PEP 708 implementation

[sepehr-rs]

This PR continues the implementation effort for PEP 708, building on the work in #12813.
Since the original PR is now inactive, I have rebased the branch onto the current main, and I am working to complete the implementation so pip can make use of metadata already supported by PyPI.

[sepehr-rs]

Hi @notatallshaw, sorry to bother you about this.
The code is functional and mostly stabilized now (though there’s still plenty of work left), but two tests are currently failing:

FAILED tests/functional/test_install_config.py::test_command_line_append_flags - AssertionError: Script returned code: 1
FAILED tests/functional/test_install_config.py::test_command_line_appends_correctly - AssertionError: Script returned code: 1

These failures happen because the tests end up triggering check_multiple_remote_repositories. For example:

{'is_file': False, 'file_path': None, 'comes_from': 'https://test.pypi.org/simple/initools/', 'metadata_urls': {'https://test.pypi.org/simple/initools/'}}
{'https://test.pypi.org/simple/initools/'}
{'is_file': False, 'file_path': None, 'comes_from': 'https://pypi.org/simple/initools/', 'metadata_urls': {'https://pypi.org/simple/initools/'}}

Since there’s no Track or Alternate Location metadata indicating these repositories can be merged, this isn’t PEP 708 compliant, and check_multiple_remote_repositories raises UnsafeMultipleRemoteRepositories, which causes the tests to fail.

I see two possible approaches:

1. Update the tests so that they're PEP 708 compliant.
2. Add a set of trusted PyPI-family URLs to check_multiple_remote_repositories so that these cases are exempt from the safety check.

Before moving forward, I’d really appreciate your guidance on which direction makes the most sense. Thanks!

[sepehr-rs]

Hi @notatallshaw, sorry to bother you about this. The code is functional and mostly stabilized now (though there’s still plenty of work left), but two tests are currently failing:

FAILED tests/functional/test_install_config.py::test_command_line_append_flags - AssertionError: Script returned code: 1
FAILED tests/functional/test_install_config.py::test_command_line_appends_correctly - AssertionError: Script returned code: 1

These failures happen because the tests end up triggering check_multiple_remote_repositories. For example:

{'is_file': False, 'file_path': None, 'comes_from': 'https://test.pypi.org/simple/initools/', 'metadata_urls': {'https://test.pypi.org/simple/initools/'}}
{'https://test.pypi.org/simple/initools/'}
{'is_file': False, 'file_path': None, 'comes_from': 'https://pypi.org/simple/initools/', 'metadata_urls': {'https://pypi.org/simple/initools/'}}

Since there’s no Track or Alternate Location metadata indicating these repositories can be merged, this isn’t PEP 708 compliant, and check_multiple_remote_repositories raises UnsafeMultipleRemoteRepositories, which causes the tests to fail.

I see two possible approaches:

1. Update the tests so that they're PEP 708 compliant.

2. Add a set of trusted PyPI-family URLs to `check_multiple_remote_repositories` so that these cases are exempt from the safety check.

Before moving forward, I’d really appreciate your guidance on which direction makes the most sense. Thanks!

Just wanted to gently follow up on this and get your thoughts when you have a moment.
cc'ing @pfmoore and @ichard26 in case they have any guidance or opinions on the best approach here.
No rush at all, thanks!