PEP 691 JSON API: upload-time should reflect when package was added to repository, not pulp_created

[dkliban]

Summary

The PEP 691 JSON Simple API response includes an upload-time field for each file. Currently, this field uses the content unit's pulp_created timestamp (when the package was first uploaded to Pulp), rather than the date the package was added to the specific repository being queried.

Problem

When a package is uploaded to Pulp and later added to a different repository (e.g. via copy or modify), the upload-time in the JSON API still reflects the original upload date, not when it became available in the repository serving the request.

Example

• ray-2.54.1-cp312-cp312-manylinux2014_aarch64.whl was uploaded to Pulp on 2026-03-26
• It was added to the rhoai-3.5-EA1-cpu-ubi9 repository on 2026-05-12 (repository version 370)
• The PEP 691 JSON response for that repository reports upload-time as 2026-03-26 (the pulp_created date)

Impact

Tools like uv use --exclude-newer to filter packages by upload-time for reproducible dependency resolution. When upload-time reflects the original upload rather than when the package appeared in the repository, the resolver may include packages that were not yet available in the repository at the intended cutoff time, or exclude packages that were.

This is particularly relevant for workflows that copy packages between repositories (e.g. from a staging repo to a release repo) where the repository addition date is the meaningful timestamp for consumers.

Expected Behavior

The upload-time field in the PEP 691 JSON API response should reflect when the package was added to the repository being queried, not the global pulp_created timestamp of the content unit.

Reference

• PEP 691 – JSON-based Simple API for Python Package Indexes
• PEP 700 – Additional Fields for the Simple API for Package Indexes (defines upload-time)