From c0ed5693a75d5077829f2a9cf3f3a5be2b138a16 Mon Sep 17 00:00:00 2001
From: Aria Desires <aria.desires@gmail.com>
Date: Mon, 7 Apr 2025 13:49:05 -0400
Subject: [PATCH] only warn if CRC appears to be missing (#12722)

an alternative to #12706

fixes #12694
---
 Cargo.lock                      |  1 +
 crates/uv-extract/src/stream.rs | 14 ++++++++++++--
 crates/uv-metadata/Cargo.toml   |  1 +
 crates/uv-metadata/src/lib.rs   | 14 ++++++++++++--
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f1b137151..0947aa2ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5348,6 +5348,7 @@ dependencies = [
  "thiserror 2.0.12",
  "tokio",
  "tokio-util",
+ "tracing",
  "uv-distribution-filename",
  "uv-normalize",
  "uv-pypi-types",
diff --git a/crates/uv-extract/src/stream.rs b/crates/uv-extract/src/stream.rs
index 7d6b2646d..be5f2cde6 100644
--- a/crates/uv-extract/src/stream.rs
+++ b/crates/uv-extract/src/stream.rs
@@ -92,11 +92,21 @@ pub async fn unzip<R: tokio::io::AsyncRead + Unpin>(
             let computed = reader.compute_hash();
             let expected = reader.entry().crc32();
             if computed != expected {
-                return Err(Error::BadCrc32 {
+                let error = Error::BadCrc32 {
                     path: relpath,
                     computed,
                     expected,
-                });
+                };
+                // There are some cases where we fail to get a proper CRC.
+                // This is probably connected to out-of-line data descriptors
+                // which are problematic to access in a streaming context.
+                // In those cases the CRC seems to reliably be stubbed inline as 0,
+                // so we downgrade this to a (hidden-by-default) warning.
+                if expected == 0 {
+                    warn!("presumed missing CRC: {error}");
+                } else {
+                    return Err(error);
+                }
             }
         }
 
diff --git a/crates/uv-metadata/Cargo.toml b/crates/uv-metadata/Cargo.toml
index ddbf5b5aa..b80547dca 100644
--- a/crates/uv-metadata/Cargo.toml
+++ b/crates/uv-metadata/Cargo.toml
@@ -23,6 +23,7 @@ futures = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
+tracing = { workspace = true }
 zip = { workspace = true }
 
 [lints]
diff --git a/crates/uv-metadata/src/lib.rs b/crates/uv-metadata/src/lib.rs
index d1b38aed2..12164fe6b 100644
--- a/crates/uv-metadata/src/lib.rs
+++ b/crates/uv-metadata/src/lib.rs
@@ -258,11 +258,21 @@ pub async fn read_metadata_async_stream<R: futures::AsyncRead + Unpin>(
             let computed = reader.compute_hash();
             let expected = reader.entry().crc32();
             if computed != expected {
-                return Err(Error::BadCrc32 {
+                let error = Error::BadCrc32 {
                     path,
                     computed,
                     expected,
-                });
+                };
+                // There are some cases where we fail to get a proper CRC.
+                // This is probably connected to out-of-line data descriptors
+                // which are problematic to access in a streaming context.
+                // In those cases the CRC seems to reliably be stubbed inline as 0,
+                // so we downgrade this to a (hidden-by-default) warning.
+                if expected == 0 {
+                    tracing::warn!("presumed missing CRC: {error}");
+                } else {
+                    return Err(error);
+                }
             }
 
             let metadata = ResolutionMetadata::parse_metadata(&contents)