pypa/pip · error · InstallationError

Absolute paths are not supported in pylock files obtained fr

Error message

Absolute paths are not supported in pylock files obtained from a URL: {path!r} in {pylock_path_or_url!r}

What it means

InstallationError from _package_dist_url when a pylock.toml fetched from a URL contains an absolute filesystem path for a package. A remote lock file cannot reference the installer's local filesystem (absolute paths), so pip rejects it outright.

Source

Thrown at src/pip/_internal/utils/pylock.py:179

                # "file:..." as absolute, so it reaches here and urljoin honors
                # its scheme, discarding the pylock base. Only keep the result
                # if its scheme and host still match the lock's own.
                base = urlsplit(pylock_path_or_url)
                target = urlsplit(dist_url)
                if (target.scheme, target.netloc) != (base.scheme, base.netloc):
                    raise InstallationError(
                        f"Path {path!r} in pylock file obtained from a URL "
                        f"resolves outside its location: {pylock_path_or_url!r}"
                    )
                return dist_url
            else:
                return path_to_url(
                    os.path.join(os.path.dirname(pylock_path_or_url), path)
                )
        else:
            # absolute path, reject if pylock comes from a URL
            if _is_url(pylock_path_or_url):
                raise InstallationError(
                    f"Absolute paths are not supported in pylock files obtained "
                    f"from a URL: {path!r} in {pylock_path_or_url!r}"
                )
            return path_to_url(path)
    else:
        assert url is not None  # guaranteed by packaging.pylock validation
        return url


def package_vcs_requirement_url(
    pylock_path_or_url: str, package_vcs: PackageVcs
) -> str:
    dist_url = _package_dist_url(pylock_path_or_url, package_vcs.path, package_vcs.url)
    url = f"{package_vcs.type}+{dist_url}@{package_vcs.commit_id}"
    if package_vcs.subdirectory:
        if "#" in url:
            raise InstallationError(
                f"Package URL {url!r} cannot contain fragments in combination "

View on GitHub (pinned to d7d0d0a394)

Solutions

1. Use the `url` field for remote-served locks instead of absolute `path` fields.
2. Convert absolute paths to relative paths that resolve under the lock's own host.
3. Serve the lock from a local file path (not a URL) if it genuinely references local artifacts.

Example fix

# before - remote lock referencing absolute local path
[[packages]]
path = "/home/me/pkg-1.0.whl"

# after - serve the artifact and reference by url
[[packages]]
url = "https://example.com/p/pkg-1.0.whl"

import os
from urllib.parse import urlparse

def pylock_has_no_absolute_path_for_remote_url(lock_url, packages):
    if urlparse(lock_url).scheme not in ('http', 'https'):
        return True
    return not any(os.path.isabs(p.get('path', '')) for p in packages)
# validate a generated remote lock before publishing/serving it

try:
    pip_install('-r', lock_url)
except InstallationError as e:
    if 'Absolute paths are not supported' in str(e):
        convert_paths_to_urls(lock_url)
        pip_install('-r', lock_url)
    else:
        raise

When it happens

Trigger: _is_url(pylock_path_or_url) is True, path is not None, os.path.isabs(path) is True. E.g. `pip -r https://example.com/lock.toml` where a package entry has `path = "/home/me/pkg-1.0.whl"` or `path = "C:\pkg-1.0.whl"`.

Common situations: A lock file generated on one machine (absolute paths) and then served over HTTP for others to consume; copy-pasting a local pylock path layout into a remotely-hosted lock; Windows lock with drive-letter paths served via URL.

Related errors

• Path {path!r} in pylock file obtained from a URL resolves ou
• Package URL {url!r} cannot contain fragments in combination
• Directory entries are not supported in remote pylock.toml {p
• Error reading pylock file {pylock_path_or_url!r}: {exc}
• {path} is a symlink; Will not return uid for symlinks

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/6625caebbb65bf20.json. Report an issue: GitHub.