chtypes 2.0.0.dev12__tar.gz → 2.0.0.dev14__tar.gz

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/CHANGELOG.md

@@ -8,6 +8,8 @@ The four bindings in this repository are released together and give one answer,
 
 ### Added
 
+- `Value.null_input` (ABI v2): whether the input field was the format's NULL literal (a JSON `null`, a TSV `\N`), decoded from `cols[].null_input` in the row and batch documents; false when the document carries none. It differs from `null` where a NULL literal is read into a column that is not Nullable. Decode cells over the ABI v2 stub (variant `null-input`: a NULL literal into a non-Nullable UUID, FixedString, Int32, DateTime, LowCardinality(String) and Enum8 column, in JSONEachRow and TSV) run in all four bindings.
+- `Value.poison` and `Value.dup_dropped` (ABI v2): whether the stored value is one the server cannot read back (the batch is then `accepted_poisoned` and exports nothing), and whether the reader dropped a duplicate key, decoded from `cols[].poison` and `cols[].dup_dropped` in the row and batch documents; false when the document carries none. Decode cells over the ABI v2 stub (variant `value-flags`: a NULL read into a non-Nullable Enum8 in JSONEachRow and TSV, and a repeated top-level JSONEachRow key that arrives after every column has been read, which the reader skips so the first value is stored, with controls holding each member false and absent) run in all four bindings.
 - Tests: the shared revocation-statement table (`tests/fixtures/revocation-statement/cases.json`) runs against `verify_revocation` and `check_installed`: `superseded_by` must be a string (`""` = no fix), and the first verifying revocation in a listing wins. No behavior changed.
 - `column_defaults` is covered by unit tests (ABI v2): the exact `insert_options` JSON for a UTF-8 value, a non-UTF-8 value (`value_b64`), an empty value (sent as `""`) and two entries in order, and the decode of a `default_override` cell (`Source.DEFAULT_OVERRIDE`, stored). The batches guide gains a usage section. No behavior changed.
 - Docs: `docs/guides/batches.md` shows how a `column_defaults` value is read, in the body format's own field encoding (CSV quoting, TSV escapes, a JSON string or number), with a value that doesn't read refused at the call before any body byte.
@@ -91,6 +93,7 @@ The four bindings in this repository are released together and give one answer,
 
 ### Fixed
 
+- Installing a pre-seeded cache entry from local blobs now checks the layer blob against the manifest's layer descriptor (size and sha256) before it decompresses it, and the manifest blob against its digest and its `index.json` descriptor's size before it parses it, as a downloaded blob already was and as the other three bindings already did. The install had checked only that the signed statement names the layer's digest, then unpacked the file stored under that name without hashing it, so a file replaced under a signed layer's name, holding the same library bytes plus other members, was installed with those members. Such an entry is now not installed, and the lookup is a miss. The installed library itself was always re-hashed against the signed predicate.
 - An offline lookup no longer reads every cached blob once per pre-seeded entry (#690). For each `index.json` entry with no record, the lookup read every blob of the layout, layers included, to find its signature, so entries it could not install (a signature not present, or one no trusted key verifies) cost entries × cache bytes on every lookup: about 4.9 s for 27 such entries over 1.27 GB (`measured`, darwin-arm64). The signature referrers are now read once per lookup, and never a layer, because a blob larger than `limits.manifest_bytes` cannot be a manifest. Installed entries were already skipped. The build that is installed is verified exactly as before: its manifest against its descriptor, its whole layer against its digest, and its signature, platform, request and fingerprint. A unit test counts the blob reads of one lookup that installs nothing and holds them to at most two per blob and five per entry, with no layer read, at 2 and at 20 entries alike.
 - Docs: `docs/guides/settings.md` names the ABI v2 admission time budget `chtypes_default_eval_cpu_nanos`, the evaluating thread's CPU time. Its examples used the 1.x name `chtypes_default_eval_wall_nanos`, which v2 refuses with `CHS_INVALID_ARGUMENT`.
 - A response body cut off part way (shorter than its Content-Length, a reset, a TLS close) is retried like a 5xx and, once the retry table is spent, is `CHTYPES_SOURCE_UNREACHABLE`; only an oversize body is `CHTYPES_ARTIFACT_CORRUPT`, and it is never retried (#641). Python took a body that ended before its Content-Length as the whole body and failed its digest check as corrupt without a retry; now a short body, or `http.client.IncompleteRead`, is retried and ends as unreachable. The rule is `docs/guides/fetch-v1.md` section 7, and the new `body-cut-off-then-ok` and `body-cut-off-exhausted` conformance cases hold every binding to it.

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: chtypes
-Version: 2.0.0.dev12
+Version: 2.0.0.dev14
 Summary: Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI
 Project-URL: Homepage, https://github.com/wave-rf/chtypes
 Project-URL: Repository, https://github.com/wave-rf/chtypes

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "chtypes"
-version = "2.0.0.dev12"
+version = "2.0.0.dev14"
 description = "Python binding for the chtypes artifacts: ClickHouse's own type system, per version, behind the frozen chs_* C ABI"
 readme = "README.md"
 license = "Apache-2.0"

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/src/chtypes/_decode.py

@@ -322,6 +322,9 @@ def _value(obj: dict[str, Any], where: str) -> Value:
         source=source,
         is_stored=Source.is_stored(source),
         value=_opt_b64(obj, "value_b64", where),
+        null_input=_bool(obj, "null_input", where),
+        poison=_bool(obj, "poison", where),
+        dup_dropped=_bool(obj, "dup_dropped", where),
     )
 
 

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/src/chtypes/_ocifetch/_ensure.py

@@ -75,6 +75,7 @@ from chtypes._ocifetch._layout import (
 from chtypes._ocifetch._lock import Lock, LockPin, load_lock, new_lock, save_lock
 from chtypes._ocifetch._oci import (
     Descriptor,
+    copy_blob_verified,
     fetch_blob_bytes,
     fetch_blob_to_path,
     fetch_manifest_by_digest,
@@ -86,6 +87,8 @@ from chtypes._ocifetch._oci import (
     resolve_platform_manifest,
     spelling_components,
     validate_spelling,
+    verify_body_matches_digest,
+    verify_json_descriptor,
     version_within_request,
 )
 from chtypes._ocifetch._referrers import ReferrerListing, discover_referrers, read_listing
@@ -1346,6 +1349,7 @@ def _verify_and_install_from_local_blobs(
     trusted_keys: tuple[TrustedKey, ...],
     visible_only: bool = False,
     referrers: dict[str, list[tuple[str, dict]]] | None = None,
+    manifest_size: int | None = None,
 ) -> VerifiedRecord | None:
     """docs/guides/fetch-v1.md §1/§6: "A pre-seeded layout has entries in
     `index.json` with no corresponding `unpacked/` directory yet; the first
@@ -1357,7 +1361,14 @@ def _verify_and_install_from_local_blobs(
     `source_root/blobs/sha256/*`, never the network. Returns `None` — never
     raises — for a missing, unreadable or untrusted entry, the same
     tolerant shape `_find_verified_signature` uses for a network referrer:
-    a bad pre-seed is "nothing usable here," not a crash."""
+    a bad pre-seed is "nothing usable here," not a crash.
+
+    The manifest blob is checked against `manifest_digest` (and against
+    `manifest_size`, the index descriptor's size, when the caller has one)
+    before it is parsed, and the layer blob against the manifest's layer
+    descriptor (size and sha256) before it is decompressed: the same
+    checks a download gets (§7.3), so no byte the signature does not cover
+    reaches the install."""
     blobs_dir = source_root / "blobs" / "sha256"
     if not blobs_dir.is_dir():
         return None
@@ -1366,7 +1377,15 @@ def _verify_and_install_from_local_blobs(
     if not manifest_path.is_file():
         return None
     try:
-        manifest_doc = json.loads(manifest_path.read_bytes())
+        manifest_bytes = manifest_path.read_bytes()
+        verify_body_matches_digest(manifest_bytes, manifest_digest, what="pre-seeded manifest")
+        if manifest_size is not None:
+            verify_json_descriptor(
+                manifest_bytes,
+                Descriptor(media_type="", digest=manifest_digest, size=manifest_size),
+                what="pre-seeded manifest",
+            )
+        manifest_doc = json.loads(manifest_bytes)
         layer_desc = manifest_layer_descriptor(manifest_doc)
     except (ValueError, OSError, FetchError):
         return None
@@ -1415,9 +1434,18 @@ def _verify_and_install_from_local_blobs(
     scratch = _scratch_root(cache_write_root)
     tmp_dir = tempfile.mkdtemp(dir=str(scratch))
     try:
+        # Size and sha256 against the layer descriptor BEFORE decompressing
+        # (§7.3), on a copy in scratch, which is then the file unpacked.
+        verified_layer = os.path.join(tmp_dir, "layer")
+        copy_blob_verified(
+            str(layer_path),
+            layer_desc,
+            verified_layer,
+            what=f"pre-seeded layer {layer_desc.digest}",
+        )
         unpacked_dir = os.path.join(tmp_dir, "unpacked")
         unpack_tar_zst(
-            str(layer_path),
+            verified_layer,
             unpacked_dir,
             library_name=predicate["library"],
             library_sha256=predicate["library_sha256"],
@@ -1469,11 +1497,15 @@ def _verify_preseeded_entries(roots: Sequence[Path], trusted_keys: tuple[Trusted
         candidates: list[str] = []
         candidate_layers: set[str] = set()
         manifests_read: dict[str, bytes] = {}
+        sizes: dict[str, int] = {}
         for m in index_doc.get("manifests") or []:
             digest = m.get("digest")
             if not digest or digest in already_verified:
                 continue
             candidates.append(digest)
+            size = m.get("size")
+            if isinstance(size, int) and not isinstance(size, bool):
+                sizes[digest] = size
             try:
                 manifest_hex = parse_digest(digest)
                 manifest_bytes = (blobs_dir / manifest_hex).read_bytes()
@@ -1495,6 +1527,7 @@ def _verify_preseeded_entries(roots: Sequence[Path], trusted_keys: tuple[Trusted
                 trusted_keys=trusted_keys,
                 visible_only=True,
                 referrers=referrers,
+                manifest_size=sizes.get(digest),
             )
             if record is not None:
                 already_verified.add(digest)

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/src/chtypes/_ocifetch/_oci.py

@@ -26,6 +26,7 @@ from chtypes._ocifetch._http import (
 
 __all__ = [
     "Descriptor",
+    "copy_blob_verified",
     "fetch_blob_bytes",
     "fetch_blob_to_path",
     "fetch_manifest_by_digest",
@@ -143,6 +144,46 @@ def verify_body_matches_digest(body: bytes, digest: str, *, what: str) -> None:
         )
 
 
+def copy_blob_verified(src_path: str, descriptor: Descriptor, dest_path: str, *, what: str) -> None:
+    """Copy a LOCAL blob file (a pre-seeded layout's `blobs/sha256/<hex>`)
+    to `dest_path`, streaming, and check the copy's size and sha256 against
+    `descriptor` BEFORE the caller does anything else with it — the local
+    counterpart of `fetch_blob_to_path`, with the same §7.3 rule ("check
+    size and sha256 before decompressing"). The caller unpacks the copy it
+    verified, never the source file, so the bytes checked are the bytes
+    used. Reads at most `descriptor.size + 1` bytes; removes `dest_path` on
+    any failure."""
+    expected = parse_digest(descriptor.digest)
+    hasher = hashlib.sha256()
+    size = 0
+    try:
+        with open(src_path, "rb") as src, open(dest_path, "wb") as dst:
+            while size <= descriptor.size:
+                chunk = src.read(min(1 << 20, descriptor.size + 1 - size))
+                if not chunk:
+                    break
+                hasher.update(chunk)
+                dst.write(chunk)
+                size += len(chunk)
+        if size > descriptor.size:
+            raise ArtifactCorruptError(
+                f"{what}: larger than the descriptor's size {descriptor.size}"
+            )
+        if size != descriptor.size:
+            raise ArtifactCorruptError(
+                f"{what}: size {size} disagreed with the descriptor's {descriptor.size}"
+            )
+        actual = hasher.hexdigest()
+        if actual != expected:
+            raise ArtifactCorruptError(f"{what}: sha256 {actual} disagreed with {expected}")
+    except BaseException:
+        try:
+            os.unlink(dest_path)
+        except OSError:
+            pass
+        raise
+
+
 def resolve_platform_manifest(index_doc: dict, platform_key: str) -> Descriptor:
     """Pick the one manifest descriptor in an OCI image index matching
     `platform_key` (e.g. "linux-arm64"), refusing a duplicate or absent

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/src/chtypes/results.py

@@ -73,7 +73,20 @@ class Value:
     bytes of a scalar String or FixedString leaf (from `value_b64`), None where
     the document carries none. `null`: the library's verdict, poison included.
     `source`: the `value_src` spelling (from `src`); `Source` lists them.
-    `is_stored`: the description's own fact for `source`.
+    `is_stored`: the description's own fact for `source`. `null_input`: whether
+    the input field was the format's NULL literal (a JSON null, a TSV `\\N`),
+    from `null_input`, False where the document carries none; a fact about the
+    input, where `null` is one about the stored value, so the two differ where
+    a NULL literal is read into a column that is not Nullable. `poison`: the
+    stored value is one the server cannot read back (the batch is then
+    accepted_poisoned and exports nothing), from `poison`; `dup_dropped`: the
+    reader dropped a duplicate key for this column, from `dup_dropped` (at default
+    settings a repeated top-level JSONEachRow key that arrives after every column
+    has been read is skipped: the first value is stored, this is True, and a
+    `duplicate_key_dropped` transform is reported; a repeat while a column is
+    still unread is refused with 117; a repeated key inside a Map value keeps
+    both keys). Each is
+    False where the document carries none.
     """
 
     column: bytes
@@ -82,6 +95,9 @@ class Value:
     source: str
     is_stored: bool
     value: bytes | None = None
+    null_input: bool = False
+    poison: bool = False
+    dup_dropped: bool = False
 
 
 @dataclass(frozen=True, slots=True)

chtypes-2.0.0.dev14/tests/abi2/test_null_input.py

@@ -0,0 +1,153 @@
+"""The null_input decode cells, through the public API, over the generated v2
+stub (variant "null-input").
+
+The stub answers scripts/abi-v1/emit/_stubshared.py's NULL_INPUT_DOCS: for a
+JSON null and a TSV `\\N` into each of six non-Nullable types (UUID,
+FixedString(4), Int32, DateTime, LowCardinality(String), Enum8), the entry
+carries `null_input` true; two controls carry it false and absent. Each entry's
+expected value is read off its name (a NULL_INPUT_CONTROL_PREFIX name expects
+False), and the cell count is the generator's NULL_INPUT_CELL_COUNT, so a
+document that lost its cells fails. The other three bindings pin that count as
+12; `test_null_input_cell_count_is_pinned` fails here first if the generator
+changes it. Without `$CHTYPES_ABI2_STUBS` the stub tests skip loudly by name.
+"""
+
+from __future__ import annotations
+
+import shutil
+import sys
+from pathlib import Path
+
+import pytest
+
+from chtypes import Format, Value, library
+
+from .conftest import REPO_ROOT, stub_path
+
+PINNED_CELL_COUNT = 12  # Go, TypeScript and Rust pin the same number
+
+
+def _shared():
+    sys.path.insert(0, str(REPO_ROOT / "scripts" / "abi-v1"))
+    from emit import _stubshared
+
+    return _stubshared
+
+
+@pytest.fixture
+def null_input_library(
+    stubs_dir: Path, stubs_manifest: dict, tmp_path: Path, clean_process, monkeypatch
+):
+    monkeypatch.setenv("CHTYPES_ALLOW_UNVERIFIED_LIBRARY", "1")
+    target = tmp_path / "null-input.so"
+    shutil.copyfile(stub_path(stubs_dir, stubs_manifest["variants"]["null-input"]), target)
+    target.chmod(0o755)
+    with pytest.warns(UserWarning, match="UNVERIFIED"):
+        return library.open_unverified(target, allow=True)
+
+
+def _check(where: str, cols: tuple[Value, ...], prefix: bytes) -> int:
+    cells = 0
+    for c in cols:
+        want = not c.column.startswith(prefix)
+        cells += want
+        assert c.null_input is want, (
+            f"{where}: column {c.column!r}: null_input = {c.null_input}, want {want}"
+        )
+        # A NULL into a non-Nullable Enum8 stores 0, outside the enum: poisoned.
+        want_poison = want and c.column.endswith(b".enum8")
+        assert c.poison is want_poison, (
+            f"{where}: column {c.column!r}: poison = {c.poison}, want {want_poison}"
+        )
+    return cells
+
+
+def test_null_input_cell_count_is_pinned() -> None:
+    assert _shared().NULL_INPUT_CELL_COUNT == PINNED_CELL_COUNT
+
+
+def test_stub_null_input(null_input_library) -> None:
+    shared = _shared()
+    prefix = shared.NULL_INPUT_CONTROL_PREFIX.encode()
+    schema = null_input_library.compile_table(b"CREATE TABLE t (x Int32)")
+
+    row = schema.row(Format.JSON_EACH_ROW, b'{"x":null}')
+    assert _check("row", row.columns, prefix) == shared.NULL_INPUT_CELL_COUNT
+
+    batch = schema.rows(Format.TSV, b"\\N\n")
+    cells = sum(_check(f"batch.rows[{i}]", r.columns, prefix) for i, r in enumerate(batch.rows))
+    assert cells == shared.NULL_INPUT_CELL_COUNT
+
+
+# The poison and dup_dropped cells, variant "value-flags"
+# (_stubshared.VALUE_FLAGS_DOCS): a JSON null or TSV \N into a non-Nullable
+# Enum8 (poison, in JSONEachRow and TSV) and one canned entry that carries
+# dup_dropped, plus four controls that hold each member false and absent. A
+# "poison." entry expects poison True and dup_dropped False, a "dup." entry the
+# reverse, a "control." entry both False, so a binding that swaps the members
+# fails. The other three bindings pin the counts as 2 and 1.
+PINNED_POISON_CELLS = 2
+PINNED_DUP_CELLS = 1
+
+
+@pytest.fixture
+def value_flags_library(
+    stubs_dir: Path, stubs_manifest: dict, tmp_path: Path, clean_process, monkeypatch
+):
+    monkeypatch.setenv("CHTYPES_ALLOW_UNVERIFIED_LIBRARY", "1")
+    target = tmp_path / "value-flags.so"
+    shutil.copyfile(stub_path(stubs_dir, stubs_manifest["variants"]["value-flags"]), target)
+    target.chmod(0o755)
+    with pytest.warns(UserWarning, match="UNVERIFIED"):
+        return library.open_unverified(target, allow=True)
+
+
+def _check_flags(where: str, cols: tuple[Value, ...], shared) -> tuple[int, int]:
+    poison = dup = 0
+    for c in cols:
+        name = c.column.decode()
+        want_p = name.startswith(shared.VALUE_FLAGS_POISON_PREFIX)
+        want_d = name.startswith(shared.VALUE_FLAGS_DUP_PREFIX)
+        if not (want_p or want_d):
+            assert name.startswith(shared.VALUE_FLAGS_CONTROL_PREFIX), (
+                f"{where}: unexpected {name!r}"
+            )
+        poison += want_p
+        dup += want_d
+        if want_d:
+            # The producing input: a repeated top-level JSONEachRow key after
+            # every column was read; the first value is stored.
+            assert (name, c.text) == ("dup.JSONEachRow.repeated_top_key", b"1"), where
+        assert (c.poison, c.dup_dropped) == (want_p, want_d), (
+            f"{where}: column {name!r}: poison = {c.poison}, dup_dropped = {c.dup_dropped}, "
+            f"want {want_p}, {want_d}"
+        )
+    return poison, dup
+
+
+def test_value_flags_cell_counts_are_pinned() -> None:
+    shared = _shared()
+    assert shared.VALUE_FLAGS_POISON_CELLS == PINNED_POISON_CELLS
+    assert shared.VALUE_FLAGS_DUP_CELLS == PINNED_DUP_CELLS
+
+
+def test_stub_value_flags(value_flags_library) -> None:
+    shared = _shared()
+    schema = value_flags_library.compile_table(b"CREATE TABLE t (x Int32)")
+
+    row = schema.row(Format.JSON_EACH_ROW, b'{"a":1,"a":2}')
+    assert _check_flags("row", row.columns, shared) == (PINNED_POISON_CELLS, PINNED_DUP_CELLS)
+
+    dup_transforms = [
+        t
+        for t in row.transformed
+        if t.reason == "duplicate_key_dropped" and t.column == b"dup.JSONEachRow.repeated_top_key"
+    ]
+    assert len(dup_transforms) == 1
+
+    batch = schema.rows(Format.TSV, b"1\n")
+    counts = [_check_flags(f"batch.rows[{i}]", r.columns, shared) for i, r in enumerate(batch.rows)]
+    assert (sum(p for p, _ in counts), sum(d for _, d in counts)) == (
+        PINNED_POISON_CELLS,
+        PINNED_DUP_CELLS,
+    )

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/tests/ocifetch/test_preseed_scan.py

@@ -8,8 +8,10 @@ The verdicts come from the blob reads the lookup itself made (every
 from __future__ import annotations
 
 import hashlib
+import io
 import json
 import shutil
+import tarfile
 from collections import Counter
 from collections.abc import Callable
 from pathlib import Path
@@ -159,3 +161,121 @@ def test_preseeded_install_still_verifies_the_layer(tmp_path: Path) -> None:
     layer.write_bytes(bytes(b))
     assert resolve_installed(Request("26.1"), "linux-arm64", _options(cache, "test-key")) is None
     assert not (cache / "unpacked" / "sha256" / digests[0].removeprefix("sha256:")).exists()
+
+
+def _tamper_layer(original: bytes, case: str) -> bytes:
+    """A different valid tar.zst carrying the signed library member's bytes
+    unchanged. "extra-member": every member of `original` plus `planted.txt`.
+    "manifest-json": the tarball's `manifest.json` altered — the signed
+    fixture layer has none (its members are `docs/` and the library), so its
+    altered form is a `manifest.json` the signed layer does not carry, beside
+    the same library bytes. Neither is covered by any signature."""
+    try:
+        from compression import zstd  # Python 3.14+
+    except ImportError:  # Python 3.11-3.13
+        from backports import zstd  # type: ignore[no-redef]
+
+    def add(dst: tarfile.TarFile, name: str, body: bytes) -> None:
+        info = tarfile.TarInfo(name)
+        info.size = len(body)
+        dst.addfile(info, io.BytesIO(body))
+
+    src = tarfile.open(fileobj=io.BytesIO(zstd.decompress(original)))
+    out = io.BytesIO()
+    with tarfile.open(fileobj=out, mode="w", format=tarfile.PAX_FORMAT) as dst:
+        for member in src.getmembers():
+            if member.name == "manifest.json":
+                continue
+            dst.addfile(member, src.extractfile(member) if member.isreg() else None)
+        if case == "extra-member":
+            add(dst, "planted.txt", b"bytes no signature covers\n")
+        else:
+            add(dst, "manifest.json", b'{"planted.txt": "bytes no signature covers"}\n')
+    return zstd.compress(out.getvalue())
+
+
+def _unpack_spy(monkeypatch: pytest.MonkeyPatch) -> list[str]:
+    """Every layer file the local install handed to `unpack_tar_zst`."""
+    import chtypes._ocifetch._ensure as ensure_mod
+
+    calls: list[str] = []
+    real = ensure_mod.unpack_tar_zst
+
+    def spy(path: str, *args: object, **kwargs: object) -> None:
+        calls.append(path)
+        real(path, *args, **kwargs)  # type: ignore[arg-type]
+
+    monkeypatch.setattr(ensure_mod, "unpack_tar_zst", spy)
+    return calls
+
+
+def _assert_nothing_installed(cache: Path, manifest: str) -> None:
+    leaked = [*cache.rglob("planted.txt"), *(cache / "unpacked").rglob("manifest.json")]
+    assert leaked == [], f"bytes outside the signature were installed: {leaked}"
+    assert not (cache / "unpacked" / "sha256" / manifest.removeprefix("sha256:")).exists()
+
+
+@pytest.mark.parametrize("case", ["extra-member", "manifest-json"])
+def test_preseeded_layer_swapped_under_its_signed_name_installs_nothing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, case: str
+) -> None:
+    """The layer blob FILE under its signed digest name is replaced by a
+    different valid tar.zst carrying the same library bytes. The library
+    re-hash alone passes on those bytes; the layer descriptor check (size
+    and sha256) refuses them BEFORE any unpack. The lookup installs nothing
+    and is a miss."""
+    cache, digests = _seed_clones(tmp_path, 1)
+    layer = cache / "blobs" / "sha256" / BUILD_LAYER_HEX
+    layer.write_bytes(_tamper_layer(layer.read_bytes(), case))
+    assert hashlib.sha256(layer.read_bytes()).hexdigest() != BUILD_LAYER_HEX
+    unpacked = _unpack_spy(monkeypatch)
+    result = resolve_installed(Request("26.1"), "linux-arm64", _options(cache, "test-key"))
+    _assert_nothing_installed(cache, digests[0])
+    assert unpacked == [], f"{case}: the unverified layer reached unpack"
+    assert result is None
+
+
+def test_preseeded_manifest_swapped_under_its_digest_name_installs_nothing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The manifest blob FILE under its index digest is replaced by other
+    bytes naming the same signed layer: the manifest no longer hashes to the
+    digest the signature names, and the lookup installs nothing."""
+    cache, digests = _seed_clones(tmp_path, 1)
+    path = cache / "blobs" / "sha256" / digests[0].removeprefix("sha256:")
+    manifest = json.loads(path.read_bytes())
+    manifest["annotations"] = {"test.swapped": "1"}
+    path.write_bytes(json.dumps(manifest).encode())
+    unpacked = _unpack_spy(monkeypatch)
+    assert resolve_installed(Request("26.1"), "linux-arm64", _options(cache, "test-key")) is None
+    assert unpacked == []
+    _assert_nothing_installed(cache, digests[0])
+
+
+def test_preseeded_manifest_size_disagreeing_with_index_installs_nothing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The index descriptor's size disagrees with the manifest blob's: the
+    manifest is checked against its whole descriptor, as a download is."""
+    cache, digests = _seed_clones(tmp_path, 1)
+    index = json.loads((cache / "index.json").read_text())
+    index["manifests"][0]["size"] += 1
+    (cache / "index.json").write_text(json.dumps(index))
+    unpacked = _unpack_spy(monkeypatch)
+    assert resolve_installed(Request("26.1"), "linux-arm64", _options(cache, "test-key")) is None
+    assert unpacked == []
+    _assert_nothing_installed(cache, digests[0])
+
+
+def test_preseeded_untouched_layout_still_installs(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The control for the cases above: the same layout, untouched, reaches
+    unpack once, installs and answers."""
+    cache, digests = _seed_clones(tmp_path, 1)
+    unpacked = _unpack_spy(monkeypatch)
+    assert (
+        resolve_installed(Request("26.1"), "linux-arm64", _options(cache, "test-key")) is not None
+    )
+    assert len(unpacked) == 1
+    assert (cache / "unpacked" / "sha256" / digests[0].removeprefix("sha256:")).is_dir()

{chtypes-2.0.0.dev12 → chtypes-2.0.0.dev14}/uv.lock

@@ -74,7 +74,7 @@ wheels = [
 
 [[package]]
 name = "chtypes"
-version = "2.0.0.dev12"
+version = "2.0.0.dev14"
 source = { editable = "." }
 dependencies = [
     { name = "backports-zstd", marker = "python_full_version < '3.14'" },