code-sandboxes 1.9.20__tar.gz → 1.9.22__tar.gz

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.20
+Version: 1.9.22
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.20"
+__version__ = "1.9.22"

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/code_sandboxes/environments/adapters/daytona.py

@@ -90,7 +90,7 @@ from __future__ import annotations
 import shlex
 import tempfile
 import uuid
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from pathlib import Path
 from typing import Any
 
@@ -100,6 +100,7 @@ from ..builders import (
     ArtifactReference,
     BuildRequest,
     CapabilityFinding,
+    ValidationResult,
 )
 from ..contract import SANDBOX_CONTRACT_V1
 from ..errors import (
@@ -567,6 +568,89 @@ class Builder(ManagedBuilder):
             raise self._provider_error("ask whether the snapshot exists", error) from error
         return True
 
+    def smoke_test(
+        self,
+        artifact: ArtifactReference,
+        *,
+        environment: Any = None,
+        lock_text: str | None = None,
+        secret_values: Sequence[str] = (),
+    ) -> ValidationResult:
+        """Launch the snapshot and run Appendix B's core tier in it (E2-04).
+
+        This box's own `Done when` asks for exactly this — "a sandbox launched
+        from its id passes the core tier" — and until 2026-09-17 it refused
+        through `ManagedBuilder`, so **no Daytona build could reach
+        `succeeded`**: the workflow calls this step, the snapshot was built and
+        live at the provider, and the build was recorded failed.
+
+        **Launched by id, never by name** (E0-04): a Daytona sandbox record
+        keeps the snapshot's *name*, and a name is republished, so only the id
+        says which artifact actually ran.
+
+        **Restarted by stopping and starting the sandbox**, not the kernel
+        (E0-04 again): Daytona's own daemon is PID 1 here, so there is no
+        kernel to restart, and check 8 means the thing that survives a real
+        restart.
+
+        The sandbox is deleted whether the tier passed or not — a smoke test
+        that leaves a sandbox running bills the owner for a check.
+        """
+        if environment is None:
+            raise EnvironmentsError(
+                CAPABILITY_UNSUPPORTED,
+                "A Daytona smoke test needs the version's spec: the core tier "
+                "asks for the Python version it declared and the packages its "
+                "lock pinned, and an artifact carries neither",
+                detail={"variant": self.variant},
+            )
+        from ..conformance import expected_packages, run_core_tier
+
+        snapshot = artifact.provider_artifact_id or artifact.immutable_reference
+        sandbox = self._smoke_test_sandbox(snapshot)
+        self._log(f"Launching {snapshot} to smoke-test it")
+        try:
+            sandbox.start()
+            return run_core_tier(
+                sandbox,
+                python_version=environment.spec.language.version,
+                expected_packages=expected_packages(environment, lock_text or ""),
+                secret_values=tuple(secret_values),
+                restart=lambda: self._restart(sandbox),
+            )
+        except EnvironmentsError:
+            raise
+        except Exception as error:
+            raise self._provider_error("smoke-test the snapshot", error) from error
+        finally:
+            try:
+                sandbox.stop()
+            except Exception as error:
+                self._log(f"The smoke-test sandbox could not be stopped: {error}")
+
+    def _smoke_test_sandbox(self, snapshot: str) -> Any:
+        """A sandbox of this build's own snapshot, deleted when it stops."""
+        from ...daytona_sandbox import DaytonaSandbox
+
+        secrets = self._provider_secrets()
+        return DaytonaSandbox(
+            api_key=secrets.get("DAYTONA_API_KEY"),
+            organization_id=secrets.get("DAYTONA_ORGANIZATION_ID"),
+            snapshot=snapshot,
+            delete_on_stop=True,
+        )
+
+    @staticmethod
+    def _restart(sandbox: Any) -> None:
+        """Check 8's restart, as Daytona can do it.
+
+        Its daemon is PID 1, so there is no kernel to restart: the sandbox
+        itself is stopped and started, which is the stronger version of the
+        same question.
+        """
+        sandbox.stop()
+        sandbox.start()
+
     def _provider_error(self, what: str, error: BaseException) -> EnvironmentsError:
         return EnvironmentsError(
             PROVIDER_ERROR,

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/code_sandboxes/environments/adapters/managed.py

@@ -24,6 +24,7 @@ An SDK imported at module scope would turn `validate` into a 500.
 
 from __future__ import annotations
 
+from collections.abc import Sequence
 from typing import Any, Callable
 
 from ..builders import (
@@ -261,7 +262,23 @@ class ManagedBuilder:
     def inspect(self, artifact: ArtifactReference) -> ArtifactMetadata:
         raise self._not_built("inspect an artifact")
 
-    def smoke_test(self, artifact: ArtifactReference) -> ValidationResult:
+    def smoke_test(
+        self,
+        artifact: ArtifactReference,
+        *,
+        environment: Any = None,
+        lock_text: str | None = None,
+        secret_values: Sequence[str] = (),
+    ) -> ValidationResult:
+        """Launch the artifact and run Appendix B's core tier in it (E2-03/04/05).
+
+        `environment` and `lock_text` are what the core tier needs and an
+        artifact does not carry: the Python version the spec asks for and the
+        packages its lock pins. The caller has both — it read them to build —
+        and passes them rather than making every adapter fetch them again.
+        They are keyword-only and optional so a caller that has neither still
+        type-checks, and an adapter that needs them says so itself.
+        """
         raise self._not_built("smoke-test an artifact")
 
     def resolve(self, version_ref: str) -> ArtifactReference:

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/code_sandboxes/environments/attest.py

@@ -675,14 +675,43 @@ def attest_artifact(
     answers the mapping the workflow stores: the scan's decision, the
     signature, the SBOM and provenance references, and the size.
     """
+    variant = str(getattr(artifact, "variant", "") or "")
     reference = str(getattr(artifact, "immutable_reference", "") or "")
+    if variant and variant != "datalayer":
+        # D-11 is about the Datalayer artifact: it lives in this platform's
+        # registry, the scanner reads it there, cosign signs that digest, and
+        # the Operator refuses to start what is unsigned. A managed artifact
+        # is none of those things — it lives in the owner's own provider
+        # account (D-8) and is referenced the way that provider names it: a
+        # Daytona snapshot uuid, an E2B build id, a Modal `im-…`. There is no
+        # digest in a repository to scan or sign, and no Operator starting it.
+        #
+        # Attesting one anyway is what the first real Daytona build did, and
+        # it failed *after* the snapshot was built — the work done, the
+        # artifact live at the provider, and the build recorded as failed
+        # (2026-09-17).
+        #
+        # Publishing is not weakened by this: E2-15's gate requires the
+        # **Datalayer** artifact to have passed its scan, and that one is
+        # still attested here.
+        if log:
+            log(f"{variant} artifacts are not attested: {reference} is not a digest in a registry")
+        return {
+            "scan_summary": {},
+            "sbom_ref": "",
+            "provenance_ref": "",
+            "signature_ref": "",
+            "size_bytes": size_bytes,
+            "signed_now": False,
+            "licenses": [],
+        }
     registry, _, rest = reference.partition("/")
     repository, _, digest = rest.partition("@")
     if not (registry and repository and _DIGEST.match(digest)):
         raise EnvironmentsError(
             PROVIDER_ERROR,
             f"`{reference}` is not a digest in a repository, so it cannot be attested",
-            detail={"reference": reference},
+            detail={"reference": reference, "variant": variant},
         )
     use = attestor or Attestor(
         key=str(getattr(credential, "signing_key", "") or ""),

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/code_sandboxes/environments/conformance.py

@@ -457,6 +457,36 @@ def _secrets(
     )
 
 
+def expected_packages(environment: Any, lock_text: str) -> dict[str, str]:
+    """Each top-level distribution the spec names, pinned to what its lock resolved.
+
+    What Appendix B check 5 is given. Never every package the lock pins — most
+    of a real lock is transitive, and check 5 tries to *import* each name it is
+    handed; a build tool or a C-library-only wheel that was never meant to be
+    imported directly would fail a check with nothing wrong to report. The
+    spec's own `packages.python.dependencies` is what a person declared
+    wanting, so it is what disagreeing across variants (E2-08) means something
+    about.
+
+    Here rather than in the durable worker, which had the only copy, so that a
+    builder running its own smoke test asks the same question of its own
+    artifact (E2-03/04/05).
+    """
+    from packaging.requirements import InvalidRequirement, Requirement
+    from packaging.utils import canonicalize_name
+
+    from .resolve import locked_versions
+
+    pinned = locked_versions(lock_text) if lock_text else {}
+    names: list[str] = []
+    for text in environment.spec.packages.python.dependencies:
+        try:
+            names.append(canonicalize_name(Requirement(text).name))
+        except InvalidRequirement:
+            continue
+    return {name: pinned[name] for name in names if name in pinned}
+
+
 def run_core_tier(
     sandbox: Sandbox,
     *,
@@ -551,9 +581,7 @@ def _gpu(sandbox: Sandbox, requested: bool, cuda: str | None, timeout: float | N
     # version its spec describes. A version that asked for none never
     # reaches here (the trivial pass above), so the extended tier still
     # gates nothing for a CPU version.
-    return _result(
-        11, not problems, gating=True, detail="; ".join(problems) or None, actual=answer
-    )
+    return _result(11, not problems, gating=True, detail="; ".join(problems) or None, actual=answer)
 
 
 def _throughput(

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/tests/test_environment_attest.py

@@ -19,12 +19,13 @@ from __future__ import annotations
 
 import json
 import subprocess
+from types import SimpleNamespace
 
 import pytest
 
 from code_sandboxes.environments.attest import Attestor, attest_artifact, licenses_of, signature_tag
 from code_sandboxes.environments.builders import ArtifactReference
-from code_sandboxes.environments.errors import EnvironmentsError
+from code_sandboxes.environments.errors import PROVIDER_ERROR, EnvironmentsError
 from code_sandboxes.environments.policy import (
     DEFAULT_POLICY,
     Finding,
@@ -613,27 +614,25 @@ class TestAttestingAnArtifact:
         assert cosign.argv == [], "a blocked artifact must not be signed"
 
     def test_a_reference_that_is_not_a_digest_cannot_be_attested(self) -> None:
-        artifact = ArtifactReference(
-            variant="modal",
-            immutable_reference="im-1234567890",
-            provider_artifact_id="im-1234567890",
-            contract_version="sandbox-contract/v1",
-        )
+        """A `datalayer` artifact must be a digest in this platform's registry.
+
+        `attest_artifact` takes `artifact: Any`, so nothing guarantees every
+        caller went through the model validator that would have refused this.
+        """
+        artifact = SimpleNamespace(variant="datalayer", immutable_reference="im-1234567890")
         with pytest.raises(EnvironmentsError) as raised:
             attest_artifact(artifact=artifact, attestor=an_attestor())
         assert raised.value.code.code == "DL_ENV_PROVIDER_ERROR"
 
     def test_a_malformed_digest_cannot_be_attested_either(self) -> None:
         """`sha256:bad` starts with `sha256:` too: only a whole one is
-        accepted (found on PR #27's Copilot review). `e2b` rather than
-        `datalayer`, whose own model validator already refuses a malformed
-        digest before this function ever sees it — `attest_artifact` takes
-        `artifact: Any`, so nothing guarantees every caller went through it."""
-        artifact = ArtifactReference(
-            variant="e2b",
+        accepted (found on PR #27's Copilot review). Asked of `datalayer`,
+        since that is the variant this check is for — `attest_artifact` takes
+        `artifact: Any`, so nothing guarantees every caller went through the
+        model validator that would have refused it."""
+        artifact = SimpleNamespace(
+            variant="datalayer",
             immutable_reference=f"{REGISTRY}/{REPOSITORY}@sha256:bad",
-            provider_artifact_id="sha256:bad",
-            contract_version="sandbox-contract/v1",
         )
         with pytest.raises(EnvironmentsError) as raised:
             attest_artifact(artifact=artifact, attestor=an_attestor())
@@ -749,3 +748,43 @@ class TestLicencesFromTheSbom:
         """Never a reason to fail a build: a licence list is worth having, not dying for."""
         for document in (None, {}, {"packages": None}, {"components": [1, 2]}, "spdx"):
             assert licenses_of(document) == []
+
+
+class TestWhatIsAttestedAndWhatIsNot:
+    """D-11 is about the Datalayer artifact, not every artifact.
+
+    It lives in this platform's registry: the scanner reads it there, cosign
+    signs that digest, and the Operator refuses to start what is unsigned. A
+    managed artifact is none of those things — it lives in the owner's own
+    provider account (D-8), named the way that provider names it.
+    """
+
+    def _artifact(self, variant: str, reference: str):
+        return SimpleNamespace(variant=variant, immutable_reference=reference)
+
+    def test_a_daytona_snapshot_is_not_attested(self) -> None:
+        """Its reference is a uuid, and attesting it anyway failed the first
+        real Daytona build *after* the snapshot was already built
+        (2026-09-17)."""
+        answer = attest_artifact(
+            artifact=self._artifact("daytona", "51d10ab0-d98d-4117-bdb5-918e98646c92"),
+            size_bytes=1234,
+        )
+        assert answer["scan_summary"] == {}
+        assert answer["signature_ref"] == ""
+        assert answer["signed_now"] is False
+        # What the provider told us is still recorded.
+        assert answer["size_bytes"] == 1234
+
+    def test_an_e2b_build_id_and_a_modal_image_id_are_not_either(self) -> None:
+        for variant, reference in (("e2b", "bld-123"), ("modal", "im-abc123")):
+            answer = attest_artifact(artifact=self._artifact(variant, reference))
+            assert answer["signed_now"] is False, variant
+            assert answer["scan_summary"] == {}, variant
+
+    def test_a_datalayer_artifact_that_is_not_a_digest_still_fails(self) -> None:
+        """The check that matters is kept where it means something."""
+        with pytest.raises(EnvironmentsError) as raised:
+            attest_artifact(artifact=self._artifact("datalayer", "not-a-digest"))
+        assert raised.value.code is PROVIDER_ERROR
+        assert "cannot be attested" in str(raised.value)

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/tests/test_environment_daytona_builder.py

@@ -833,3 +833,99 @@ class TestReadingTheRegistry:
         builder.build(a_request())
         builder.exists(an_artifact(provider_artifact_id="snp-999"))
         assert len(daytona.daytona_calls) == 1
+
+
+class TestSmokeTestingASnapshot:
+    """E2-04's own `Done when`: a sandbox launched from its id passes the core tier.
+
+    It refused through `ManagedBuilder` until 2026-09-17, and the build
+    workflow calls this step — so no Daytona build could reach `succeeded`:
+    the snapshot was built and live at the provider, and the build was
+    recorded failed.
+    """
+
+    def _environment(self):
+        return parse_environment(a_request().environment.model_dump(by_alias=True))
+
+    def test_it_launches_by_id_and_runs_the_core_tier(self, monkeypatch) -> None:
+        """A Daytona sandbox record keeps the snapshot's *name*, and a name is
+        republished, so only the id says which artifact ran (E0-04)."""
+        made: dict = {}
+        ran: dict = {}
+
+        class FakeSandbox:
+            def __init__(self, **kwargs):
+                made.update(kwargs)
+                self.events: list[str] = []
+
+            def start(self):
+                self.events.append("start")
+
+            def stop(self):
+                self.events.append("stop")
+
+        builder = a_builder()
+        monkeypatch.setattr(
+            "code_sandboxes.daytona_sandbox.DaytonaSandbox", FakeSandbox, raising=False
+        )
+        monkeypatch.setattr(
+            "code_sandboxes.environments.conformance.run_core_tier",
+            lambda sandbox, **kwargs: ran.update(kwargs) or "the-result",
+        )
+
+        answer = builder.smoke_test(
+            an_artifact(
+                variant="daytona",
+                immutable_reference="snap-1",
+                provider_artifact_id="snap-1",
+            ),
+            environment=self._environment(),
+            lock_text="",
+        )
+        assert answer == "the-result"
+        assert made["snapshot"] == "snap-1"
+        # A smoke test that leaves a sandbox running bills the owner for a check.
+        assert made["delete_on_stop"] is True
+        assert "restart" in ran and ran["python_version"]
+
+    def test_the_sandbox_is_deleted_even_when_the_tier_raises(self, monkeypatch) -> None:
+        events: list[str] = []
+
+        class FakeSandbox:
+            def __init__(self, **_kwargs):
+                pass
+
+            def start(self):
+                events.append("start")
+
+            def stop(self):
+                events.append("stop")
+
+        monkeypatch.setattr(
+            "code_sandboxes.daytona_sandbox.DaytonaSandbox", FakeSandbox, raising=False
+        )
+        monkeypatch.setattr(
+            "code_sandboxes.environments.conformance.run_core_tier",
+            lambda *_a, **_k: (_ for _ in ()).throw(RuntimeError("the tier blew up")),
+        )
+        with pytest.raises(EnvironmentsError):
+            a_builder().smoke_test(
+                an_artifact(
+                    variant="daytona", immutable_reference="snap-1", provider_artifact_id="snap-1"
+                ),
+                environment=self._environment(),
+                lock_text="",
+            )
+        assert events == ["start", "stop"]
+
+    def test_without_a_spec_it_says_what_it_needs(self) -> None:
+        """The core tier asks for the Python version and the pinned packages,
+        and an artifact carries neither."""
+        with pytest.raises(EnvironmentsError) as raised:
+            a_builder().smoke_test(
+                an_artifact(
+                    variant="daytona", immutable_reference="snap-1", provider_artifact_id="snap-1"
+                )
+            )
+        assert raised.value.code is CAPABILITY_UNSUPPORTED
+        assert "needs the version's spec" in str(raised.value)

{code_sandboxes-1.9.20 → code_sandboxes-1.9.22}/tests/test_environment_managed_builders.py

@@ -379,12 +379,13 @@ class TestTheHalfThatIsNotBuiltYet:
             assert raised.value.detail["operation"], f"e2b.{operation}"
 
     def test_daytona_still_refuses_what_e2_04_did_not_build(self) -> None:
-        """`build`/`inspect`/`exists` are E2-04's; `smoke_test`, `resolve` and
-        `delete` are not — see test_environment_daytona_builder.py for what
-        is built."""
+        """`build`, `inspect`, `exists` and now `smoke_test` are E2-04's —
+        the last of them because this box's own `Done when` asks for "a
+        sandbox launched from its id passes the core tier", and until it was
+        built no Daytona build could reach `succeeded`. `resolve` and `delete`
+        are still not built — see test_environment_daytona_builder.py."""
         builder = get_builder("daytona")
         calls = {
-            "smoke_test": lambda: builder.smoke_test(None),  # type: ignore[arg-type]
             "resolve": lambda: builder.resolve("geo@1"),
             "delete": lambda: builder.delete(None),  # type: ignore[arg-type]
         }