code-sandboxes 1.9.2__tar.gz → 1.9.3__tar.gz

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/CHANGELOG.md

@@ -8,6 +8,17 @@
 
 ## Unreleased
 
+## 1.9.3
+
+- **A build secret is mounted only on the `postInstall` commands that name it**
+  (`environments.spec.command_names_secret`, `environments.adapters.datalayer`;
+  PLAN_ENV.md E3-05). Every declared secret used to be mounted on every
+  `postInstall` `RUN`. A command now gets a secret's mount only when the
+  secret's name is in it as a whole word (`$NAME`, `${NAME}`, `--key-env NAME`,
+  `/run/secrets/NAME`). A declared secret that no command names is a
+  `DL_ENV_SPEC_INVALID` finding on `spec.buildSecrets[i]`, rather than a build
+  that runs with it empty.
+
 ## 1.9.2
 
 - **A real ECR repository name is lowercase; a real owner uid is not**

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.2
+Version: 1.9.3
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

code_sandboxes-1.9.3/build.log

@@ -0,0 +1,5 @@
+* Creating isolated environment: venv+pip...
+* Installing packages in isolated environment:
+  - hatchling~=1.21
+* Getting build dependencies for sdist...
+* Building sdist...

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.2"
+__version__ = "1.9.3"

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/code_sandboxes/environments/adapters/datalayer.py

@@ -69,7 +69,7 @@ from ..errors import (
 )
 from ..files import files_step
 from ..resolve import WHEELHOUSE_IMAGE_PATH, WHEELHOUSE_PATH, apt_pins_in, locked_versions
-from ..spec import BuildSecret, Environment
+from ..spec import BuildSecret, Environment, command_names_secret
 
 __all__ = [
     "ECR_ENVIRONMENT_PREFIX",
@@ -347,15 +347,14 @@ class Builder:
                 "/opt/datalayer/lock.txt",
             ]
         )
-        # A build secret is mounted on the postInstall step and nowhere else
-        # (§4.1, D-11): never an `ARG` or `ENV`, which bakes a value into the
-        # image's history, and never the package-install or files steps,
-        # which no secret is declared for. `--mount=type=secret` is a
-        # BuildKit mount: the value is available to the one `RUN`'s shell and
-        # never written to a layer.
+        # A build secret is mounted on the postInstall commands that name it
+        # and nowhere else (§4.1, D-11): never an `ARG` or `ENV`, which bakes a
+        # value into the image's history, never the package-install or files
+        # steps, and never a postInstall command that does not read it.
+        # `--mount=type=secret` is a BuildKit mount: the value is available to
+        # the one `RUN`'s shell and never written to a layer.
         wanted = set(request.build_secret_ids)
         secrets = [secret for secret in spec.build_secrets if secret.id in wanted]
-        secret_mounts = " ".join(_secret_mount(secret) for secret in secrets)
         baked = files_step(request.environment, variant=self.variant)
         if baked:
             lines.append("USER 1000:100")
@@ -365,11 +364,15 @@ class Builder:
         if spec.commands.post_install:
             lines.append("USER 1000:100")
             lines.append("WORKDIR /home/datalayer/content")
-            prefix = "RUN --network=none " + (f"{secret_mounts} " if secret_mounts else "")
             for command in spec.commands.post_install:
                 # No network: a command that fetches something makes an
                 # artifact whose contents depend on the day it was built.
-                lines.append(f"{prefix}{command}")
+                mounts = "".join(
+                    f"{_secret_mount(secret)} "
+                    for secret in secrets
+                    if command_names_secret(command, secret)
+                )
+                lines.append(f"RUN --network=none {mounts}{command}")
         lines.extend(
             [
                 "USER 1000:100",

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/code_sandboxes/environments/spec.py

@@ -83,6 +83,7 @@ __all__ = [
     "VariantSet",
     "VersionStatus",
     "assert_publishable",
+    "command_names_secret",
     "parse_environment",
     "parse_requirements_txt",
     "publication_findings",
@@ -200,6 +201,18 @@ class BuildSecret(_Model):
     name: str = Field(pattern=r"^[A-Za-z0-9_.-]+$")
 
 
+def command_names_secret(command: str, secret: BuildSecret) -> bool:
+    """Whether one ``postInstall`` command names ``secret``, so its step gets the mount (E3-05).
+
+    A command names a secret when the secret's name is in it as a whole word:
+    ``$PIP_TOKEN``, ``${PIP_TOKEN}``, ``--key-env PIP_TOKEN`` or
+    ``/run/secrets/netrc``. A secret is mounted on exactly the steps that name
+    it (§4.1), so a command that reads none holds none.
+    """
+    word = rf"(?<![A-Za-z0-9_.-]){re.escape(secret.name)}(?![A-Za-z0-9_.-])"
+    return re.search(word, command) is not None
+
+
 class Accelerator(_Model):
     type: str
     count: int = Field(default=1, ge=1)
@@ -640,6 +653,17 @@ def spec_findings(
         values = [getattr(secret, attribute) for secret in spec.build_secrets]
         if len(values) != len(set(values)):
             findings.append(SpecFinding("spec.buildSecrets", f"a secret {label} is listed twice"))
+    for index, secret in enumerate(spec.build_secrets):
+        # A secret no command names would be mounted nowhere: the build would
+        # run with it empty and fail far from the cause.
+        if not any(command_names_secret(command, secret) for command in spec.commands.post_install):
+            findings.append(
+                SpecFinding(
+                    f"spec.buildSecrets[{index}]",
+                    f"`{secret.name}` is named by no `postInstall` command, and a secret "
+                    "is mounted only on the commands that name it",
+                )
+            )
 
     resources = spec.resources
     if resources.size_class not in SIZE_CLASSES:

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/tests/test_environment_datalayer_builder.py

@@ -95,6 +95,18 @@ class FakeEcr:
         return error
 
 
+#: One build secret, named by one of two `postInstall` commands (E3-05).
+A_SECRET = {
+    "buildSecrets": [{"id": "dlsec_01J9BUILDSECRET0000000000", "name": "PIP_TOKEN"}],
+    "commands": {
+        "postInstall": [
+            "python -c 'import geopandas'",
+            "python unpack_tiles.py --key-env PIP_TOKEN",
+        ]
+    },
+}
+
+
 def a_request(**changes) -> BuildRequest:
     """The section 4.1 example as a build of version 3, attempt `bld-1`."""
     spec = {
@@ -236,21 +248,20 @@ class TestTheDockerfileItGenerates:
         # Never the loose list: that is the whole point of resolving once.
         assert "geopandas==1.1.1" not in dockerfile
 
-    def test_a_build_secret_is_mounted_for_the_postinstall_step_alone(self) -> None:
-        """Mounted on the `postInstall` `RUN` alone — never an `ARG`/`ENV`,
-        which bakes a value into the image's history, and never the
-        package-install or files steps, which name no secret (§4.1, D-11)."""
-        request = a_request(
-            spec={"buildSecrets": [{"id": "dlsec_01J9BUILDSECRET0000000000", "name": "PIP_TOKEN"}]},
-            build_secret_ids=("dlsec_01J9BUILDSECRET0000000000",),
-        )
+    def test_a_build_secret_is_mounted_for_the_command_that_names_it_alone(self) -> None:
+        """Mounted on the `postInstall` `RUN` that names it alone — never an
+        `ARG`/`ENV`, which bakes a value into the image's history, never the
+        package-install or files steps, and never a `postInstall` command
+        that does not read it (§4.1, D-11)."""
+        request = a_request(spec=A_SECRET, build_secret_ids=("dlsec_01J9BUILDSECRET0000000000",))
         dockerfile = a_builder().dockerfile(request)
         lines = dockerfile.splitlines()
         mount_lines = [line for line in lines if "--mount=type=secret" in line]
         assert mount_lines == [
             "RUN --network=none --mount=type=secret,id=dlsec_01J9BUILDSECRET0000000000,"
-            "env=PIP_TOKEN python -c 'import geopandas'"
+            "env=PIP_TOKEN python unpack_tiles.py --key-env PIP_TOKEN"
         ]
+        assert "RUN --network=none python -c 'import geopandas'" in lines
         # Nowhere else in the Dockerfile: no `ARG`/`ENV` line, and no other
         # `RUN` mentions the id or the value's own name.
         assert not any(line.startswith(("ARG", "ENV")) and "PIP_TOKEN" in line for line in lines)
@@ -265,7 +276,8 @@ class TestTheDockerfileItGenerates:
                         "name": "netrc",
                         "mountAs": "file",
                     }
-                ]
+                ],
+                "commands": {"postInstall": ["python unpack_tiles.py --netrc /run/secrets/netrc"]},
             },
             build_secret_ids=("dlsec_01J9BUILDSECRET0000000000",),
         )
@@ -480,7 +492,7 @@ class TestBuildingAndPushing:
                 return result
 
         request = a_request(
-            spec={"buildSecrets": [{"id": "dlsec_01J9BUILDSECRET0000000000", "name": "PIP_TOKEN"}]},
+            spec=A_SECRET,
             build_secret_ids=("dlsec_01J9BUILDSECRET0000000000",),
         )
         buildctl = RecordingBuildctl()
@@ -501,7 +513,7 @@ class TestBuildingAndPushing:
             raise EnvironmentsError(BUILD_SECRET_UNAVAILABLE, "IAM is unreachable")
 
         request = a_request(
-            spec={"buildSecrets": [{"id": "dlsec_01J9BUILDSECRET0000000000", "name": "PIP_TOKEN"}]},
+            spec=A_SECRET,
             build_secret_ids=("dlsec_01J9BUILDSECRET0000000000",),
         )
         buildctl = Buildctl()

{code_sandboxes-1.9.2 → code_sandboxes-1.9.3}/tests/test_environment_spec.py

@@ -23,8 +23,10 @@ from code_sandboxes.environments.errors import EnvironmentsError
 from code_sandboxes.environments.schema import main as schema_main
 from code_sandboxes.environments.schema import schema_text
 from code_sandboxes.environments.spec import (
+    BuildSecret,
     Environment,
     assert_publishable,
+    command_names_secret,
     parse_environment,
     publication_findings,
     spec_digest,
@@ -72,10 +74,11 @@ spec:
   commands:
     postInstall:
       - "python -c 'import geopandas'"
+      - "python unpack_tiles.py --key-env TILES_LICENSE_KEY"
   buildSecrets:
     - id: dlsec_01J8ZK
       mountAs: env
-      name: PIP_EXTRA_INDEX_TOKEN
+      name: TILES_LICENSE_KEY
   resources:
     accelerator: none
     hints:
@@ -195,6 +198,13 @@ UNSUPPORTED = "DL_ENV_CAPABILITY_UNSUPPORTED"
         ("spec.language.version", "3.9", "spec.language.version", INVALID),
         ("spec.build.source", "dockerfile", "spec.build.source", UNSUPPORTED),
         ("spec.packages.python.manager", "conda", "spec.packages.python.manager", UNSUPPORTED),
+        # E3-05: a secret no postInstall command names would be mounted nowhere.
+        (
+            "spec.commands.postInstall",
+            ["python -c 'import geopandas'"],
+            "spec.buildSecrets[0]",
+            INVALID,
+        ),
         (
             "spec.packages.python.dependencies.0",
             "geopandas>=>1",
@@ -526,6 +536,24 @@ def test_a_spec_is_digested_the_same_from_the_environment_or_the_spec() -> None:
     assert spec_digest(environment) == spec_digest(environment.spec)
 
 
+@pytest.mark.parametrize(
+    ("command", "named"),
+    [
+        ("python unpack_tiles.py --key-env TOKEN", True),
+        ('curl -H "Authorization: $TOKEN" x', True),
+        ("echo ${TOKEN}", True),
+        ("cat /run/secrets/TOKEN", True),
+        ("echo $TOKEN_FILE", False),
+        ("echo $MY_TOKEN", False),
+        ("python -c 'import geopandas'", False),
+    ],
+)
+def test_a_command_names_a_secret_by_its_whole_name(command: str, named: bool) -> None:
+    """E3-05: the Datalayer builder mounts a secret on the commands that name it."""
+    secret = BuildSecret(id="dlsec_01J8ZK", name="TOKEN")
+    assert command_names_secret(command, secret) is named
+
+
 class TestPublicationFindings:
     """D-12: a version with any build secret can never be published to the Library."""