repro-lambda 0.8.0__tar.gz → 0.8.2__tar.gz

repro_lambda-0.8.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.8.2"
+}

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.8.2](https://github.com/antonbabenko/repro-lambda/compare/v0.8.1...v0.8.2) (2026-09-23)
+
+
+### Bug Fixes
+
+* **hasher:** stop re-keying artifacts on every repro-lambda release ([#19](https://github.com/antonbabenko/repro-lambda/issues/19)) ([44a263a](https://github.com/antonbabenko/repro-lambda/commit/44a263a560d6d7d3504a1365c4d2dac9c4dbad4f))
+
+## [0.8.1](https://github.com/antonbabenko/repro-lambda/compare/v0.8.0...v0.8.1) (2026-09-23)
+
+
+### Bug Fixes
+
+* **sources:** fall back to the release assets endpoint when the tag view lists none ([#17](https://github.com/antonbabenko/repro-lambda/issues/17)) ([3a5608b](https://github.com/antonbabenko/repro-lambda/commit/3a5608b8cd7294f66986b1a61e4607efd052163a))
+
 ## [0.8.0](https://github.com/antonbabenko/repro-lambda/compare/v0.7.2...v0.8.0) (2026-09-18)
 
 

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: repro-lambda
-Version: 0.8.0
+Version: 0.8.2
 Summary: Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf.
 Project-URL: Homepage, https://github.com/antonbabenko/repro-lambda
 Project-URL: Repository, https://github.com/antonbabenko/repro-lambda

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/SETUP.md

@@ -32,6 +32,23 @@ Once an artifact with a content-hash key (`lambdas/<name>/<sha256>.zip`) is
 uploaded, the key is permanently bound to those bytes. `repro-lambda` treats
 HTTP 412 PreconditionFailed on a duplicate upload as success.
 
+The key hashes the build inputs (staged source, requirements lock, spec, base
+image, filters, sources) plus a builder hash contract. It does not hash the
+repro-lambda package version, so upgrading repro-lambda keeps every existing key
+unless the release changes the packaged bytes, in which case it bumps
+`HASH_CONTRACT` in `hasher.py` and says so in its changelog entry.
+`tests/test_hash_contract.py` fingerprints the packaging modules, so a change to
+them fails CI until the contract is reviewed.
+
+`--verify` builds twice and compares the two results; it does not compare against
+the object already in S3. On a cache hit the build catalog records
+`hash-contract:<value>` as the builder, because the running version did not
+build that object.
+
+Releases up to 0.8.1 folded the package version into the key, so 0.8.1 would mint
+keys of its own. 0.8.2 returns to the keys 0.8.0 minted. If a pin was taken from a
+0.8.1 build, it moves back to the 0.8.0 key on the next build, with identical bytes.
+
 ## Terraform - per-account bootstrap
 
 The Terraform below assumes you already have a configured AWS provider in the

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/USAGE.md

@@ -86,9 +86,9 @@ include_patterns  = ["worker/**/*.py", "worker/**/*.json"]
 exclude_patterns  = ["**/tests/**"]
 ```
 
-The resolved per-lambda builder (base-image digest + include/exclude lists +
-builder version) folds into the content hash, so changing an override re-keys
-that lambda's artifact while leaving the others untouched.
+The resolved per-lambda builder (base-image digest + include/exclude lists)
+folds into the content hash, so changing an override re-keys that lambda's
+artifact while leaving the others untouched.
 
 ## Declarative sources - `[[lambda.source]]`
 

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "repro-lambda"
-version = "0.8.0"
+version = "0.8.2"
 description = "Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf."
 readme = "README.md"
 requires-python = ">=3.11"

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/src/repro_lambda/__init__.py

@@ -1,3 +1,3 @@
 """repro-lambda — reproducible AWS Lambda packaging outside Terraform."""
 
-__version__ = "0.8.0"  # x-release-please-version
+__version__ = "0.8.2"  # x-release-please-version

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/src/repro_lambda/build.py

@@ -11,7 +11,7 @@ from pathlib import Path
 from repro_lambda import __version__
 from repro_lambda.catalog import Catalog, CatalogEntry
 from repro_lambda.docker_runner import build_nodejs_lambda, build_python_lambda
-from repro_lambda.hasher import compute_content_hash
+from repro_lambda.hasher import HASH_CONTRACT, compute_content_hash
 from repro_lambda.manifest import BuilderConfig, LambdaSpec, resolve_builder
 from repro_lambda.s3_uploader import S3Uploader, UploadResult
 from repro_lambda.source_stager import stage_source
@@ -83,7 +83,7 @@ def compute_sha_for(
             requirements_lock=lock_path,
             spec=spec,
             base_image=primary_base_image,
-            builder_version=__version__,
+            builder_version=HASH_CONTRACT,
             extra_files=extras,
             payload_exec=[(ef.dest, ef.executable) for ef in spec.extra_files],
             include_patterns=builder.include_patterns,
@@ -130,7 +130,7 @@ def build_one(
             requirements_lock=lock_path,
             spec=spec,
             base_image=primary_base_image,
-            builder_version=__version__,
+            builder_version=HASH_CONTRACT,
             extra_files=extras,
             payload_exec=[(ef.dest, ef.executable) for ef in spec.extra_files],
             include_patterns=builder.include_patterns,
@@ -144,7 +144,7 @@ def build_one(
 
         uploader = S3Uploader(region=spec.region)
         if uploader.exists(bucket=target_bucket, key=bucket_key):
-            _record(catalog, spec, sha, source_commit, builder)
+            _record(catalog, spec, sha, source_commit, builder, built=False)
             return BuildOutcome(BuildResult.CACHE_HIT, sha, bucket_key)
 
         # Cache miss only: fetch + verify + extract declarative sources into the staged
@@ -182,7 +182,7 @@ def build_one(
 
         result = uploader.upload(bucket=target_bucket, key=bucket_key, body_path=out_zip)
         assert result in {UploadResult.UPLOADED, UploadResult.ALREADY_PRESENT}
-        _record(catalog, spec, sha, source_commit, builder)
+        _record(catalog, spec, sha, source_commit, builder, built=True)
         return BuildOutcome(BuildResult.BUILT_AND_UPLOADED, sha, bucket_key)
 
 
@@ -192,6 +192,8 @@ def _record(
     sha: str,
     source_commit: str,
     builder: BuilderConfig,
+    *,
+    built: bool,
 ) -> None:
     if spec.package_manager == "npm":
         primary_image = builder.base_image_nodejs
@@ -205,7 +207,9 @@ def _record(
             runtime=spec.runtime,
             arch=spec.arch,
             region=spec.region,
-            builder_version=__version__,
+            # A cache hit did not build the object, and the key no longer carries the
+            # package version, so only the hash contract is known to match it.
+            builder_version=__version__ if built else f"hash-contract:{HASH_CONTRACT}",
             base_image_digest=primary_image.split("@", 1)[-1],
             built_at=datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
         ),

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/src/repro_lambda/hasher.py

@@ -7,6 +7,15 @@ from pathlib import Path
 
 from repro_lambda.manifest import LambdaSpec, Source
 
+# The builder's contribution to every artifact key. NOT the package version: a
+# release that leaves the packaged bytes alone must keep every key, or promote-by-key
+# sees two keys for one zip. Bump it only when the same inputs would produce different
+# zip bytes (packaging, normalisation, install flags, base-image handling), and update
+# the fingerprints in tests/test_hash_contract.py with it. Frozen at "0.8.0", the last
+# package version folded here, so keys minted by 0.8.0 stay valid; the packaging
+# modules did not change between 0.7.2 and 0.8.1.
+HASH_CONTRACT = "0.8.0"
+
 
 def _sha256_file(path: Path) -> str:
     h = hashlib.sha256()
@@ -32,6 +41,7 @@ def compute_content_hash(
     """
     sha256 over: sorted (relative-path, sha256(content)) tuples for the staged tree
     + sha256(requirements_lock) + spec scalars + base_image + builder_version
+    (the HASH_CONTRACT, not the package version)
     + optional resolved include/exclude filter lists + optional extra_files keyed by
     destination relname (e.g. "package.json").
 

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/src/repro_lambda/sources.py

@@ -34,6 +34,7 @@ import tempfile
 import zipfile
 from http.client import HTTPSConnection
 from pathlib import Path
+from typing import Any
 from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from repro_lambda import __version__
@@ -183,7 +184,7 @@ def _stream_to(resp, sink: io.BufferedWriter, max_bytes: int) -> str:
     return h.hexdigest()
 
 
-def _http_get_json(url: str, headers: dict[str, str]) -> dict:
+def _http_get_json(url: str, headers: dict[str, str]) -> Any:
     buf = io.BytesIO()
     writer = io.BufferedWriter(_RawSink(buf))
     _http_request(url, headers, writer, _JSON_MAX_BYTES)
@@ -219,7 +220,15 @@ def _github_asset_url(src: Source, token: str | None) -> tuple[str, dict[str, st
     auth = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}
     release = _http_get_json(api, auth)
     want = src.resolved_asset
-    for asset in release.get("assets", []):
+    assets = release.get("assets", [])
+    if not any(a.get("name") == want for a in assets) and "id" in release:
+        # The tag view can serve a stale, empty `assets` list for a while after an
+        # upload; the per-release assets endpoint is current.
+        # ponytail: first 100 assets only, paginate if a release ever carries more.
+        assets = _http_get_json(
+            f"{_GITHUB_API}/repos/{src.repo}/releases/{release['id']}/assets?per_page=100", auth
+        )
+    for asset in assets:
         if asset.get("name") == want:
             asset_id = asset["id"]
             dl = f"{_GITHUB_API}/repos/{src.repo}/releases/assets/{asset_id}"

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/tests/test_build_integration.py

@@ -7,6 +7,7 @@ from moto import mock_aws
 
 from repro_lambda.build import BuildResult, build_one, compute_sha_for
 from repro_lambda.catalog import Catalog
+from repro_lambda.hasher import HASH_CONTRACT
 from repro_lambda.manifest import BuilderConfig, LambdaSpec
 
 
@@ -84,6 +85,8 @@ def test_build_one_cache_hit_skips_docker_and_returns_existing_sha(
     assert outcome.sha256 == sha
     mock_docker.assert_not_called()
     assert catalog.lambdas["app"].current == sha
+    # This process did not build the object; claim only the hash contract.
+    assert catalog.lambdas["app"].history[0].builder_version == f"hash-contract:{HASH_CONTRACT}"
 
 
 def test_build_one_cache_miss_runs_docker_uploads_and_records(git_repo_with_sample: Path, mocker):

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/tests/test_extra_files.py

@@ -220,3 +220,31 @@ def test_compute_sha_for_reflects_payload_binary(tmp_path: Path):
     sha_b = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
 
     assert sha_a != sha_b, "content hash must track the bundled binary's bytes"
+
+
+def test_compute_sha_for_ignores_the_package_version(tmp_path: Path, monkeypatch):
+    # A release that does not change the packaged bytes must not re-key artifacts:
+    # identical zips under two keys break promote-by-key between accounts.
+    repo = _git_repo_with_source(tmp_path)
+    (repo / "handler" / "requirements.arm64.lock").write_text("")
+    builder = BuilderConfig(base_image_python=PINNED_IMAGE)
+    spec = _spec()
+
+    sha_a = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+    monkeypatch.setattr("repro_lambda.build.__version__", "99.0.0")
+    sha_b = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+
+    assert sha_a == sha_b
+
+
+def test_compute_sha_for_rekeys_on_hash_contract_bump(tmp_path: Path, monkeypatch):
+    repo = _git_repo_with_source(tmp_path)
+    (repo / "handler" / "requirements.arm64.lock").write_text("")
+    builder = BuilderConfig(base_image_python=PINNED_IMAGE)
+    spec = _spec()
+
+    sha_a = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+    monkeypatch.setattr("repro_lambda.build.HASH_CONTRACT", "bumped", raising=False)
+    sha_b = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+
+    assert sha_a != sha_b

repro_lambda-0.8.2/tests/test_hash_contract.py

@@ -0,0 +1,82 @@
+"""Guards for HASH_CONTRACT: artifact keys must change exactly when packaged bytes can."""
+
+from __future__ import annotations
+
+import hashlib
+from pathlib import Path
+
+import repro_lambda
+from repro_lambda.hasher import HASH_CONTRACT, compute_content_hash
+from repro_lambda.manifest import LambdaSpec
+
+_PKG = Path(repro_lambda.__file__).parent
+
+# Modules that shape the zip bytes or the key beyond the hashed inputs. Editing one
+# means deciding whether the same inputs can now produce different bytes: if yes, bump
+# HASH_CONTRACT; either way, record the new fingerprints here under the (possibly new)
+# contract. A fingerprint update is cheap; a key change re-keys every artifact.
+# Known gap: npm packaging uses base_image_python, which is not in the key (issue #20).
+PACKAGING_FINGERPRINTS = {
+    "0.8.0": {
+        "build.py": "2dc3140e8af9e7e68d70199f85f261db04eef3e847d60ac21c9276133e9ec041",
+        "hasher.py": "c5eb56e00737efdca6c4bb47b694390b3dbd8941569f6c5cb299ba4cd5b18704",
+        "zip_packager.py": "56810a5e337a2fd5f72c269ba81bab06ca2f019e14e0edb728d6c37881d7cf0a",
+        "docker_runner.py": "0092a103b8dd11e6c0a00979e4c38272ccc6d707f2ee74035d8d84e61fed4988",
+        "source_stager.py": "38186277fb94ab6feac8a07cad2ae35f5adfaa52bde3d51ac71daccb003d3c68",
+        "sources.py": "10415ccc89b85f521fb64ef199f084f0bea1842032d414cb3d3537334f6caa0b",
+    },
+}
+
+
+def test_packaging_modules_match_the_hash_contract():
+    expected = PACKAGING_FINGERPRINTS.get(HASH_CONTRACT)
+    assert expected, f"no packaging fingerprints recorded for HASH_CONTRACT={HASH_CONTRACT!r}"
+    actual = {name: hashlib.sha256((_PKG / name).read_bytes()).hexdigest() for name in expected}
+    changed = sorted(n for n in expected if actual[n] != expected[n])
+    assert not changed, (
+        f"packaging module(s) changed: {changed}. If the same inputs can now produce "
+        "different zip bytes, bump HASH_CONTRACT in hasher.py. Then record these "
+        f"fingerprints under the contract: {actual}"
+    )
+
+
+def test_content_hash_golden_key(tmp_path: Path):
+    # Pins the hash layout: any change to what is folded, or how, re-keys every artifact.
+    src = tmp_path / "source"
+    src.mkdir()
+    (src / "app.py").write_text("ok\n")
+    lock = tmp_path / "lock.txt"
+    lock.write_text("\n")
+    spec = LambdaSpec(
+        logical_name="fn",
+        source_dir="src/fn",
+        requirements_lock="src/fn/requirements.${arch}.lock",
+        runtime="python3.13",
+        arch="arm64",
+        handler="app.handler",
+        region="eu-west-1",
+    )
+    got = compute_content_hash(src, lock, spec, "img@sha256:0", HASH_CONTRACT)
+    assert got == "de8da0c8801288758e8dc86edc15b085ffadc6eb915dcc45d875bfb235854dea"
+
+
+# The zip command's exclusion list lives in cli.py; changing it changes the zip bytes.
+ZIP_EXCLUDES = {
+    "0.8.0": [
+        "*__pycache__*",
+        "*.pyc",
+        "*.dist-info/RECORD",
+        "*.dist-info/INSTALLER",
+        "*.dist-info/direct_url.json",
+        "*.dist-info/REQUESTED",
+    ],
+}
+
+
+def test_zip_excludes_match_the_hash_contract():
+    from repro_lambda.cli import _LAMBDA_ZIP_EXCLUDES
+
+    assert ZIP_EXCLUDES.get(HASH_CONTRACT) == _LAMBDA_ZIP_EXCLUDES, (
+        "the lambda zip exclusion list changed: bump HASH_CONTRACT in hasher.py "
+        "and record the new list under the contract"
+    )

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/tests/test_sources.py

@@ -358,6 +358,60 @@ def test_github_source_requires_token(tmp_path: Path):
         sources._github_asset_url(src, None)
 
 
+def _gh_src() -> Source:
+    return Source(
+        name="p",
+        type="github_release",
+        sha256=SHA_PLACEHOLDER,
+        extract="tar.gz",
+        dest="p",
+        repo="o/r",
+        tag="t",
+        asset="a.tgz",
+    )
+
+
+def test_github_asset_falls_back_to_assets_endpoint(monkeypatch):
+    # GitHub can serve releases/tags/<tag> with a stale, empty `assets` list right after
+    # an upload, while /releases/{id}/assets already lists the file.
+    calls = []
+
+    def fake_get(url, headers):
+        calls.append(url)
+        if url.endswith("/releases/tags/t"):
+            return {"id": 7, "assets": []}
+        assert url.endswith("/releases/7/assets?per_page=100")
+        return [{"name": "other", "id": 1}, {"name": "a.tgz", "id": 42}]
+
+    monkeypatch.setattr(sources, "_http_get_json", fake_get)
+    url, headers = sources._github_asset_url(_gh_src(), "tok")
+    assert url.endswith("/repos/o/r/releases/assets/42")
+    assert headers["Accept"] == "application/octet-stream"
+    assert len(calls) == 2
+
+
+def test_github_asset_embedded_list_needs_no_second_call(monkeypatch):
+    calls = []
+
+    def fake_get(url, headers):
+        calls.append(url)
+        return {"id": 7, "assets": [{"name": "a.tgz", "id": 42}]}
+
+    monkeypatch.setattr(sources, "_http_get_json", fake_get)
+    url, _ = sources._github_asset_url(_gh_src(), "tok")
+    assert url.endswith("/releases/assets/42")
+    assert len(calls) == 1
+
+
+def test_github_asset_missing_everywhere_raises(monkeypatch):
+    def fake_get(url, headers):
+        return {"id": 7, "assets": []} if url.endswith("/tags/t") else []
+
+    monkeypatch.setattr(sources, "_http_get_json", fake_get)
+    with pytest.raises(SourceFetchError, match="not found"):
+        sources._github_asset_url(_gh_src(), "tok")
+
+
 # --- staging + end-to-end (no network) -------------------------------------
 
 

{repro_lambda-0.8.0 → repro_lambda-0.8.2}/uv.lock

@@ -646,7 +646,7 @@ wheels = [
 
 [[package]]
 name = "repro-lambda"
-version = "0.8.0"
+version = "0.8.2"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },

repro_lambda-0.8.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.8.0"
-}