feat(sdist): dereference symlinks by default

README.md

@@ -202,6 +202,9 @@ sdist.reproducible = true
 # If set to True, CMake will be run before building the SDist.
 sdist.cmake = false
 
+# If set to True, symlinks in the SDist will be dereferenced and their contents
+sdist.dereference = true
+
 # A list of packages to auto-copy into the wheel.
 wheel.packages = ["src/<package>", "python/<package>", "<package>"]
 

docs/reference/configs.md

@@ -440,6 +440,16 @@ print(mk_skbuild_docs())
   If set to True, CMake will be run before building the SDist.
 ```
 
+```{eval-rst}
+.. confval:: sdist.dereference
+  :type: ``bool``
+  :default: true
+
+  If set to True, symlinks in the SDist will be dereferenced and their contents
+  will be copied into the archive. This ensures the source distribution remains
+  usable across different machines and environments.
+```
+
 ```{eval-rst}
 .. confval:: sdist.exclude
   :type: ``list[str]``

src/scikit_build_core/build/sdist.py

@@ -138,7 +138,12 @@ def build_sdist(
             )
         )
         tar = stack.enter_context(
-            tarfile.TarFile(fileobj=gzip_container, mode="w", format=tarfile.PAX_FORMAT)
+            tarfile.TarFile(
+                fileobj=gzip_container,
+                mode="w",
+                format=tarfile.PAX_FORMAT,
+                dereference=settings.sdist.dereference,
+            )
         )
         assert settings.sdist.inclusion_mode is not None
         paths = sorted(

src/scikit_build_core/resources/scikit-build.schema.json

@@ -189,6 +189,11 @@
           "type": "boolean",
           "default": false,
           "description": "If set to True, CMake will be run before building the SDist."
+        },
+        "dereference": {
+          "type": "boolean",
+          "default": true,
+          "description": "If set to True, symlinks in the SDist will be dereferenced and their contents"
         }
       }
     },

src/scikit_build_core/settings/skbuild_model.py

@@ -262,6 +262,13 @@ class SDistSettings:
     If set to True, CMake will be run before building the SDist.
     """
 
+    dereference: bool = True
+    """
+    If set to True, symlinks in the SDist will be dereferenced and their contents
+    will be copied into the archive. This ensures the source distribution remains
+    usable across different machines and environments.
+    """
+
 
 @dataclasses.dataclass
 class WheelSettings:

tests/test_pep517_sdist_symlink.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import tarfile
+from pathlib import Path
+
+import pytest
+
+from scikit_build_core.build import build_sdist
+
+
+@pytest.mark.usefixtures("package_simple_pyproject_ext")
+def test_pep517_sdist_symlink(tmp_path: Path):
+    # Attempt to create a symlink in the current working directory
+    try:
+        Path("CMakeLists_link.txt").symlink_to("CMakeLists.txt")
+    except OSError:
+        pytest.skip(
+            "Creating symlinks is not supported/allowed on this OS without privileges"
+        )
+
+    out = build_sdist(str(tmp_path))
+
+    with tarfile.open(tmp_path / out, "r:gz") as tar:
+        # Check that the symlink file is actually dereferenced into a regular file
+        link_member = tar.getmember("cmake_example-0.0.1/CMakeLists_link.txt")
+        assert link_member.isreg(), (
+            "The symlink should have been stored as a regular file"
+        )
+
+
+@pytest.mark.usefixtures("package_simple_pyproject_ext")
+def test_pep517_sdist_symlink_no_dereference(tmp_path: Path):
+    try:
+        Path("CMakeLists_link_no_deref.txt").symlink_to("CMakeLists.txt")
+    except OSError:
+        pytest.skip(
+            "Creating symlinks is not supported/allowed on this OS without privileges"
+        )
+
+    out = build_sdist(
+        str(tmp_path),
+        config_settings={"sdist.dereference": "False"},
+    )
+
+    with tarfile.open(tmp_path / out, "r:gz") as tar:
+        # Check that the symlink file is actually NOT dereferenced
+        link_member = tar.getmember("cmake_example-0.0.1/CMakeLists_link_no_deref.txt")
+        assert link_member.issym(), "The symlink should have been stored as a symlink"