code-sandboxes 1.9.14__tar.gz → 1.9.18__tar.gz

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/CHANGELOG.md

@@ -8,6 +8,68 @@
 
 ## Unreleased
 
+## 1.9.18
+
+- **A lock no longer carries a wall clock, so the build cache can hit**
+  (`environments/resolve.py`, `resolve_conda.py`; PLAN_ENVS.md E1-26, D-12).
+  The lock's header carried a `# resolved-at:` line, and its digest is over
+  the whole text — so two resolves of the same spec, in the same base,
+  pinning the same 320 packages, produced two different digests. Found by
+  resolving one environment twice on r1 on 2026-09-16: the texts differed in
+  exactly that one line out of 5,388. Section 5's cache key is over the lock
+  digest, so D-12's build cache could never hit, and it never had:
+  `environments.cache.lookups` read `hit=false` twelve times out of twelve.
+  When a lock was resolved is on the lock document Runtimes stores, in its
+  `created_at`, which is where it belongs. `resolved_at` is gone from
+  `lock_document`, `conda_lock_document`, `resolve_environment` and
+  `resolve_conda_environment`; the two tests that asserted determinism by
+  freezing the clock now assert it without one.
+
+## 1.9.17
+
+- **An artifact's size is read from the registry** (`environments/attest.py`;
+  PLAN_ENVS.md E1-25). `attest_artifact` took `size_bytes` from its caller and
+  nobody ever passed one — the builder answers a reference, not a weight — so
+  every artefact was recorded with `sizeBytes: null` and
+  `environments.artifact.bytes`, the series section 14 tracks the artifact
+  size in, had no point in it although artifacts had been recorded (seen on r1,
+  2026-09-16, through the OTEL query API). `Attestor.size_of()` asks the
+  registry, with the client the scan is already read from, and a size that
+  cannot be read is logged rather than raised: a missing number on a dashboard
+  is not a reason to refuse an artifact that is otherwise signed. 3 new tests.
+
+## 1.9.15
+
+- **A restart restarts the kernel, not just this client's socket**
+  (`jupyter_server_sandbox`, `client`; PLAN_ENV.md E0-09, Appendix B check
+  7). `CodeSandboxClient.restart()` was `stop()` then `start()`, which is
+  right for a sandbox this process owns — it is destroyed and recreated, and
+  nothing survives — and wrong for one *attached* to a Jupyter server
+  somebody else runs, which is every Datalayer runtime pod: stopping drops
+  the websocket while the kernel process keeps running, so the reconnect
+  lands in the same interpreter with every global still set. Check 7 is
+  "nothing is assumed to persist across restarts", and it read `state survived the restart ('True')` for exactly this reason — found live on r1,
+  2026-09-16, the first drill whose smoke test reached the check.
+  `JupyterServerSandbox.restart_kernel()` now asks the server's own
+  `POST /api/kernels/{id}/restart` (the way `_do_interrupt` already uses the
+  API rather than the client's lifecycle) and reconnects onto the new
+  kernel; `restart()` prefers it and falls back to the lifecycle for every
+  variant that draws no such distinction. 7 new tests.
+- **`datalayer/python-cpu:2026.09` repinned** to
+  `sha256:122d3e31f5e2507251457cbf47871c39ac1753adb1d83777ab0743fa11cd6148`:
+  the contract layer now sets `MappingKernelManager.root_dir`, so kernels
+  start in `/home/datalayer/content`. The image already declared `WORKDIR`
+  there and `sandbox-contract/v1`'s User row already required it, but a
+  kernel's cwd is the Jupyter server's to choose and jupyter-python's config
+  roots it at `$HOME` — so every environment's kernel ran in
+  `/home/datalayer` and Appendix B check 2 read `cwd is '/home/datalayer', not '/home/datalayer/content'`. The file browser stays rooted at `$HOME`,
+  where a person expects to see everything they have; only the kernel moves.
+- Two assertions that had rotted through three base releases are pinned in
+  one place again: the channel's digest and its apt snapshot were duplicated
+  across `test_environment_bases.py` and `test_environment_resolve.py`, and
+  2026-09-15's and 2026-09-16's releases left both red rather than catching
+  anything.
+
 ## 1.9.14
 
 - **`datalayer/python-cpu:2026.09` base channel repinned** to the rebuilt

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.14
+Version: 1.9.18
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.14"
+__version__ = "1.9.18"

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/client.py

@@ -508,7 +508,21 @@ class CodeSandboxClient:
         return self.is_started
 
     def restart(self) -> None:
-        """Restart the wrapped sandbox through its public lifecycle."""
+        """Restart the wrapped sandbox, clearing what it was holding.
+
+        A sandbox this process owns is restarted by its own lifecycle: stop
+        and start destroy and recreate it, and nothing survives. One that is
+        merely *attached* to a server somebody else runs — a Jupyter server
+        in a Datalayer runtime pod — is not: stopping drops this client's
+        websocket while the kernel process goes on running, and starting
+        reconnects to the same interpreter with every global still set. A
+        sandbox that knows how to restart what it is attached to says so with
+        `restart_kernel`, and that is used in preference; the lifecycle is
+        the fallback for every variant that has no such distinction.
+        """
+        restart_kernel = getattr(self._sandbox, "restart_kernel", None)
+        if callable(restart_kernel) and restart_kernel():
+            return
         self._sandbox.stop()
         self._sandbox.start()
 

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/environments/attest.py

@@ -536,10 +536,35 @@ class Attestor:
             signature_ref=signature,
             sbom_ref=sbom_ref or f"{registry}/{repository}@{digest}.sbom",
             provenance_ref=provenance_ref or f"{registry}/{repository}@{digest}.att",
-            size_bytes=size_bytes,
+            size_bytes=size_bytes
+            if size_bytes is not None
+            else self.size_of(repository=repository, digest=digest),
             signed_now=signed_now,
         )
 
+    def size_of(self, *, repository: str, digest: str) -> int | None:
+        """What the registry says the artifact weighs, or None.
+
+        Nobody hands the size down: the builder answers a reference, not a
+        weight, so until this asked the registry `size_bytes` was always None
+        — and with it `environments.artifact.bytes`, the series section 14
+        tracks the artifact size in, which had no point in it on 2026-09-16
+        although artifacts had been recorded. The registry has known all
+        along; the scan is read from the same client.
+
+        Never a reason to fail an attestation: a size that could not be read
+        is a missing number on a dashboard, and the artifact is still signed.
+        """
+        try:
+            images = self._client().describe_images(
+                repositoryName=repository, imageIds=[{"imageDigest": digest}]
+            )["imageDetails"]
+        except Exception as error:
+            self._log(f"The artifact's size could not be read: {error}")
+            return None
+        size = (images[0] or {}).get("imageSizeInBytes") if images else None
+        return int(size) if size else None
+
     def _client(self) -> Any:
         if self._ecr is None:
             try:

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/environments/bases.py

@@ -126,7 +126,16 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
                     # `.spec.VARIANTS`, spelled out: `spec` imports from this
                     # module, so importing it back here would be circular.
                     ("datalayer", "e2b", "daytona", "modal"),
-                    "sha256:aa5413000bb5b6ecd0a0cf03959b107f0d572f65bf230c08bbdf9a4569775545",
+                    # 2026-09-16: kernels now start in the contract's own
+                    # working directory. The image already declared `WORKDIR
+                    # /home/datalayer/content`, but a kernel's cwd is the
+                    # Jupyter server's to choose, and jupyter-python's config
+                    # roots it at `$HOME` — so every environment's kernel ran
+                    # in `/home/datalayer` and Appendix B check 2 read "cwd is
+                    # '/home/datalayer', not '/home/datalayer/content'". The
+                    # contract layer now sets `MappingKernelManager.root_dir`,
+                    # which moves the kernel without moving the file browser.
+                    "sha256:122d3e31f5e2507251457cbf47871c39ac1753adb1d83777ab0743fa11cd6148",
                 )
             },
             snapshots={"2026.09": "20260916T120000Z"},

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/environments/files.py

@@ -25,12 +25,15 @@ __all__ = ["build_entries", "files_step"]
 def build_entries(
     environment: Environment, *, source_of: Callable[[FileEntry], str] | None = None
 ) -> list[BuildEntry]:
-    """The spec's files as build entries.
+    """The spec's baked files as build entries: ``files`` then ``contentsBuild``.
 
-    ``source_of`` turns a ``contentRef`` into a URL the build can fetch —
-    a presigned URL for a ``blob://`` reference — and defaults to the
-    reference itself. A file without its sha256 is refused: the build
-    verifies every byte it bakes.
+    ``files`` a user uploaded (referenced by ``contentRef``) and
+    ``contentsBuild`` fetched from an external ``source`` are both baked the
+    same way, so they are the same kind of entry here. ``source_of`` turns a
+    ``contentRef`` into a URL the build can fetch — a presigned URL for a
+    ``blob://`` reference — and defaults to the reference itself; a
+    ``contentsBuild`` source is already a URL and is used as is. A file without
+    its sha256 is refused: the build verifies every byte it bakes.
     """
     entries: list[BuildEntry] = []
     for index, entry in enumerate(environment.spec.files):
@@ -48,6 +51,15 @@ def build_entries(
                 size_bytes=entry.size_bytes,
             )
         )
+    for built in environment.spec.contents_build:
+        entries.append(
+            BuildEntry(
+                source_uri=built.source,
+                destination_path=built.path,
+                sha256=built.sha256,
+                size_bytes=built.size_bytes,
+            )
+        )
     return entries
 
 
@@ -63,7 +75,7 @@ def files_step(
     """
     if variant not in VARIANTS:
         raise ValueError(f"{variant!r} is not a variant")
-    if not environment.spec.files:
+    if not environment.spec.files and not environment.spec.contents_build:
         return []
     build = EnvironmentBuild(
         environment=environment.metadata.name,

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/environments/resolve.py

@@ -889,7 +889,6 @@ def lock_document(
     python_version: str,
     base_reference: str,
     merged: MergedRequirements,
-    resolved_at: datetime | None = None,
 ) -> dict[str, Any]:
     """The stored lock: its text, its digest, and what a reader needs from it.
 
@@ -897,11 +896,19 @@ def lock_document(
     output, so the document is still a requirements file — ``pip install -r``
     reads it, and so does every tool that only knows that format — while
     saying everything the build installs.
+
+    **Nothing here is a wall clock.** The header carried a ``# resolved-at:``
+    line until 2026-09-16, and since the digest is over the whole text, two
+    resolves of the same spec, in the same base, pinning the same 320 packages
+    produced two different digests — the texts differed in that one line out
+    of 5,388, found by resolving the same environment twice on r1. The cache
+    key of section 5 is over the lock digest, so D-12's build cache could
+    never hit: `environments.cache.lookups` read `hit=false` 12 times out of
+    12. When the lock was resolved is on the lock document Runtimes stores, in
+    its ``created_at``, where it belongs.
     """
-    when = (resolved_at or _utcnow()).replace(microsecond=0).isoformat()
     header = [
         "# Resolved by Datalayer (PLAN_ENV.md D-9). Do not edit: a change makes a new version.",
-        f"# resolved-at: {when}",
         f"# python: {python_version}",
         f"# base: {base_reference}",
     ]
@@ -1163,7 +1170,6 @@ def resolve_environment(
     runner: ResolveRunner | None = None,
     conda_runner: CondaResolveRunner | None = None,
     bases: dict[str, ApprovedBase] = APPROVED_BASES,
-    resolved_at: datetime | None = None,
     uv: str | None = None,
     pyproject_run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
     image_transport: Any = None,
@@ -1198,8 +1204,6 @@ def resolve_environment(
     bases
         The approved bases, injected by tests and by a plane whose channel is
         published somewhere else.
-    resolved_at
-        The moment the lock records. Now by default.
     uv, pyproject_run
         A `pyproject` `dependencyFile` source's own verification (E3-01):
         the `uv` to check and export with, and how it is run — injected by
@@ -1274,7 +1278,6 @@ def resolve_environment(
                 credential=credential,
                 log=say,
                 runner=conda_runner,
-                resolved_at=resolved_at,
             )
         if dependency_file.source_format == "pyproject":
             # Verified, not re-resolved (E3-01): the author's own uv.lock is
@@ -1321,7 +1324,6 @@ def resolve_environment(
         python_version=environment.spec.language.version,
         base_reference=solving_in,
         merged=merged,
-        resolved_at=resolved_at,
     )
     say(
         f"Locked {document['package_count']} packages"

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/environments/resolve_conda.py

@@ -644,24 +644,28 @@ class BuildkitCondaResolveRunner:
         carries the whole of what the solve resolved, not the conda layer alone.
         """
         micromamba = shlex.quote(MICROMAMBA_BINARY)
-        return "\n".join(
-            [
-                f"FROM {request.base_reference} AS solve",
-                "USER root",
-                "WORKDIR /solve",
-                micromamba_bootstrap_dockerfile_line(),
-                "COPY environment.yml ./environment.yml",
-                "ENV PIP_FIND_LINKS=" + shlex.quote(WHEELHOUSE_IMAGE_PATH),
-                "RUN --mount=type=cache,target=/opt/conda/pkgs "
-                f"{micromamba} create --yes --prefix /solve/prefix "
-                f"--platform {shlex.quote(request.platform)} --file environment.yml",
-                f"RUN {micromamba} env export --explicit --prefix /solve/prefix > /solve/lock.txt",
-                f"RUN {micromamba} env export --prefix /solve/prefix > /solve/pip-env.yml",
-                "FROM scratch",
-                "COPY --from=solve /solve/lock.txt /lock.txt",
-                "COPY --from=solve /solve/pip-env.yml /pip-env.yml",
-            ]
-        ) + "\n"
+        return (
+            "\n".join(
+                [
+                    f"FROM {request.base_reference} AS solve",
+                    "USER root",
+                    "WORKDIR /solve",
+                    micromamba_bootstrap_dockerfile_line(),
+                    "COPY environment.yml ./environment.yml",
+                    "ENV PIP_FIND_LINKS=" + shlex.quote(WHEELHOUSE_IMAGE_PATH),
+                    "RUN --mount=type=cache,target=/opt/conda/pkgs "
+                    f"{micromamba} create --yes --prefix /solve/prefix "
+                    f"--platform {shlex.quote(request.platform)} --file environment.yml",
+                    f"RUN {micromamba} env export --explicit "
+                    "--prefix /solve/prefix > /solve/lock.txt",
+                    f"RUN {micromamba} env export --prefix /solve/prefix > /solve/pip-env.yml",
+                    "FROM scratch",
+                    "COPY --from=solve /solve/lock.txt /lock.txt",
+                    "COPY --from=solve /solve/pip-env.yml /pip-env.yml",
+                ]
+            )
+            + "\n"
+        )
 
     def solve(
         self, request: CondaResolveRequest, log: Callable[[str], None] | None = None
@@ -800,7 +804,6 @@ def conda_lock_document(
     base_reference: str,
     merged: MergedRequirements,
     platform: str = CONDA_PLATFORM,
-    resolved_at: datetime | None = None,
 ) -> dict[str, Any]:
     """The stored conda lock: its text, its digest, and what a reader needs.
 
@@ -814,10 +817,8 @@ def conda_lock_document(
     could read the prefix back, and the merged requirements otherwise, so it is
     always complete rather than the protected pins alone.
     """
-    when = (resolved_at or _utcnow()).replace(microsecond=0).isoformat()
     header = [
         "# Resolved by Datalayer (PLAN_ENV.md D-9). Do not edit: a change makes a new version.",
-        f"# resolved-at: {when}",
         f"# python: {python_version}",
         f"# platform: {platform}",
         f"# base: {base_reference}",
@@ -854,7 +855,6 @@ def resolve_conda_environment(
     credential: Any = None,
     log: Callable[[str], None] | None = None,
     runner: CondaResolveRunner | None = None,
-    resolved_at: datetime | None = None,
 ) -> dict[str, Any]:
     """A conda version's lock, from its ``environment.yml`` (E3-02).
 
@@ -892,7 +892,6 @@ def resolve_conda_environment(
         base_reference=solving_in,
         merged=merged,
         platform=platform,
-        resolved_at=resolved_at,
     )
     say(f"Locked {document['package_count']} conda packages as {document['digest']}")
     return {**document, "resolved_bases": dict(resolved_bases)}

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/environments/spec.py

@@ -259,6 +259,21 @@ class FileEntry(_Model):
     sha256: str | None = Field(default=None, pattern=r"^[0-9a-f]{64}$")
 
 
+class ContentsBuildEntry(_Model):
+    """One immutable file the Environment bakes from an external source.
+
+    Unlike ``files`` — which a user uploads, referenced by ``contentRef`` — a
+    ``contentsBuild`` entry names an external ``source`` URL fetched at build
+    time and verified against ``sha256`` (required: the build verifies every
+    byte it bakes). Both are baked the same way, into every provider artifact.
+    """
+
+    source: str
+    path: str
+    sha256: str = Field(pattern=r"^[0-9a-f]{64}$")
+    size_bytes: int | None = Field(default=None, ge=0)
+
+
 class Commands(_Model):
     post_install: list[str] = Field(default_factory=list)
 
@@ -365,6 +380,7 @@ class EnvironmentSpec(_Model):
     platform: Platform = Field(default_factory=Platform)
     packages: Packages = Field(default_factory=Packages)
     files: list[FileEntry] = Field(default_factory=list)
+    contents_build: list[ContentsBuildEntry] = Field(default_factory=list)
     env: dict[str, str] = Field(default_factory=dict)
     commands: Commands = Field(default_factory=Commands)
     build_secrets: list[BuildSecret] = Field(default_factory=list)

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/code_sandboxes/jupyter_server_sandbox.py

@@ -607,6 +607,58 @@ class JupyterServerSandbox(Sandbox):
             logger.warning(f"Failed to interrupt Jupyter kernel: {e}")
             return False
 
+    def restart_kernel(self) -> bool:
+        """Restart the kernel itself, through the server's own REST API.
+
+        Not `stop()` then `start()`: those are this *client's* lifecycle, and
+        when the server is somebody else's — a Datalayer runtime pod, which
+        is every attached sandbox — stopping the client only drops the
+        websocket. The kernel is a process on the server and keeps running,
+        so a reconnect lands back in the same interpreter with every global
+        still set.
+
+        That is what Appendix B check 7 ("nothing is assumed to persist
+        across restarts") measures, and it read `state survived the restart`
+        for exactly this reason — found live on r1, 2026-09-16, the first
+        drill whose smoke test reached the check. `POST
+        /api/kernels/{id}/restart` is the one that restarts the kernel, the
+        same way `_do_interrupt` already uses the API rather than the
+        client's own lifecycle.
+
+        Answers whether the server accepted it; never raises, so a caller
+        that cannot restart reports a failed check rather than an error.
+        """
+        if not self._server_url or not self._client:
+            return False
+        kernel_id = getattr(self._client, "id", None)
+        if not kernel_id:
+            return False
+        try:
+            response = requests.post(
+                f"{self._server_url}/api/kernels/{kernel_id}/restart",
+                params={"token": self._token},
+                headers=self._headers or None,
+                timeout=30,
+            )
+        except Exception as error:
+            # A restart that cannot even be asked for is a failed check, not
+            # an error to raise at the caller, exactly as `_do_interrupt` is.
+            logger.warning(f"Failed to restart Jupyter kernel: {error}")
+            return False
+        if not response.ok:
+            logger.warning(
+                "Failed to restart Jupyter kernel: the server answered %s", response.status_code
+            )
+            return False
+        # The websocket the client holds is to the kernel that has just been
+        # replaced; reconnecting is what makes the next execution land in the
+        # new interpreter rather than on a channel nobody is reading.
+        with contextlib.suppress(Exception):
+            self._client.stop()
+        with contextlib.suppress(Exception):
+            self._client.start()
+        return True
+
     @marks_execution
     def run_code(  # noqa: C901
         self,

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/schemas/environment-v1alpha1.json

@@ -152,6 +152,45 @@
       "title": "Compatibility",
       "type": "object"
     },
+    "ContentsBuildEntry": {
+      "additionalProperties": false,
+      "description": "One immutable file the Environment bakes from an external source.\n\nUnlike ``files`` \u2014 which a user uploads, referenced by ``contentRef`` \u2014 a\n``contentsBuild`` entry names an external ``source`` URL fetched at build\ntime and verified against ``sha256`` (required: the build verifies every\nbyte it bakes). Both are baked the same way, into every provider artifact.",
+      "properties": {
+        "path": {
+          "title": "Path",
+          "type": "string"
+        },
+        "sha256": {
+          "pattern": "^[0-9a-f]{64}$",
+          "title": "Sha256",
+          "type": "string"
+        },
+        "sizeBytes": {
+          "anyOf": [
+            {
+              "minimum": 0,
+              "type": "integer"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Sizebytes"
+        },
+        "source": {
+          "title": "Source",
+          "type": "string"
+        }
+      },
+      "required": [
+        "source",
+        "path",
+        "sha256"
+      ],
+      "title": "ContentsBuildEntry",
+      "type": "object"
+    },
     "DependencyFileSpec": {
       "additionalProperties": false,
       "description": "A `requirements.txt`, a `pyproject.toml` with its `uv.lock`, or a conda\n`environment.yml` (E3-01, E3-02).\n\n``requirements`` resolves the way ``packages`` does \u2014 the protected\nconstraints merged in, the same solve. ``pyproject`` does not resolve at\nall: its own ``uv.lock`` is verified against the current\n``pyproject.toml`` and exported, never re-solved, because a lock the\nauthor already made is the whole point of bringing one. ``conda`` resolves\nthe ``environment.yml`` in its own ``micromamba`` solve into an explicit\nlock, with the protected constraints merged over its ``pip:`` layer.",
@@ -202,6 +241,13 @@
         "compatibility": {
           "$ref": "#/$defs/Compatibility"
         },
+        "contentsBuild": {
+          "items": {
+            "$ref": "#/$defs/ContentsBuildEntry"
+          },
+          "title": "Contentsbuild",
+          "type": "array"
+        },
         "contract": {
           "default": "sandbox-contract/v1",
           "title": "Contract",

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/tests/test_client.py

@@ -157,6 +157,62 @@ def test_variables_interrupt_and_restart_delegate_to_sandbox():
     assert client.is_alive() is True
 
 
+class TestRestartingWhatIsActuallyHoldingTheState:
+    """A restart has to clear the interpreter, not just this client's socket.
+
+    Appendix B check 7 is "nothing is assumed to persist across restarts". A
+    sandbox this process owns is cleared by its own lifecycle; one attached
+    to somebody else's Jupyter server is not, because the kernel outlives
+    the websocket. Found live on r1, 2026-09-16: `state survived the
+    restart`.
+    """
+
+    def test_a_sandbox_that_can_restart_its_kernel_is_asked_to(self):
+        class _AttachedSandbox(_FakeSandbox):
+            def __init__(self):
+                super().__init__()
+                self.kernel_restarts = 0
+
+            def restart_kernel(self):
+                self.kernel_restarts += 1
+                return True
+
+        sandbox = _AttachedSandbox()
+        sandbox.start()
+        CodeSandboxClient(sandbox).restart()
+
+        assert sandbox.kernel_restarts == 1
+        # And the lifecycle was left alone: stopping it would have dropped a
+        # connection the restarted kernel is still reachable on.
+        assert sandbox.is_started is True
+
+    def test_a_kernel_restart_that_fails_falls_back_to_the_lifecycle(self):
+        class _RefusingSandbox(_FakeSandbox):
+            def __init__(self):
+                super().__init__()
+                self.stops = 0
+
+            def restart_kernel(self):
+                return False
+
+            def stop(self):
+                self.stops += 1
+                super().stop()
+
+        sandbox = _RefusingSandbox()
+        sandbox.start()
+        CodeSandboxClient(sandbox).restart()
+
+        assert sandbox.stops == 1, "a refused kernel restart still restarts the sandbox"
+        assert sandbox.is_started is True
+
+    def test_a_sandbox_with_no_kernel_of_its_own_restarts_as_it_always_did(self):
+        sandbox = _FakeSandbox()
+        sandbox.start()
+        CodeSandboxClient(sandbox).restart()
+        assert sandbox.is_started is True
+
+
 def test_a_sandbox_that_knows_it_is_gone_is_believed():
     """`is_alive` reports what the sandbox can find out, not the local start
     flag, so a backend that died under us is not reported as ready."""

{code_sandboxes-1.9.14 → code_sandboxes-1.9.18}/tests/test_environment_attest.py

@@ -80,7 +80,7 @@ def basic(identifier: str, severity: str, *, package: str = "openssl") -> dict:
 
 
 class FakeEcr:
-    """The two ECR calls the attestor makes, and nothing else."""
+    """The three ECR calls the attestor makes, and nothing else."""
 
     def __init__(
         self,
@@ -90,6 +90,7 @@ class FakeEcr:
         enhanced_findings=True,
         manifest: dict | None = None,
         pages: list[list[dict]] | None = None,
+        size_bytes: int | None = 2_147_483_648,
     ) -> None:
         self.statuses = list(statuses)
         self.findings = list(findings)
@@ -99,8 +100,12 @@ class FakeEcr:
         self.pages = pages
         self.enhanced_findings = enhanced_findings
         self.manifest = manifest
+        #: What `describe_images` answers for the digest; None makes it raise
+        #: `ImageNotFoundException`, the way a registry that lost it would.
+        self.size_bytes = size_bytes
         self.asked = 0
         self.scanned: list[str] = []
+        self.sized: list[str] = []
 
     def batch_get_image(self, repositoryName, imageIds, acceptedMediaTypes):  # noqa: N803 - boto3's spelling
         manifest = self.manifest or {
@@ -117,6 +122,14 @@ class FakeEcr:
             ]
         }
 
+    def describe_images(self, repositoryName, imageIds):  # noqa: N803 - boto3's spelling
+        self.sized.append(imageIds[0]["imageDigest"])
+        if self.size_bytes is None:
+            error = Exception("ImageNotFoundException")
+            error.response = {"Error": {"Code": "ImageNotFoundException"}}
+            raise error
+        return {"imageDetails": [{"imageSizeInBytes": self.size_bytes}]}
+
     def describe_image_scan_findings(self, repositoryName, imageId, nextToken=None):  # noqa: N803 - boto3's spelling
         self.asked += 1
         self.scanned.append(imageId["imageDigest"])
@@ -630,6 +643,33 @@ class TestAttestingAnArtifact:
         answer = attest_artifact(artifact=self.an_artifact(), attestor=an_attestor())
         assert answer["scan_summary"]["policy"] == DEFAULT_POLICY.body()
 
+    def test_the_size_is_read_from_the_registry_when_nobody_hands_one_down(self) -> None:
+        """Which is every real call: the builder answers a reference, not a
+        weight, so `environments.artifact.bytes` — section 14's artifact size
+        — had no point in it although artifacts had been recorded (E1-25)."""
+        ecr = FakeEcr(size_bytes=2_147_483_648)
+        answer = attest_artifact(artifact=self.an_artifact(), attestor=an_attestor(ecr=ecr))
+        assert answer["size_bytes"] == 2_147_483_648
+        assert ecr.sized == [DIGEST]
+
+    def test_a_size_handed_down_is_kept_and_the_registry_is_not_asked(self) -> None:
+        ecr = FakeEcr()
+        answer = attest_artifact(
+            artifact=self.an_artifact(), size_bytes=116_183_040, attestor=an_attestor(ecr=ecr)
+        )
+        assert answer["size_bytes"] == 116_183_040
+        assert ecr.sized == []
+
+    def test_a_size_that_cannot_be_read_is_not_a_reason_to_refuse(self) -> None:
+        """A missing number on a dashboard, against an artifact nothing can
+        launch: the artifact is signed and the attestation stands."""
+        said: list[str] = []
+        attestor = an_attestor(ecr=FakeEcr(size_bytes=None), log=said.append)
+        answer = attest_artifact(artifact=self.an_artifact(), attestor=attestor)
+        assert answer["size_bytes"] is None
+        assert answer["signature_ref"] == f"{REGISTRY}/{REPOSITORY}@{DIGEST}"
+        assert any("size could not be read" in line for line in said)
+
 
 def test_nothing_reaches_a_registry_when_nothing_could_sign() -> None:
     """The order that keeps a refusal cheap and honest (E1-08, E1-09).