Fix sdist extraction on older Python versions

[fredrikblau]

Summary

The tar security fallback clears ownership names with None. Python versions before 3.10.12 and 3.11.4 pass those values to grp.getgrnam() / pwd.getpwnam(), causing root sdist installs to fail.

Use empty ownership names instead, which preserves the ownership-stripping behavior without triggering the older tarfile bug. Added a regression test that simulates the affected tarfile implementation.

Fixes #11036.

Tests

• pytest tests/utils/test_helpers.py -q (50 passed)
• pytest (2,935 passed, 28 skipped; 6 collection errors due missing deepdiff before installation, and one unrelated Python 3.14 platform-tag expectation)
• ruff check tests/utils/test_helpers.py (passed; existing PLC0206 remains in src/poetry/utils/helpers.py)

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. If the owner-name workaround is wrong, extraction could fail or create files with an unintended owner or group, potentially affecting access to the extracted sdist. Reverting fixes future extractions, but already-created files and their ownership would remain until the archive is re-extracted or the metadata is corrected.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[radoering]

There are more spots with the pattern "try - except KeyError" and running the repro with Poetry from your branch still fails:

TypeError

  uid should be integer, not NoneType

(Just replace poetry==2.4.2 with git+https://github.com/fredrikblau/poetry.git@fix/older-python-sdist-extraction in the repro.)