chtypes 0.2.1__tar.gz → 0.2.2__tar.gz

{chtypes-0.2.1 → chtypes-0.2.2}/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to the python binding. The format is [Keep a Changelog](http
 
 The four bindings in this repository are released together and give one answer, so an entry here has a counterpart in the other three.
 
+## [0.2.2] — 2026-09-17
+
+### Changed
+
+- **`Registry(..., verify_hashes=True)` now refuses an artifact whose manifest carries no `library_sha256`, instead of loading it silently.** This is a behavior change in a security posture, not a silent fix: previously, asking for verification against a manifest with the field absent returned as if the bytes had been checked, when they never were — the caller believed the load was verified and it was not. `verify_library` now raises `RegistryError` naming the path and saying the manifest carries no `library_sha256`, the same shape its hash-mismatch path has always raised. `verify_hashes` off is unaffected: the field stays optional for a caller who did not ask. Go, TypeScript and Rust already refused this case; this was the one gap issue #13's item A2 left (#48).
+
+### Notes
+
+- Speaks **ABI revision 4**, unchanged since 0.1.0, so no artifact needs relinking. The golden set this release was tested against is the one core serves, generated on the ClickHouse lines 24.8, 25.3, 25.8, 25.10, 26.2, 26.3, 26.4, 26.5, 26.6, 26.7 and 26.8.
+- Seven facts about the compiled library's behavior that a consumer previously had to discover by experiment are now written down: `CHECK`-constraint batch rejection, binding filter parameters as `String`, single-line compact JSON array loss under `allow_errors`, the JSONCompactEachRow export field separator, the value-injection pattern and its compile-time wrap trap, `Columns` as canonical and in declaration order, and the frozen-signatures promise reworded ahead of the next ABI revision (#56). That promise is now stated once, in `docs/support.md`, and linked from everywhere else rather than restated in nine places (#69).
+
 ## [0.2.1] — 2026-09-15
 
 Released in step with the Rust crate, which gains `Registry::open` and `Error::LibraryRead`; this binding's public API is unchanged.

{chtypes-0.2.1 → chtypes-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: chtypes
-Version: 0.2.1
+Version: 0.2.2
 Summary: Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI
 Project-URL: Homepage, https://github.com/wave-rf/chtypes
 Project-URL: Repository, https://github.com/wave-rf/chtypes

{chtypes-0.2.1 → chtypes-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "chtypes"
-version = "0.2.1"
+version = "0.2.2"
 description = "Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI"
 readme = "README.md"
 license = "Apache-2.0"

{chtypes-0.2.1 → chtypes-0.2.2}/src/chtypes/_manifest.py

@@ -106,7 +106,9 @@ def verify_library(version_dir: str | os.PathLike[str]) -> None:
             f"chtypes: {path} is {size} bytes, manifest says {manifest.library_bytes}"
         )
     if not manifest.library_sha256:
-        return
+        raise RegistryError(
+            f"chtypes: {path} cannot be verified: manifest carries no library_sha256"
+        )
     digest = hashlib.sha256()
     with path.open("rb") as handle:
         for chunk in iter(lambda: handle.read(1 << 20), b""):

{chtypes-0.2.1 → chtypes-0.2.2}/tests/test_registry.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import dataclasses
 import hashlib
 import json
 import os
@@ -221,6 +222,48 @@ def test_verify_library_checks_the_bytes(tmp_path: Path) -> None:
         chtypes.verify_library(tmp_path)
 
 
+def test_verify_library_refuses_a_manifest_with_no_hash(tmp_path: Path) -> None:
+    """Verification asked for and not possible is not verification (#48): Go,
+    TypeScript and Rust all refuse an artifact whose manifest carries no
+    `library_sha256` when checksums are asked for. `verify_library` runs only
+    when a caller asked for it (`Registry(verify_hashes=True)`), so a manifest
+    missing the field must raise here too, not return quietly.
+    """
+    payload = b"not really a library"
+    (tmp_path / "fake.so").write_bytes(payload)
+    (tmp_path / "manifest.json").write_text(
+        json.dumps({"library": "fake.so", "library_bytes": len(payload)})
+    )
+    with pytest.raises(chtypes.RegistryError, match="library_sha256"):
+        chtypes.verify_library(tmp_path)
+
+
+def test_registry_verify_hashes_refuses_a_manifest_with_no_hash(
+    registry: chtypes.Registry, tmp_path: Path
+) -> None:
+    """`Registry(..., verify_hashes=True)` must not load bytes it never
+    checked (#48): a manifest with the field simply absent is exactly the
+    shape a truncated or hand-assembled artifact directory has. With
+    `verify_hashes` off the field stays optional for a caller who did not
+    ask, and the same directory loads normally.
+    """
+    smallest = min(registry.libraries(), key=lambda lib: lib.manifest.library_bytes or 1 << 62)
+    fields = dataclasses.asdict(smallest.manifest)
+    del fields["library_sha256"]
+    line = tmp_path / smallest.minor
+    line.mkdir()
+    (line / smallest.manifest.library).symlink_to(Path(smallest.path).resolve())
+    (line / "manifest.json").write_text(json.dumps(fields))
+
+    strict = chtypes.Registry(tmp_path, verify_hashes=True)
+    with pytest.raises(chtypes.RegistryError, match="library_sha256"):
+        strict.libraries()
+
+    lenient = chtypes.Registry(tmp_path, verify_hashes=False)
+    loaded = lenient.for_version(smallest.minor)  # must NOT raise
+    assert loaded.version == smallest.version
+
+
 def test_verify_a_real_artifact(registry: chtypes.Registry) -> None:
     # The one integrity check that means anything, run against the real bytes: a
     # move that reported success and truncated a 232 MB library looks identical

{chtypes-0.2.1 → chtypes-0.2.2}/uv.lock

@@ -4,7 +4,7 @@ requires-python = ">=3.11"
 
 [[package]]
 name = "chtypes"
-version = "0.2.1"
+version = "0.2.2"
 source = { editable = "." }
 
 [package.dev-dependencies]