CodeVetter · Repo Unpack · Risk map
pypa/hatch
The main sensitive boundaries are executable project configuration, plugin loading, credentials, downloads, and filesystem operations beyond the checkout. These findings describe source behavior and review priorities, not confirmed vulnerabilities. Error handling and persistence choices also affect operational reliability. Tests provide useful signals, but mocks and conditional skips limit what their existence proves.
- Configured scripts are formatted into command strings and EnvironmentInterface.run_shell_command defaults shell=True; pre/post-install commands use this executor, making project command configuration an execution trust boundary.
- Third-party plugin discovery loads installed hatch entry points, custom plugin loaders execute Python modules, and environment plugin requirements may be installed into Hatch's own interpreter through uv or PyApp management.
- Authentication can read user configuration, .pypirc, and keyring; config show --all bypasses scrubbing, HATCH_DEBUG enables traceback locals, and upload errors mask the exact authentication string through replacement.
- Environment paths may be absolute outside the project and removal deletes both execution/build environments; wheel clean removes every .whl in its selected directory, and force-includes can package external files.
- EnvironmentMetadata writes JSON directly with write_text and reads with json.loads, whereas ConfigFile.save uses write_atomic. Hypothesis: interrupted or concurrent metadata writes merit targeted recovery testing; no corruption was observed. (inferred)
- IndexPublisher treats any exception during the simple API existence lookup as an empty artifact set, then attempts uploads; this branch is marked no cov and can conceal the original lookup failure.
- PipLocker.apply_lock raises LockerUnsupportedError and install_matches_lock returns False; locked pip environments therefore have a documented synchronization limitation, with a corresponding CLI failure assertion.
- PythonManager.install follows redirects, unpacks downloaded archives, and replaces the interpreter installation; custom distribution sources are supported, and tar extraction explicitly applies filter='data'. This is a remote-content-to-local-executable boundary.