Skip to content

test(fixtures): stop stamping a clock into the uv archive fixture #2001

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seonghobae wants to merge 3 commits into
base: main
Choose a base branch
from
Open

test(fixtures): stop stamping a clock into the uv archive fixture #2001

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
af5c50e
test(fixtures): stop stamping a clock into the uv archive fixture
seonghobae Sep 6, 2026
10192de
test(fixtures): assert deterministic gzip header
seonghobae Sep 7, 2026
d46f4f1
Merge remote-tracking branch 'origin/main' into HEAD
seonghobae Sep 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 29 additions & 9 deletions tests/test_materialize_base_python_requirements.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
from __future__ import annotations

import gzip
import hashlib
import io
import json
Expand Down Expand Up @@ -719,16 +720,29 @@ def _trusted_uv_archive(
member_name: str = materializer.TRUSTED_UV_ARCHIVE_MEMBER,
regular: bool = True,
) -> bytes:
"""Build a deterministic uv tar archive for supply-chain boundary tests."""
"""Build a deterministic uv tar archive for supply-chain boundary tests.

The gzip layer is written explicitly with ``mtime=0`` because
``tarfile.open(mode="w:gz")`` stamps the *current* time into the gzip
header instead, which made this helper's output -- and so this docstring --
non-deterministic. Three call sites feed the result straight into a
``pytest.mark.parametrize`` value, so pytest derived the test id from those
bytes and two of the three ids changed on every collection. Any comparison
of collected test ids across two runs then reported phantom disappearances:
a peer session diffing id sets across two commits saw "2 tests vanished"
that had not moved at all. ``TarInfo.mtime`` already defaults to 0, so the
gzip header was the only clock left in the archive.
"""
payload = io.BytesIO()
with tarfile.open(fileobj=payload, mode="w:gz") as bundle:
member = tarfile.TarInfo(member_name)
if regular:
member.size = len(binary)
bundle.addfile(member, io.BytesIO(binary))
else:
member.type = tarfile.DIRTYPE
bundle.addfile(member)
with gzip.GzipFile(fileobj=payload, mode="wb", mtime=0) as compressed:
with tarfile.open(fileobj=compressed, mode="w") as bundle:
member = tarfile.TarInfo(member_name)
if regular:
member.size = len(binary)
bundle.addfile(member, io.BytesIO(binary))
else:
member.type = tarfile.DIRTYPE
bundle.addfile(member)
return payload.getvalue()


Expand Down Expand Up @@ -811,6 +825,12 @@ def test_download_trusted_uv_archive_rejects_network_and_size_failures(
materializer._download_trusted_uv_archive()


def test_trusted_uv_archive_carries_no_clock() -> None:
"""The gzip header must pin MTIME to zero so parametrized test ids do not drift."""
for kwargs in ({}, {"member_name": "wrong/uv"}, {"regular": False}):
assert _trusted_uv_archive(**kwargs)[4:8] == b"\x00\x00\x00\x00"


def test_verified_uv_binary_accepts_exact_archive(
monkeypatch: pytest.MonkeyPatch,
) -> None:
Expand Down
Loading