Remove xz entirely

Signed-off-by: William Woodruff <william@astral.sh>

Author: woodruffw

Cargo.lock

@@ -100,7 +100,6 @@ async-channel = { version = "2.3.1" }
 async-compression = { version = "0.4.12", features = [
   "bzip2",
   "gzip",
-  "xz",
   "zstd",
 ] }
 async-trait = { version = "0.1.82" }
@@ -301,7 +300,6 @@ windows-registry = { version = "0.5.0" }
 windows-version = { version = "0.1.6" }
 wiremock = { version = "0.6.4" }
 wmi = { version = "0.18.3", default-features = false }
-xz2 = { version = "0.1.7", features = ["static"] }
 zeroize = { version = "1.8.1" }
 zip = { version = "8.1.0", default-features = false, features = [
   "deflate",

Cargo.toml

@@ -49,6 +49,3 @@ tokio = { workspace = true }
 
 [package.metadata.cargo-shear]
 ignored = ["uv-extract"]
-
-[features]
-static = ["uv-extract/static"]

crates/uv-bench/Cargo.toml

@@ -21,6 +21,7 @@ use tokio::io::{AsyncRead, ReadBuf};
 use tokio_util::compat::FuturesAsyncReadCompatExt;
 use url::Url;
 use uv_client::retryable_on_request_failure;
+use uv_distribution_filename::LegacySourceDistExtension;
 use uv_distribution_filename::SourceDistExtension;
 
 use uv_cache::{Cache, CacheBucket, CacheEntry, Error as CacheError};
@@ -170,7 +171,7 @@ impl ArchiveFormat {
 impl From<ArchiveFormat> for SourceDistExtension {
     fn from(val: ArchiveFormat) -> Self {
         match val {
-            ArchiveFormat::Zip => Self::Zip,
+            ArchiveFormat::Zip => Self::Legacy(LegacySourceDistExtension::Zip),
             ArchiveFormat::TarGz => Self::TarGz,
         }
     }

crates/uv-bin-install/src/lib.rs

@@ -72,7 +72,7 @@ name = "uv-dev"
 required-features = ["dev"]
 
 [features]
-default = ["performance", "uv-extract/static"]
+default = ["performance"]
 # Actually build the dev CLI.
 dev = []
 performance = ["performance-memory-allocator"]

crates/uv-dev/Cargo.toml

@@ -27,9 +27,29 @@ pub enum DistExtension {
 )]
 #[rkyv(derive(Debug))]
 pub enum SourceDistExtension {
+    TarGz,
+    Legacy(LegacySourceDistExtension),
+}
+
+#[derive(
+    Clone,
+    Copy,
+    Debug,
+    PartialEq,
+    Eq,
+    PartialOrd,
+    Ord,
+    Hash,
+    Serialize,
+    Deserialize,
+    rkyv::Archive,
+    rkyv::Deserialize,
+    rkyv::Serialize,
+)]
+#[rkyv(derive(Debug))]
+pub enum LegacySourceDistExtension {
     Tar,
     TarBz2,
-    TarGz,
     TarLz,
     TarLzma,
     TarXz,
@@ -83,41 +103,49 @@ impl SourceDistExtension {
 
         match extension {
             "gz" if is_tar(path.as_ref()) => Ok(Self::TarGz),
-            // TODO: Remove these other extensions in the future.
-            // NOTE: These get parsed from network sources like PyPI, so we don't
-            // necessarily want to hard-fail, just skip in the future.
-            "zip" => Ok(Self::Zip),
-            "tar" => Ok(Self::Tar),
-            "tgz" => Ok(Self::Tgz),
-            "tbz" => Ok(Self::Tbz),
-            "txz" => Ok(Self::Txz),
-            "tlz" => Ok(Self::Tlz),
-            "bz2" if is_tar(path.as_ref()) => Ok(Self::TarBz2),
-            "xz" if is_tar(path.as_ref()) => Ok(Self::TarXz),
-            "lz" if is_tar(path.as_ref()) => Ok(Self::TarLz),
-            "lzma" if is_tar(path.as_ref()) => Ok(Self::TarLzma),
-            "zst" if is_tar(path.as_ref()) => Ok(Self::TarZst),
+            "zip" => Ok(Self::Legacy(LegacySourceDistExtension::Zip)),
+            "tar" => Ok(Self::Legacy(LegacySourceDistExtension::Tar)),
+            "tgz" => Ok(Self::Legacy(LegacySourceDistExtension::Tgz)),
+            "tbz" => Ok(Self::Legacy(LegacySourceDistExtension::Tbz)),
+            "txz" => Ok(Self::Legacy(LegacySourceDistExtension::Txz)),
+            "tlz" => Ok(Self::Legacy(LegacySourceDistExtension::Tlz)),
+            "bz2" if is_tar(path.as_ref()) => Ok(Self::Legacy(LegacySourceDistExtension::TarBz2)),
+            "xz" if is_tar(path.as_ref()) => Ok(Self::Legacy(LegacySourceDistExtension::TarXz)),
+            "lz" if is_tar(path.as_ref()) => Ok(Self::Legacy(LegacySourceDistExtension::TarLz)),
+            "lzma" if is_tar(path.as_ref()) => Ok(Self::Legacy(LegacySourceDistExtension::TarLzma)),
+            "zst" if is_tar(path.as_ref()) => Ok(Self::Legacy(LegacySourceDistExtension::TarZst)),
             _ => Err(ExtensionError::SourceDist),
         }
     }
 
     /// Return the name for the extension.
     pub fn name(&self) -> &'static str {
         match self {
-            Self::Tar => "tar",
-            Self::TarBz2 => "tar.bz2",
             Self::TarGz => "tar.gz",
-            Self::TarLz => "tar.lz",
-            Self::TarLzma => "tar.lzma",
-            Self::TarXz => "tar.xz",
-            Self::TarZst => "tar.zst",
-            Self::Tbz => "tbz",
-            Self::Tgz => "tgz",
-            Self::Tlz => "tlz",
-            Self::Txz => "txz",
-            Self::Zip => "zip",
+            Self::Legacy(LegacySourceDistExtension::Tar) => "tar",
+            Self::Legacy(LegacySourceDistExtension::TarBz2) => "tar.bz2",
+            Self::Legacy(LegacySourceDistExtension::TarLz) => "tar.lz",
+            Self::Legacy(LegacySourceDistExtension::TarLzma) => "tar.lzma",
+            Self::Legacy(LegacySourceDistExtension::TarXz) => "tar.xz",
+            Self::Legacy(LegacySourceDistExtension::TarZst) => "tar.zst",
+            Self::Legacy(LegacySourceDistExtension::Tbz) => "tbz",
+            Self::Legacy(LegacySourceDistExtension::Tgz) => "tgz",
+            Self::Legacy(LegacySourceDistExtension::Tlz) => "tlz",
+            Self::Legacy(LegacySourceDistExtension::Txz) => "txz",
+            Self::Legacy(LegacySourceDistExtension::Zip) => "zip",
         }
     }
+
+    /// Returns `true` if the extension conforms to [PEP 625](https://peps.python.org/pep-0625/)'s
+    /// naming requirements.
+    ///
+    /// PEP 625 mandates `.tar.gz`; `.zip` is also accepted for backwards compatibility.
+    pub fn is_pep625_compliant(&self) -> bool {
+        matches!(
+            self,
+            Self::TarGz | Self::Legacy(LegacySourceDistExtension::Zip)
+        )
+    }
 }
 
 impl Display for SourceDistExtension {

crates/uv-distribution-filename/src/extension.rs

@@ -7,7 +7,9 @@ use uv_pep440::Version;
 pub use build_tag::{BuildTag, BuildTagError};
 pub use egg::{EggInfoFilename, EggInfoFilenameError};
 pub use expanded_tags::{ExpandedTagError, ExpandedTags};
-pub use extension::{DistExtension, ExtensionError, SourceDistExtension};
+pub use extension::{
+    DistExtension, ExtensionError, LegacySourceDistExtension, SourceDistExtension,
+};
 pub use source_dist::{SourceDistFilename, SourceDistFilenameError};
 pub use wheel::{WheelFilename, WheelFilenameError};
 

crates/uv-distribution-filename/src/lib.rs

@@ -177,7 +177,7 @@ mod tests {
 
     use uv_normalize::PackageName;
 
-    use crate::{SourceDistExtension, SourceDistFilename};
+    use crate::{SourceDistExtension, SourceDistFilename, extension::LegacySourceDistExtension};
 
     /// Only test already normalized names since the parsing is lossy
     ///
@@ -229,7 +229,7 @@ mod tests {
         assert!(
             SourceDistFilename::parse(
                 "foo.zip",
-                SourceDistExtension::Zip,
+                SourceDistExtension::Legacy(LegacySourceDistExtension::Zip),
                 &PackageName::from_str("foo-lib").unwrap()
             )
             .is_err()

crates/uv-distribution-filename/src/source_dist.rs

@@ -20,4 +20,9 @@ pub enum Error {
 
     #[error("Requested package name `{0}` does not match `{1}` in the distribution filename: {2}")]
     PackageNameMismatch(PackageName, PackageName, String),
+
+    #[error(
+        "Source distribution `{0}` has a non-PEP 625-compliant filename; only `.tar.gz` and `.zip` archives are accepted"
+    )]
+    NotPep625Filename(String),
 }

crates/uv-distribution-types/src/error.rs

@@ -395,6 +395,9 @@ impl Dist {
                 })))
             }
             DistExtension::Source(ext) => {
+                if !ext.is_pep625_compliant() {
+                    return Err(Error::NotPep625Filename(url.verbatim().to_string()));
+                }
                 Ok(Self::Source(SourceDist::DirectUrl(DirectUrlSourceDist {
                     name,
                     location: Box::new(location),
@@ -443,6 +446,10 @@ impl Dist {
                 })))
             }
             DistExtension::Source(ext) => {
+                if !ext.is_pep625_compliant() {
+                    return Err(Error::NotPep625Filename(url.verbatim().to_string()));
+                }
+
                 // If there is a version in the filename, record it.
                 let version = url
                     .filename()