lean-runtime 2.0.6__tar.gz → 2.0.7__tar.gz

{lean_runtime-2.0.6 → lean_runtime-2.0.7}/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 2.0.7
+
+- Retry an OCI layer once from a clean partial after size or SHA-256 integrity
+  verification fails, bypassing intermediary caches while preserving strict
+  digest validation and emitting structured retry diagnostics.
+
 ## 2.0.6
 
 - Preserve the highest-ranked Lean compiler rejection when automatic discovery

{lean_runtime-2.0.6/lean_runtime.egg-info → lean_runtime-2.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.0.6
+Version: 2.0.7
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.0.6 → lean_runtime-2.0.7}/lean_runtime/oci.py

@@ -32,6 +32,7 @@ _BEARER_PARAMETER = re.compile(r'([a-zA-Z]+)="([^"]*)"')
 _DIGEST = re.compile(r"sha256:([0-9a-f]{64})")
 _ACCEPT = ", ".join((INDEX_MEDIA_TYPE, MANIFEST_MEDIA_TYPE))
 DEFAULT_ENVIRONMENT_LIBRARIES = ("oci://ghcr.io/alerad/lean-runtime-cache",)
+_BLOB_INTEGRITY_ATTEMPTS = 2
 
 
 class SignatureVerifier(Protocol):
@@ -215,52 +216,73 @@ class OCIRegistryClient:
                     return destination
                 destination.unlink()
             temporary = destination.with_name(f".{destination.name}.partial")
-            if temporary.exists() and temporary.stat().st_size > size:
-                temporary.unlink()
-            offset = temporary.stat().st_size if temporary.exists() else 0
-            request = urllib.request.Request(self._url(f"blobs/{digest}"))
-            if offset:
-                request.add_header("Range", f"bytes={offset}-")
-            events.emit(
-                "library.layer_download_started",
-                "Downloading OCI blob",
-                digest=digest,
-                size=size,
-            )
-            observed = hashlib.sha256()
-            written = offset
-            if offset:
-                with temporary.open("rb") as existing:
-                    for chunk in iter(lambda: existing.read(1024 * 1024), b""):
-                        observed.update(chunk)
-            try:
-                response = self._request(request)
-                if offset and response.status != 206:
-                    offset = 0
-                    written = 0
-                    observed = hashlib.sha256()
+            for attempt in range(1, _BLOB_INTEGRITY_ATTEMPTS + 1):
+                if temporary.exists() and temporary.stat().st_size > size:
+                    temporary.unlink()
+                offset = temporary.stat().st_size if temporary.exists() else 0
+                request = urllib.request.Request(self._url(f"blobs/{digest}"))
+                if offset:
+                    request.add_header("Range", f"bytes={offset}-")
+                if attempt > 1:
+                    request.add_header("Cache-Control", "no-cache")
+                events.emit(
+                    "library.layer_download_started",
+                    "Downloading OCI blob",
+                    digest=digest,
+                    size=size,
+                    attempt=attempt,
+                    resumed_bytes=offset,
+                )
+                observed = hashlib.sha256()
+                written = offset
                 if offset:
-                    content_range = response.headers.get("Content-Range", "")
-                    if not content_range.startswith(f"bytes {offset}-"):
-                        response.close()
-                        temporary.unlink(missing_ok=True)
-                        raise EnvironmentError("OCI registry returned an invalid byte range")
-                mode = "ab" if offset else "wb"
-                with response, temporary.open(mode) as output:
-                    while chunk := response.read(1024 * 1024):
-                        written += len(chunk)
-                        if written > size:
-                            raise EnvironmentError("OCI blob exceeds its declared size")
-                        observed.update(chunk)
-                        output.write(chunk)
-                if written != size or "sha256:" + observed.hexdigest() != digest:
+                    with temporary.open("rb") as existing:
+                        for chunk in iter(lambda: existing.read(1024 * 1024), b""):
+                            observed.update(chunk)
+                try:
+                    response = self._request(request)
+                    if offset and response.status != 206:
+                        offset = 0
+                        written = 0
+                        observed = hashlib.sha256()
+                    if offset:
+                        content_range = response.headers.get("Content-Range", "")
+                        if not content_range.startswith(f"bytes {offset}-"):
+                            response.close()
+                            temporary.unlink(missing_ok=True)
+                            raise EnvironmentError("OCI registry returned an invalid byte range")
+                    mode = "ab" if offset else "wb"
+                    with response, temporary.open(mode) as output:
+                        while chunk := response.read(1024 * 1024):
+                            written += len(chunk)
+                            if written > size:
+                                raise EnvironmentError("OCI blob exceeds its declared size")
+                            observed.update(chunk)
+                            output.write(chunk)
+                    observed_digest = "sha256:" + observed.hexdigest()
+                    if written == size and observed_digest == digest:
+                        temporary.replace(destination)
+                        break
                     temporary.unlink(missing_ok=True)
-                    raise EnvironmentError("downloaded OCI blob failed digest verification")
-                temporary.replace(destination)
-            except urllib.error.HTTPError as exc:
-                raise DownloadUnavailable(f"OCI blob download failed: HTTP {exc.code}") from exc
-            except OSError as exc:
-                raise DownloadUnavailable(f"OCI blob download failed: {exc}") from exc
+                    if attempt == _BLOB_INTEGRITY_ATTEMPTS:
+                        raise EnvironmentError(
+                            "downloaded OCI blob failed digest verification "
+                            f"after {attempt} attempts (expected {digest}, got "
+                            f"{observed_digest}, bytes {written}/{size})"
+                        )
+                    events.emit(
+                        "library.layer_download_retry",
+                        "Retrying OCI blob after integrity verification failed",
+                        digest=digest,
+                        attempt=attempt + 1,
+                        observed_digest=observed_digest,
+                        downloaded_bytes=written,
+                        expected_bytes=size,
+                    )
+                except urllib.error.HTTPError as exc:
+                    raise DownloadUnavailable(f"OCI blob download failed: HTTP {exc.code}") from exc
+                except OSError as exc:
+                    raise DownloadUnavailable(f"OCI blob download failed: {exc}") from exc
         return destination
 
     def blob_exists(self, digest: str) -> bool:

{lean_runtime-2.0.6 → lean_runtime-2.0.7}/lean_runtime/run_cli.py

@@ -34,6 +34,7 @@ def _progress(event: RuntimeEvent) -> None:
         "package_reference.started": "Resolving dependency",
         "library.lookup": "Looking for a cached environment",
         "library.layer_download_started": "Downloading cached environment",
+        "library.layer_download_retry": "Retrying cached-environment download",
         "environment.build_started": "Building environment",
         "environment.cache_hit": "Using local environment",
     }

{lean_runtime-2.0.6 → lean_runtime-2.0.7/lean_runtime.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.0.6
+Version: 2.0.7
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.0.6 → lean_runtime-2.0.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "lean-runtime"
-version = "2.0.6"
+version = "2.0.7"
 description = "Run Lean 4 proofs from Python or standalone files"
 readme = "README.md"
 requires-python = ">=3.10"

{lean_runtime-2.0.6 → lean_runtime-2.0.7}/tests/test_bundles.py

@@ -18,8 +18,14 @@ import pytest
 from lean_runtime import EnvironmentError, EnvironmentLock, LockedPackage, Runtime
 from lean_runtime.bundles import _extract_layer, _oci_archive
 from lean_runtime.environments import ENVIRONMENT_SCHEMA
-from lean_runtime.oci import OCIEnvironmentPublisher, OCIRepository
-from lean_runtime.store import environment_identity, platform_record, source_snapshot_digest
+from lean_runtime.events import EventEmitter
+from lean_runtime.oci import OCIEnvironmentPublisher, OCIRegistryClient, OCIRepository
+from lean_runtime.store import (
+    EnvironmentStore,
+    environment_identity,
+    platform_record,
+    source_snapshot_digest,
+)
 
 
 def _git_package(path: Path) -> tuple[str, str]:
@@ -403,6 +409,50 @@ def test_transparent_authenticated_oci_pull_and_blob_reuse(tmp_path: Path) -> No
         thread.join(timeout=5)
 
 
+def test_oci_blob_integrity_failure_retries_once_from_scratch(tmp_path: Path) -> None:
+    data = b"verified layer contents"
+    digest = "sha256:" + hashlib.sha256(data).hexdigest()
+    requests = 0
+    cache_controls: list[str | None] = []
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self) -> None:
+            nonlocal requests
+            requests += 1
+            cache_controls.append(self.headers.get("Cache-Control"))
+            response = b"x" * len(data) if requests == 1 else data
+            self.send_response(200)
+            self.send_header("Content-Length", str(len(response)))
+            self.end_headers()
+            self.wfile.write(response)
+
+        def log_message(self, _format: str, *_args: object) -> None:
+            pass
+
+    server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    events = []
+    try:
+        repository = OCIRepository.parse(f"oci+http://127.0.0.1:{server.server_port}/owner/cache")
+        path = OCIRegistryClient(repository).download_blob(
+            {"digest": digest, "size": len(data)},
+            EnvironmentStore(tmp_path / "consumer"),
+            EventEmitter(events.append),
+        )
+        assert path.read_bytes() == data
+        assert requests == 2
+        assert cache_controls == [None, "no-cache"]
+        assert [event.kind for event in events].count("library.layer_download_retry") == 1
+        starts = [event for event in events if event.kind == "library.layer_download_started"]
+        assert [event.data["attempt"] for event in starts] == [1, 2]
+        assert starts[1].data["resumed_bytes"] == 0
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
 def test_oci_publisher_uploads_blobs_before_manifests(tmp_path: Path) -> None:
     producer, environment_id, lock = _published_runtime(tmp_path / "producer")
     publisher = OCIEnvironmentPublisher(