Skip to content

🐛 fix(path): verify known implementations - #233

Merged
gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:bug/pypy-name-implementation
Nov 3, 2026
Merged

gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:bug/pypy-name-implementation

Conversation

@gaborbernat

@gaborbernat gaborbernat commented Nov 3, 2026 •

Copy link
Copy Markdown
Member

get_interpreter("pypy3.11") could return CPython when PATH contained a CPython executable with a PyPy filename. The old candidate filter let the filename bypass the implementation check. PATH discovery now checks the interpreter's reported implementation for known implementation names. Fixes #201.

Named candidates skipped the implementation check

The direct-name path disabled the check, while the filename-pattern path enabled it only when the matched spelling was exactly lowercase python. PythonInfo.satisfies() uses that flag to check the reported implementation. The new candidate filter sets the flag from the requested known implementation for both paths.

Behavior changes

Explicit CPython, PyPy, and GraalPy specs reject candidates that report another implementation, regardless of the executable's name or letter case. Generic python specs and unknown prefixes remain available for literal executable-name lookup.

Reported by Anthropic's OSS Scanner: ANT-2026-Y51C67N2.

The lookup accepted a PATH candidate named for PyPy even when it reported
CPython. Check the reported implementation for known names while keeping
unknown prefixes available as literal executable names.

Fixes tox-dev#201
@gaborbernat gaborbernat added the bug Something isn't working label Nov 3, 2026
The mixed-case alias tests now use the current interpreter's
free-threaded suffix. Without it, 3.15t rejects the alias on the
threading flag before implementation matching. Resolve the test imports
added on main.
@gaborbernat
gaborbernat merged commit 5177e91 into tox-dev:main Nov 3, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PyPy requests can select a CPython with a PyPy filename

1 participant