environment marker {marker} and does not constrain every profile"
+                        ),
                         evidence: Some(original.clone()),
                         provenance: None,
                     });
-                }
+                    ConditionExpr::Opaque { source: marker }
+                } else {
+                    ConditionExpr::Always
+                };
                 // The EasyBuild Python module installs setuptools, pip and
                 // wheel itself, so a project that requires one already has it.
                 // Emitting a dependency instead sends the solver looking for
@@ -166,7 +171,7 @@ fn recipe_from_warehouse(value: &Value) -> Result<ForeignRecipe, ForeignError> {
                     pin,
                     role: "run".into(),
                     original_spec: Some(original),
-                    condition: ConditionExpr::Always,
+                    condition,
                     provenance: Vec::new(),
                 });
             }
@@ -210,18 +215,32 @@ fn recipe_from_warehouse(value: &Value) -> Result<ForeignRecipe, ForeignError> {
                 Pep508::Requirement {
                     name,
                     pin,
+                    marker,
                     original,
-                    ..
                 } => {
                     if crate::provides::ignored_build_requirement(&name) {
                         continue;
                     }
+                    let condition = if let Some(marker) = marker {
+                        residuals.push(ForeignResidual {
+                            category: "pypi-marker".into(),
+                            severity: ResidualSeverity::Judgment,
+                            summary: format!(
+                                "{name} is gated by environment marker {marker} and does not constrain every profile"
+                            ),
+                            evidence: Some(original.clone()),
+                            provenance: None,
+                        });
+                        ConditionExpr::Opaque { source: marker }
+                    } else {
+                        ConditionExpr::Always
+                    };
                     dependencies.push(ForeignDep {
                         name,
                         pin,
                         role: "build".into(),
                         original_spec: Some(original),
-                        condition: ConditionExpr::Always,
+                        condition,
                         provenance: Vec::new(),
                     });
                 }