pypa/pip · error · PylockValidationError

Invalid sdist filename {package.sdist.filename!r}

Error message

Invalid sdist filename {package.sdist.filename!r}

What it means

Raised as PylockValidationError (pylock.py:621) when parse_sdist_filename() throws while validating the sdist.filename field of a package during Package._from_dict. parse_sdist_filename expects a PEP 625/500-compliant sdist name of the form '<name>-<version>.tar.gz' (or .zip); anything else re-raises as this error with context='sdist'.

Source

Thrown at src/pip/_vendor/packaging/pylock.py:621

                    context=f"wheels[{i}]",
                ) from e
            if name != package.name:
                raise PylockValidationError(
                    f"Name in {wheel.filename!r} is not consistent with "
                    f"package name {package.name!r}",
                    context=f"wheels[{i}]",
                )
            if package.version and version != package.version:
                raise PylockValidationError(
                    f"Version in {wheel.filename!r} is not consistent with "
                    f"package version {str(package.version)!r}",
                    context=f"wheels[{i}]",
                )
        if package.sdist:
            try:
                name, version = parse_sdist_filename(package.sdist.filename)
            except Exception as e:
                raise PylockValidationError(
                    f"Invalid sdist filename {package.sdist.filename!r}",
                    context="sdist",
                ) from e
            if name != package.name:
                raise PylockValidationError(
                    f"Name in {package.sdist.filename!r} is not consistent with "
                    f"package name {package.name!r}",
                    context="sdist",
                )
            if package.version and version != package.version:
                raise PylockValidationError(
                    f"Version in {package.sdist.filename!r} is not consistent with "
                    f"package version {str(package.version)!r}",
                    context="sdist",
                )
        try:
            for i, attestation_identity in enumerate(  # noqa: B007
                package.attestation_identities or []

View on GitHub (pinned to d7d0d0a394)

Solutions

1. Correct sdist.filename to the full '<normalized-name>-<version>.tar.gz' form, matching PEP 625.
2. If the artifact is actually a wheel, move it under [[packages.wheels]] and remove the sdist entry.
3. Regenerate the lock file with a spec-compliant resolver.

Example fix

# before
[[packages]]
name = "foo"
[packages.sdist]
filename = "foo.tar.gz"

# after
[[packages]]
name = "foo"
[packages.sdist]
filename = "foo-1.0.tar.gz"

import re
SDIST_RE = re.compile(r"^(?P<name>[^-]+)-(?P<version>[^-]+)\.(tar\.gz|zip)$")
def is_valid_sdist_filename(filename):
    return bool(SDIST_RE.match(filename))

null

from pip._vendor.packaging.pylock import PylockValidationError
try:
    Pylock.from_dict(d)
except PylockValidationError as e:
    if 'sdist' in (e.context or ''):
        flag_sdist_for_repair(e.context)

When it happens

Trigger: A package entry has an sdist.filename that is not a valid sdist name, e.g. 'foo.tar.gz', 'foo-1.0.whl', 'foo-1.0.tar.bz2', or a path like '/srv/files/foo-1.0.tar.gz'. Triggered by Pylock.from_dict() or Pylock.validate().

Common situations: Lock generators that stored a bare artifact name, a wrong extension, or a full path in the filename field. Migrating a hand-written lock that confused the wheel and sdist filename formats.

Related errors

• Cannot determine sdist filename
• Version in {wheel.filename!r} is not consistent with package
• Name in {package.sdist.filename!r} is not consistent with pa
• Version in {package.sdist.filename!r} is not consistent with
• Platform and interpreter constraints using --python-version,

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/b84b9c1de3091899.json. Report an issue: GitHub.