code-sandboxes 1.9.17__tar.gz → 1.9.18__tar.gz

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/CHANGELOG.md

@@ -8,6 +8,23 @@
 
 ## Unreleased
 
+## 1.9.18
+
+- **A lock no longer carries a wall clock, so the build cache can hit**
+  (`environments/resolve.py`, `resolve_conda.py`; PLAN_ENVS.md E1-26, D-12).
+  The lock's header carried a `# resolved-at:` line, and its digest is over
+  the whole text — so two resolves of the same spec, in the same base,
+  pinning the same 320 packages, produced two different digests. Found by
+  resolving one environment twice on r1 on 2026-09-16: the texts differed in
+  exactly that one line out of 5,388. Section 5's cache key is over the lock
+  digest, so D-12's build cache could never hit, and it never had:
+  `environments.cache.lookups` read `hit=false` twelve times out of twelve.
+  When a lock was resolved is on the lock document Runtimes stores, in its
+  `created_at`, which is where it belongs. `resolved_at` is gone from
+  `lock_document`, `conda_lock_document`, `resolve_environment` and
+  `resolve_conda_environment`; the two tests that asserted determinism by
+  freezing the clock now assert it without one.
+
 ## 1.9.17
 
 - **An artifact's size is read from the registry** (`environments/attest.py`;

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.17
+Version: 1.9.18
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.17"
+__version__ = "1.9.18"

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/code_sandboxes/environments/resolve.py

@@ -889,7 +889,6 @@ def lock_document(
     python_version: str,
     base_reference: str,
     merged: MergedRequirements,
-    resolved_at: datetime | None = None,
 ) -> dict[str, Any]:
     """The stored lock: its text, its digest, and what a reader needs from it.
 
@@ -897,11 +896,19 @@ def lock_document(
     output, so the document is still a requirements file — ``pip install -r``
     reads it, and so does every tool that only knows that format — while
     saying everything the build installs.
+
+    **Nothing here is a wall clock.** The header carried a ``# resolved-at:``
+    line until 2026-09-16, and since the digest is over the whole text, two
+    resolves of the same spec, in the same base, pinning the same 320 packages
+    produced two different digests — the texts differed in that one line out
+    of 5,388, found by resolving the same environment twice on r1. The cache
+    key of section 5 is over the lock digest, so D-12's build cache could
+    never hit: `environments.cache.lookups` read `hit=false` 12 times out of
+    12. When the lock was resolved is on the lock document Runtimes stores, in
+    its ``created_at``, where it belongs.
     """
-    when = (resolved_at or _utcnow()).replace(microsecond=0).isoformat()
     header = [
         "# Resolved by Datalayer (PLAN_ENV.md D-9). Do not edit: a change makes a new version.",
-        f"# resolved-at: {when}",
         f"# python: {python_version}",
         f"# base: {base_reference}",
     ]
@@ -1163,7 +1170,6 @@ def resolve_environment(
     runner: ResolveRunner | None = None,
     conda_runner: CondaResolveRunner | None = None,
     bases: dict[str, ApprovedBase] = APPROVED_BASES,
-    resolved_at: datetime | None = None,
     uv: str | None = None,
     pyproject_run: Callable[..., subprocess.CompletedProcess[str]] | None = None,
     image_transport: Any = None,
@@ -1198,8 +1204,6 @@ def resolve_environment(
     bases
         The approved bases, injected by tests and by a plane whose channel is
         published somewhere else.
-    resolved_at
-        The moment the lock records. Now by default.
     uv, pyproject_run
         A `pyproject` `dependencyFile` source's own verification (E3-01):
         the `uv` to check and export with, and how it is run — injected by
@@ -1274,7 +1278,6 @@ def resolve_environment(
                 credential=credential,
                 log=say,
                 runner=conda_runner,
-                resolved_at=resolved_at,
             )
         if dependency_file.source_format == "pyproject":
             # Verified, not re-resolved (E3-01): the author's own uv.lock is
@@ -1321,7 +1324,6 @@ def resolve_environment(
         python_version=environment.spec.language.version,
         base_reference=solving_in,
         merged=merged,
-        resolved_at=resolved_at,
     )
     say(
         f"Locked {document['package_count']} packages"

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/code_sandboxes/environments/resolve_conda.py

@@ -644,24 +644,28 @@ class BuildkitCondaResolveRunner:
         carries the whole of what the solve resolved, not the conda layer alone.
         """
         micromamba = shlex.quote(MICROMAMBA_BINARY)
-        return "\n".join(
-            [
-                f"FROM {request.base_reference} AS solve",
-                "USER root",
-                "WORKDIR /solve",
-                micromamba_bootstrap_dockerfile_line(),
-                "COPY environment.yml ./environment.yml",
-                "ENV PIP_FIND_LINKS=" + shlex.quote(WHEELHOUSE_IMAGE_PATH),
-                "RUN --mount=type=cache,target=/opt/conda/pkgs "
-                f"{micromamba} create --yes --prefix /solve/prefix "
-                f"--platform {shlex.quote(request.platform)} --file environment.yml",
-                f"RUN {micromamba} env export --explicit --prefix /solve/prefix > /solve/lock.txt",
-                f"RUN {micromamba} env export --prefix /solve/prefix > /solve/pip-env.yml",
-                "FROM scratch",
-                "COPY --from=solve /solve/lock.txt /lock.txt",
-                "COPY --from=solve /solve/pip-env.yml /pip-env.yml",
-            ]
-        ) + "\n"
+        return (
+            "\n".join(
+                [
+                    f"FROM {request.base_reference} AS solve",
+                    "USER root",
+                    "WORKDIR /solve",
+                    micromamba_bootstrap_dockerfile_line(),
+                    "COPY environment.yml ./environment.yml",
+                    "ENV PIP_FIND_LINKS=" + shlex.quote(WHEELHOUSE_IMAGE_PATH),
+                    "RUN --mount=type=cache,target=/opt/conda/pkgs "
+                    f"{micromamba} create --yes --prefix /solve/prefix "
+                    f"--platform {shlex.quote(request.platform)} --file environment.yml",
+                    f"RUN {micromamba} env export --explicit "
+                    "--prefix /solve/prefix > /solve/lock.txt",
+                    f"RUN {micromamba} env export --prefix /solve/prefix > /solve/pip-env.yml",
+                    "FROM scratch",
+                    "COPY --from=solve /solve/lock.txt /lock.txt",
+                    "COPY --from=solve /solve/pip-env.yml /pip-env.yml",
+                ]
+            )
+            + "\n"
+        )
 
     def solve(
         self, request: CondaResolveRequest, log: Callable[[str], None] | None = None
@@ -800,7 +804,6 @@ def conda_lock_document(
     base_reference: str,
     merged: MergedRequirements,
     platform: str = CONDA_PLATFORM,
-    resolved_at: datetime | None = None,
 ) -> dict[str, Any]:
     """The stored conda lock: its text, its digest, and what a reader needs.
 
@@ -814,10 +817,8 @@ def conda_lock_document(
     could read the prefix back, and the merged requirements otherwise, so it is
     always complete rather than the protected pins alone.
     """
-    when = (resolved_at or _utcnow()).replace(microsecond=0).isoformat()
     header = [
         "# Resolved by Datalayer (PLAN_ENV.md D-9). Do not edit: a change makes a new version.",
-        f"# resolved-at: {when}",
         f"# python: {python_version}",
         f"# platform: {platform}",
         f"# base: {base_reference}",
@@ -854,7 +855,6 @@ def resolve_conda_environment(
     credential: Any = None,
     log: Callable[[str], None] | None = None,
     runner: CondaResolveRunner | None = None,
-    resolved_at: datetime | None = None,
 ) -> dict[str, Any]:
     """A conda version's lock, from its ``environment.yml`` (E3-02).
 
@@ -892,7 +892,6 @@ def resolve_conda_environment(
         base_reference=solving_in,
         merged=merged,
         platform=platform,
-        resolved_at=resolved_at,
     )
     say(f"Locked {document['package_count']} conda packages as {document['digest']}")
     return {**document, "resolved_bases": dict(resolved_bases)}

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/tests/test_environment_resolve.py

@@ -13,7 +13,6 @@ paraphrase of them that cannot go out of date.
 from __future__ import annotations
 
 import subprocess
-from datetime import datetime, timezone
 
 import httpx
 import pytest
@@ -266,7 +265,6 @@ class TestTheLock:
             python_version="3.13",
             base_reference="environments/base/python-cpu@sha256:" + "11" * 32,
             merged=merge_requirements(["geopandas==1.1.1"]),
-            resolved_at=datetime(2026, 9, 12, 8, 30, tzinfo=timezone.utc),
         )
         assert document["format"] == LOCK_FORMAT
         assert document["digest"].startswith("sha256:")
@@ -275,7 +273,6 @@ class TestTheLock:
         content = document["content"]
         assert f"{APT_PIN_PREFIX}gdal-bin=3.8.4+dfsg-3build2" in content
         assert "# datalayer-protected: ipykernel==7.3.0" in content
-        assert "# resolved-at: 2026-09-12T08:30:00+00:00" in content
         # The snapshot the pins came from, which the builder installs from.
         from code_sandboxes.environments.resolve import apt_pins_in, apt_snapshot_in
 
@@ -289,15 +286,24 @@ class TestTheLock:
         }
 
     def test_the_same_lock_digests_the_same_and_a_changed_one_does_not(self) -> None:
+        """And nothing here may pin a clock to make it true.
+
+        The header carried a `# resolved-at:` line until 2026-09-16, and this
+        test passed only because it froze the moment. Resolving the same spec
+        twice on r1 produced two digests differing in that one line out of
+        5,388, and section 5's cache key is over the lock digest — so D-12's
+        build cache had never hit, 12 lookups out of 12.
+        """
         arguments = {
             "python_version": "3.13",
             "base_reference": "environments/base/python-cpu@sha256:" + "11" * 32,
             "merged": MergedRequirements((), (), ()),
-            "resolved_at": datetime(2026, 9, 12, tzinfo=timezone.utc),
         }
         first = lock_document(A_LOCK, **arguments)
         again = lock_document(A_LOCK, **arguments)
         assert first["digest"] == again["digest"]
+        assert first["content"] == again["content"]
+        assert "resolved-at" not in first["content"]
         moved = lock_document(
             ResolveOutcome(lock_text=A_LOCK.lock_text.replace("1.1.1", "1.1.2")), **arguments
         )

{code_sandboxes-1.9.17 → code_sandboxes-1.9.18}/tests/test_environment_resolve_conda.py

@@ -12,7 +12,6 @@ tested against the solver's own words rather than a paraphrase of them.
 from __future__ import annotations
 
 import subprocess
-from datetime import datetime, timezone
 
 import pytest
 
@@ -192,8 +191,7 @@ class TestParsingTheEnvironmentYml:
 
     def test_a_plain_channel_url_without_a_credential_is_kept(self) -> None:
         env = parse_conda_environment(
-            "channels:\n  - https://conda.anaconda.org/conda-forge\n"
-            "dependencies:\n  - gdal\n"
+            "channels:\n  - https://conda.anaconda.org/conda-forge\n" "dependencies:\n  - gdal\n"
         )
         assert env.channels == ("https://conda.anaconda.org/conda-forge",)
 
@@ -235,17 +233,13 @@ class TestMergingThePipLayer:
         assert {"shapely", "ipykernel", "jupyter-server"} <= names
 
     def test_a_pip_requirement_contradicting_a_pin_is_refused(self) -> None:
-        env = parse_conda_environment(
-            "dependencies:\n  - pip:\n    - ipykernel==6.0.0\n"
-        )
+        env = parse_conda_environment("dependencies:\n  - pip:\n    - ipykernel==6.0.0\n")
         with pytest.raises(EnvironmentsError) as caught:
             merge_conda_pip(env)
         assert caught.value.code.code == "DL_ENV_PROTECTED_PACKAGE"
 
     def test_the_interpreter_is_pinned_and_never_doubled(self) -> None:
-        env = parse_conda_environment(
-            "dependencies:\n  - python=3.11\n  - gdal=3.9\n"
-        )
+        env = parse_conda_environment("dependencies:\n  - python=3.11\n  - gdal=3.9\n")
         merged = merge_conda_pip(env)
         rendered = rendered_environment(env, merged, python_version="3.13")
         assert rendered.count("python=3.13") == 1
@@ -291,13 +285,11 @@ class TestTheLock:
     def test_the_document_records_the_pins_and_is_deterministic(self) -> None:
         env = parse_conda_environment(A_YAML)
         merged = merge_conda_pip(env)
-        at = datetime(2026, 9, 14, tzinfo=timezone.utc)
         document = conda_lock_document(
             CondaResolveOutcome(lock_text=EXPLICIT_LOCK),
             python_version="3.13",
             base_reference="registry/base@sha256:" + "11" * 32,
             merged=merged,
-            resolved_at=at,
         )
         assert document["format"] == CONDA_LOCK_FORMAT
         assert document["package_count"] == 2
@@ -311,9 +303,13 @@ class TestTheLock:
             python_version="3.13",
             base_reference="registry/base@sha256:" + "11" * 32,
             merged=merged,
-            resolved_at=at,
         )
+        # Deterministic without anybody pinning a clock: the header carried a
+        # `# resolved-at:` line until 2026-09-16, which made two resolves of
+        # one spec two different digests and kept D-12's cache from ever
+        # hitting.
         assert document["digest"] == again["digest"]
+        assert "resolved-at" not in document["content"]
 
     def test_an_export_without_the_marker_is_a_provider_error(self) -> None:
         env = parse_conda_environment(A_YAML)
@@ -353,9 +349,7 @@ class TestTheRunners:
                 return subprocess.CompletedProcess(argv, 0, stdout="", stderr="")
             raise subprocess.TimeoutExpired(argv, 5.0)
 
-        monkeypatch.setattr(
-            "code_sandboxes.environments.resolve_conda.subprocess.run", fake_run
-        )
+        monkeypatch.setattr("code_sandboxes.environments.resolve_conda.subprocess.run", fake_run)
         with pytest.raises(EnvironmentsError) as caught:
             runner.solve(CondaResolveRequest(environment_yml=A_YAML, python_version="3.13"))
         assert caught.value.code.code == "DL_ENV_PROVIDER_ERROR"