{"id":"6625caebbb65bf20","repo":"pypa/pip","slug":"absolute-paths-are-not-supported-in-pylock-files-o","errorCode":null,"errorMessage":"Absolute paths are not supported in pylock files obtained from a URL: {path!r} in {pylock_path_or_url!r}","messagePattern":"Absolute paths are not supported in pylock files obtained from a URL: (.+?) in (.+?)","errorType":"exception","errorClass":"InstallationError","httpStatus":null,"severity":"error","filePath":"src/pip/_internal/utils/pylock.py","lineNumber":179,"sourceCode":"                # \"file:...\" as absolute, so it reaches here and urljoin honors\n                # its scheme, discarding the pylock base. Only keep the result\n                # if its scheme and host still match the lock's own.\n                base = urlsplit(pylock_path_or_url)\n                target = urlsplit(dist_url)\n                if (target.scheme, target.netloc) != (base.scheme, base.netloc):\n                    raise InstallationError(\n                        f\"Path {path!r} in pylock file obtained from a URL \"\n                        f\"resolves outside its location: {pylock_path_or_url!r}\"\n                    )\n                return dist_url\n            else:\n                return path_to_url(\n                    os.path.join(os.path.dirname(pylock_path_or_url), path)\n                )\n        else:\n            # absolute path, reject if pylock comes from a URL\n            if _is_url(pylock_path_or_url):\n                raise InstallationError(\n                    f\"Absolute paths are not supported in pylock files obtained \"\n                    f\"from a URL: {path!r} in {pylock_path_or_url!r}\"\n                )\n            return path_to_url(path)\n    else:\n        assert url is not None  # guaranteed by packaging.pylock validation\n        return url\n\n\ndef package_vcs_requirement_url(\n    pylock_path_or_url: str, package_vcs: PackageVcs\n) -> str:\n    dist_url = _package_dist_url(pylock_path_or_url, package_vcs.path, package_vcs.url)\n    url = f\"{package_vcs.type}+{dist_url}@{package_vcs.commit_id}\"\n    if package_vcs.subdirectory:\n        if \"#\" in url:\n            raise InstallationError(\n                f\"Package URL {url!r} cannot contain fragments in combination \"","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_internal/utils/pylock.py#L161-L197","documentation":"InstallationError from _package_dist_url when a pylock.toml fetched from a URL contains an absolute filesystem path for a package. A remote lock file cannot reference the installer's local filesystem (absolute paths), so pip rejects it outright.","triggerScenarios":"_is_url(pylock_path_or_url) is True, path is not None, os.path.isabs(path) is True. E.g. `pip -r https://example.com/lock.toml` where a package entry has `path = \"/home/me/pkg-1.0.whl\"` or `path = \"C:\\pkg-1.0.whl\"`.","commonSituations":"A lock file generated on one machine (absolute paths) and then served over HTTP for others to consume; copy-pasting a local pylock path layout into a remotely-hosted lock; Windows lock with drive-letter paths served via URL.","solutions":["Use the `url` field for remote-served locks instead of absolute `path` fields.","Convert absolute paths to relative paths that resolve under the lock's own host.","Serve the lock from a local file path (not a URL) if it genuinely references local artifacts."],"exampleFix":"# before - remote lock referencing absolute local path\n[[packages]]\npath = \"/home/me/pkg-1.0.whl\"\n\n# after - serve the artifact and reference by url\n[[packages]]\nurl = \"https://example.com/p/pkg-1.0.whl\"","handlingStrategy":"validation","validationCode":"import os\nfrom urllib.parse import urlparse\n\ndef pylock_has_no_absolute_path_for_remote_url(lock_url, packages):\n    if urlparse(lock_url).scheme not in ('http', 'https'):\n        return True\n    return not any(os.path.isabs(p.get('path', '')) for p in packages)\n# validate a generated remote lock before publishing/serving it","typeGuard":null,"tryCatchPattern":"try:\n    pip_install('-r', lock_url)\nexcept InstallationError as e:\n    if 'Absolute paths are not supported' in str(e):\n        convert_paths_to_urls(lock_url)\n        pip_install('-r', lock_url)\n    else:\n        raise","preventionTips":["Never put absolute filesystem paths in a remotely-served pylock.toml.","Use url fields for artifacts when the lock is fetched over HTTP(S).","Serve locally-referencing locks only via file paths or file:// URLs."],"tags":["pip","pylock","security","url","filesystem","lockfile"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}