code-sandboxes 1.9.4__tar.gz → 1.9.6__tar.gz

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/CHANGELOG.md

@@ -8,6 +8,48 @@
 
 ## Unreleased
 
+## 1.9.6
+
+- **`datalayer/python-cpu`'s `2026.09` channel points at the patched base**
+  (`environments.bases`; PLAN_ENV.md E1-05, E1-08). `jupyter-python` 0.2.2
+  upgrades the Ubuntu security packages and conda's own OpenSSL, and drops
+  JupyterLab's staging `yarn.lock` — the 31 fixable-critical findings that
+  blocked every build from the prior digest under the default scan policy.
+
+## 1.9.5
+
+- **Attest waits for a just-pushed image's scan to exist**
+  (`environments.attest`; PLAN_ENV.md E1-08). Enhanced scanning starts after
+  the push, so the first answers for a new image are
+  `ScanNotFoundException`. Attest read that as an image with no scan and
+  failed the build at once (found live on r1, 2026-09-14). It is now waited
+  for like a running scan, within the same bound.
+- **apt is pinned at, and installed from, the base channel's Ubuntu snapshot**
+  (`environments.bases`, `environments.resolve`,
+  `environments.adapters.datalayer`; PLAN_ENV.md E1-04). A channel records
+  the `snapshot.ubuntu.com` id its image was upgraded at. The solve runs
+  `apt-get` with `--snapshot` at that id, the lock records it
+  (`# datalayer-apt-snapshot:`), and the Datalayer builder installs its pins
+  from the same snapshot. This replaces a `deb` line that named only `main`
+  (`gdal-bin` is in `universe`) and left the live mirror enabled beside it.
+  `DATALAYER_APT_SNAPSHOT` must now be a snapshot id.
+- **A private registry's credential is resolved and used** (`environments
+  .image_import`, `environments.resolve`; PLAN_ENV.md E3-04's second half).
+  `image.credentialSecretId` used to only clear the allowlist check; nothing
+  fetched or used the credential it named. It is now fetched through the
+  same IAM route a build secret is (E3-05), and sent as HTTP Basic on the
+  registry's own token exchange — the way `docker login` authenticates a
+  private pull — never to the registry named in the reference, and never
+  logged. `resolve_environment` and `resolve_image_base` take `owner_uid`
+  and `resolve_secret` to reach it; unused by a public registry or any other
+  source.
+- **The Datalayer base channel's own five ESM-locked advisories are allowed**
+  (`environments.policy`; PLAN_ENV.md E1-08). Amazon Inspector marks all five
+  fixable, but the fix is an Ubuntu ESM package version a plain
+  `apt-get upgrade` cannot reach. Reviewed and added to `DEFAULT_POLICY
+  .allowed`, 2026-09-14, so they are recorded as allowed rather than missed,
+  and any other critical still blocks.
+
 ## 1.9.4
 
 - **A pushed Environment image is decided by its linux/amd64 image's scan**

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.4
+Version: 1.9.6
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.4"
+__version__ = "1.9.6"

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/code_sandboxes/environments/adapters/datalayer.py

@@ -68,7 +68,13 @@ from ..errors import (
     EnvironmentsError,
 )
 from ..files import files_step
-from ..resolve import WHEELHOUSE_IMAGE_PATH, WHEELHOUSE_PATH, apt_pins_in, locked_versions
+from ..resolve import (
+    WHEELHOUSE_IMAGE_PATH,
+    WHEELHOUSE_PATH,
+    apt_pins_in,
+    apt_snapshot_in,
+    locked_versions,
+)
 from ..spec import BuildSecret, Environment, command_names_secret
 
 __all__ = [
@@ -310,14 +316,18 @@ class Builder:
             lines.append(f"ENV {name}={shlex.quote(spec.env[name])}")
         if apt:
             # Pinned, and from the lock: `apt-get install <name>` a month later
-            # is a different artifact.
+            # is a different artifact. From the snapshot the pins were taken
+            # from, when the lock names one: a pinned version can leave the
+            # live mirror (D-9).
             pinned = " ".join(f"{name}={apt[name]}" for name in sorted(apt))
+            snapshot = apt_snapshot_in(request.lock_text)
+            option = f" --snapshot {snapshot}" if snapshot else ""
             lines.extend(
                 [
                     "USER root",
                     "RUN --mount=type=cache,target=/var/cache/apt,sharing=locked "
-                    "apt-get update -qq \\\n"
-                    f"    && apt-get install -y --no-install-recommends {pinned} \\\n"
+                    f"apt-get update -qq{option} \\\n"
+                    f"    && apt-get install -y --no-install-recommends{option} {pinned} \\\n"
                     "    && rm -rf /var/lib/apt/lists/*",
                 ]
             )

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/code_sandboxes/environments/attest.py

@@ -530,10 +530,20 @@ def _is_missing(error: BaseException) -> bool:
     return _error_code(error) in {
         "ImageNotFoundException",
         "RepositoryNotFoundException",
-        "ScanNotFoundException",
     }
 
 
 def _is_in_progress(error: BaseException) -> bool:
-    """ECR answers a scan that has not finished as an error, not a status."""
-    return _error_code(error) in {"ScanInProgressException", "LimitExceededException"}
+    """ECR answers a scan that has not finished as an error, not a status.
+
+    `ScanNotFoundException` is one of those answers: enhanced scanning starts
+    after the push, so an image pushed a moment ago has no scan yet (found
+    live on r1, 2026-09-14, the first build to read its image's scan rather
+    than its index's). It is waited for like a running scan, within the same
+    bound.
+    """
+    return _error_code(error) in {
+        "ScanInProgressException",
+        "ScanNotFoundException",
+        "LimitExceededException",
+    }

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/code_sandboxes/environments/bases.py

@@ -36,6 +36,7 @@ __all__ = [
     "BaseChannelUnpublishedError",
     "approved_base",
     "approved_repositories",
+    "channel_snapshot",
     "is_approved_repository",
     "resolve_base",
 ]
@@ -44,6 +45,8 @@ __all__ = [
 ECR_BASE_PREFIX = "environments/base/"
 
 _DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
+#: A snapshot.ubuntu.com id: the moment, to the second, in UTC.
+_SNAPSHOT = re.compile(r"\d{8}T\d{6}Z")
 
 
 class ApprovedBase(BaseModel):
@@ -59,6 +62,11 @@ class ApprovedBase(BaseModel):
     #: Channel, then variant, to the digest resolution pins. A channel with no
     #: variant is approved and not yet published.
     channels: dict[str, dict[str, str]] = Field(default_factory=dict)
+    #: Channel to the Ubuntu snapshot its apt versions are pinned against
+    #: (D-9): a ``snapshot.ubuntu.com`` id, taken just after the channel's
+    #: image upgraded its packages, so no pin is older than what the image
+    #: already carries. A channel with none pins against the base's mirror.
+    snapshots: dict[str, str] = Field(default_factory=dict)
 
     @field_validator("channels")
     @classmethod
@@ -75,6 +83,17 @@ class ApprovedBase(BaseModel):
             for channel, digests in channels.items()
         }
 
+    @field_validator("snapshots")
+    @classmethod
+    def _snapshot_ids_only(cls, snapshots: dict[str, str]) -> dict[str, str]:
+        for channel, snapshot in snapshots.items():
+            if not _SNAPSHOT.fullmatch(snapshot):
+                raise ValueError(
+                    f"channel {channel!r} pins apt to {snapshot!r}, "
+                    "which is not a snapshot id like 20260914T150000Z"
+                )
+        return snapshots
+
     @property
     def name(self) -> str:
         """The base's name without its namespace: ``python-cpu``."""
@@ -89,9 +108,15 @@ class ApprovedBase(BaseModel):
 APPROVED_BASES: dict[str, ApprovedBase] = {
     base.ref: base
     for base in (
-        # E1-05: jupyter-python:0.2.1 (the restored fork) plus the contract layer,
-        # released 2026-09-12 to environments/base/python-cpu. One image, so every
-        # variant pins the same digest until a variant needs a base of its own.
+        # E1-05: jupyter-python:0.2.2 (Ubuntu security packages and conda's own
+        # OpenSSL upgraded, JupyterLab's staging yarn.lock dropped) plus the
+        # contract layer, released 2026-09-14 to environments/base/python-cpu.
+        # One image, so every variant pins the same digest until a variant
+        # needs a base of its own. The prior digest, jupyter-python:0.2.1,
+        # carried 31 fixable-critical findings the scan (E1-08) blocks every
+        # build on; this one carries none the default policy does not already
+        # name (`policy.py`'s own `_BASE_CHANNEL_ALLOWED`, five ESM-locked
+        # ffmpeg/libcjson1 advisories, reviewed the same day).
         ApprovedBase(
             ref="datalayer/python-cpu",
             python_versions=("3.13",),
@@ -100,9 +125,10 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
                     # `.spec.VARIANTS`, spelled out: `spec` imports from this
                     # module, so importing it back here would be circular.
                     ("datalayer", "e2b", "daytona", "modal"),
-                    "sha256:cd09308a0c5e5adeec7fb5d8d29cf7455e78ba86f5c6c095a79068a280e1254f",
+                    "sha256:334adf6c2714c8919ef60beeca1db12e3531a391c9dde41932c782f81c432b36",
                 )
             },
+            snapshots={"2026.09": "20260914T150000Z"},
         ),
         # E2-17: jupyter-python-cuda plus the same layer.
         ApprovedBase(
@@ -180,6 +206,14 @@ def resolve_base(
     return digest
 
 
+def channel_snapshot(
+    ref: str, channel: str, bases: dict[str, ApprovedBase] = APPROVED_BASES
+) -> str:
+    """The Ubuntu snapshot ``ref`` at ``channel`` pins apt against, or ``""`` for none (D-9)."""
+    base = bases.get(ref)
+    return "" if base is None else base.snapshots.get(channel, "")
+
+
 def approved_repositories(bases: dict[str, ApprovedBase] = APPROVED_BASES) -> tuple[str, ...]:
     """Every repository name an approved base is published under."""
     names: list[str] = []

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/code_sandboxes/environments/image_import.py

@@ -13,20 +13,26 @@ path. Nothing downstream needs to know a build started from an import rather
 than an approved base; the only difference is where the `FROM` digest comes
 from.
 
-**Public registries only, for now.** A per-organization allowlist and
-credentials for a private registry are the rest of this box (E3-04's second
-half), left for E3-06's organization policy document to hold — the
-`policy.py` docstring already says as much about the scan threshold, and a
-registry allowlist is the same shape of decision. `DEFAULT_ALLOWED_REGISTRIES`
-below is a bootstrap standing in for that document before it exists, not a
-policy of its own: when E3-06 lands, an organization's own list replaces this
-one rather than adding to it.
+**A public registry needs no credential; a private one names its own**
+(E3-04's second half). `credentialSecretId` on the spec (the same `dlsec_...`
+shape a `BuildSecret` uses) is resolved through the same IAM route a build
+secret is (E3-05) — the value is fetched once, at the moment the digest is
+resolved, and handed to the registry's own token exchange as HTTP Basic,
+never logged, never stored, never sent to the registry named in the
+reference. A per-organization allowlist is still E3-06's own organization
+policy document to hold; `DEFAULT_ALLOWED_REGISTRIES` below is a bootstrap
+standing in for it before it exists, not a policy of its own — a registry
+outside this list is refused unless a credential was referenced for it, on
+the read that naming one is a deliberate private registry rather than a
+mistake. When E3-06 lands, an organization's own list replaces this one
+rather than adding to it.
 
 @module code_sandboxes.environments.image_import
 """
 
 from __future__ import annotations
 
+import base64
 import hashlib
 import re
 from dataclasses import dataclass
@@ -175,10 +181,11 @@ def refuse_unless_allowed(
     A registry named alongside `credentialSecretId` (E3-04's private half) is
     presumed a deliberate private one, its governance E3-06's own allowlist
     to hold once it exists — this bootstrap list is only ever the *public*
-    default, never the only door. What resolving that credential into a real
-    one to pull with is E3-05's mechanism, not built for anything yet; a spec
-    that clears this check but has no real credential fails honestly at the
-    registry instead, the same as an approved base with no digest published.
+    default, never the only door. The credential itself is resolved and used
+    at `resolve_image_digest` (E3-05's mechanism); a spec that clears this
+    check but names a secret IAM will not give, or that the registry refuses,
+    fails honestly there instead, the same as an approved base with no digest
+    published.
     """
     if has_credential or image_registry_allowed(image, allowlist):
         return
@@ -199,21 +206,68 @@ def _challenge(header: str) -> dict[str, str]:
     return dict(_CHALLENGE_FIELD.findall(header or ""))
 
 
+def _token_for_challenge(client: Any, header: str, *, registry: str, credential: str | None) -> str:
+    """The pull token a `WWW-Authenticate: Bearer ...` challenge answers with.
+
+    With a `credential` (`username:password`), sent as HTTP Basic on this
+    request alone — exactly what `docker login` sends here — so the realm
+    mints a token scoped to what that credential can pull; with none, the
+    same request answers with a public, anonymous-scope token. Either way,
+    the credential itself never reaches the registry named in the reference,
+    only this one realm, and only as this one request's header.
+    """
+    challenge = _challenge(header)
+    realm = challenge.get("realm")
+    if not realm:
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"{registry} refused a manifest request with no way to ask for a token",
+            detail={"registry": registry, "status": 401},
+        )
+    headers = {}
+    if credential:
+        encoded = base64.b64encode(credential.encode("utf-8")).decode("ascii")
+        headers["Authorization"] = f"Basic {encoded}"
+    response = client.get(
+        realm,
+        params={
+            key: value
+            for key, value in (
+                ("service", challenge.get("service")),
+                ("scope", challenge.get("scope")),
+            )
+            if value
+        },
+        headers=headers,
+    )
+    response.raise_for_status()
+    return str(response.json().get("token") or "")
+
+
 def resolve_image_digest(
     image: ImageReference,
     *,
     transport: Any = None,
     timeout: float = 10.0,
+    credential: str | None = None,
 ) -> str:
-    """The reference's digest, over the registry's own v2 API — no credential,
-    since only a public registry reaches this (§ this module's own docstring).
+    """The reference's digest, over the registry's own v2 API.
 
     Already pinned by digest, this is free: an operator who wrote `@sha256:…`
     meant exactly that image, and nothing is asked of the registry. A tag is
-    resolved with one anonymous manifest request, following the registry's own
-    `WWW-Authenticate` challenge for the one-time pull token every public
-    registry answers with no credential (D-9's base digests are pinned the
-    same way, just from a table Datalayer keeps instead of asked live).
+    resolved with one manifest request, following the registry's own
+    `WWW-Authenticate` challenge for the pull token every registry implementing
+    the distribution spec answers with (D-9's base digests are pinned the same
+    way, just from a table Datalayer keeps instead of asked live).
+
+    With no `credential`, the challenge is answered anonymously — the only
+    path a public registry needs. With one, `username:password` (E3-04's
+    private half), it is sent as HTTP Basic on the token request the challenge
+    names, exactly what `docker login` sends there: the registry mints a
+    token scoped to what that credential can pull, private repositories
+    included, rather than the public-only anonymous one. The credential itself
+    is never sent to the registry named in the reference, and never appears in
+    a log line or an exception message — only the token that answers it.
     """
     if image.pinned:
         return image.digest
@@ -234,28 +288,12 @@ def resolve_image_digest(
         try:
             response = client.get(url, headers=headers)
             if response.status_code == 401:
-                challenge = _challenge(response.headers.get("www-authenticate", ""))
-                realm = challenge.get("realm")
-                if not realm:
-                    raise EnvironmentsError(
-                        PROVIDER_ERROR,
-                        f"{image.registry} refused an anonymous manifest request with no "
-                        "way to ask for a token",
-                        detail={"registry": image.registry, "status": 401},
-                    )
-                token_response = client.get(
-                    realm,
-                    params={
-                        key: value
-                        for key, value in (
-                            ("service", challenge.get("service")),
-                            ("scope", challenge.get("scope")),
-                        )
-                        if value
-                    },
+                token = _token_for_challenge(
+                    client,
+                    response.headers.get("www-authenticate", ""),
+                    registry=image.registry,
+                    credential=credential,
                 )
-                token_response.raise_for_status()
-                token = str(token_response.json().get("token") or "")
                 response = client.get(url, headers={**headers, "Authorization": f"Bearer {token}"})
         except httpx.HTTPError as error:
             raise EnvironmentsError(
@@ -263,6 +301,18 @@ def resolve_image_digest(
                 f"{image.registry} could not be reached to resolve {image}: {error}",
                 detail={"registry": image.registry, "reference": str(image)},
             ) from error
+    if response.status_code in (401, 403):
+        raise EnvironmentsError(
+            PROVIDER_ERROR,
+            f"{image.registry} refused the credential for {image}"
+            if credential
+            else f"{image} needs a credential to resolve at {image.registry}",
+            detail={
+                "registry": image.registry,
+                "reference": str(image),
+                "status": response.status_code,
+            },
+        )
     if response.status_code == 404:
         raise EnvironmentsError(
             PROVIDER_ERROR,

{code_sandboxes-1.9.4 → code_sandboxes-1.9.6}/code_sandboxes/environments/policy.py

@@ -129,8 +129,29 @@ class ScanPolicy:
         }
 
 
+#: Advisories allowed on the Datalayer base channel itself (D-9), reviewed and
+#: accepted 2026-09-14 rather than silently missed: all five are in `ffmpeg`
+#: (`CVE-2024-35366`, `CVE-2024-35367`, `CVE-2024-35368`, `CVE-2026-40962`) and
+#: `libcjson1` (`CVE-2025-57052`, pulled in only by `librist4`, itself only
+#: needed by `ffmpeg`), on `datalayer/python-cpu:2026.09`. Amazon Inspector
+#: reports each as fixable, but the fix is an Ubuntu ESM (Extended Security
+#: Maintenance) package version — `7:6.1.1-3ubuntu5+esm5` and the like — not
+#: reachable by a plain `apt-get upgrade`, only by a Pro subscription token
+#: this deployment does not hold. `ffmpeg` has no other installed package
+#: depending on it (`apt-cache rdepends --installed`), so it is kept for what
+#: it is: an image-wide convenience (matplotlib's `FFMpegWriter` and the like),
+#: not something the sandbox contract's own doctor checks for. Revisit once
+#: Ubuntu ships a non-ESM fix, or the channel drops `ffmpeg`.
+_BASE_CHANNEL_ALLOWED: tuple[str, ...] = (
+    "CVE-2024-35366",
+    "CVE-2024-35367",
+    "CVE-2024-35368",
+    "CVE-2026-40962",
+    "CVE-2025-57052",
+)
+
 #: What every owner is scanned against until an organization says otherwise.
-DEFAULT_POLICY = ScanPolicy()
+DEFAULT_POLICY = ScanPolicy(allowed=_BASE_CHANNEL_ALLOWED)
 
 
 @dataclass(frozen=True)