repro-lambda 0.8.1__tar.gz → 0.8.2__tar.gz

repro_lambda-0.8.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.8.2"
+}

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.2](https://github.com/antonbabenko/repro-lambda/compare/v0.8.1...v0.8.2) (2026-09-23)
+
+
+### Bug Fixes
+
+* **hasher:** stop re-keying artifacts on every repro-lambda release ([#19](https://github.com/antonbabenko/repro-lambda/issues/19)) ([44a263a](https://github.com/antonbabenko/repro-lambda/commit/44a263a560d6d7d3504a1365c4d2dac9c4dbad4f))
+
 ## [0.8.1](https://github.com/antonbabenko/repro-lambda/compare/v0.8.0...v0.8.1) (2026-09-23)
 
 

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: repro-lambda
-Version: 0.8.1
+Version: 0.8.2
 Summary: Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf.
 Project-URL: Homepage, https://github.com/antonbabenko/repro-lambda
 Project-URL: Repository, https://github.com/antonbabenko/repro-lambda

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/SETUP.md

@@ -32,6 +32,23 @@ Once an artifact with a content-hash key (`lambdas/<name>/<sha256>.zip`) is
 uploaded, the key is permanently bound to those bytes. `repro-lambda` treats
 HTTP 412 PreconditionFailed on a duplicate upload as success.
 
+The key hashes the build inputs (staged source, requirements lock, spec, base
+image, filters, sources) plus a builder hash contract. It does not hash the
+repro-lambda package version, so upgrading repro-lambda keeps every existing key
+unless the release changes the packaged bytes, in which case it bumps
+`HASH_CONTRACT` in `hasher.py` and says so in its changelog entry.
+`tests/test_hash_contract.py` fingerprints the packaging modules, so a change to
+them fails CI until the contract is reviewed.
+
+`--verify` builds twice and compares the two results; it does not compare against
+the object already in S3. On a cache hit the build catalog records
+`hash-contract:<value>` as the builder, because the running version did not
+build that object.
+
+Releases up to 0.8.1 folded the package version into the key, so 0.8.1 would mint
+keys of its own. 0.8.2 returns to the keys 0.8.0 minted. If a pin was taken from a
+0.8.1 build, it moves back to the 0.8.0 key on the next build, with identical bytes.
+
 ## Terraform - per-account bootstrap
 
 The Terraform below assumes you already have a configured AWS provider in the

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/USAGE.md

@@ -86,9 +86,9 @@ include_patterns  = ["worker/**/*.py", "worker/**/*.json"]
 exclude_patterns  = ["**/tests/**"]
 ```
 
-The resolved per-lambda builder (base-image digest + include/exclude lists +
-builder version) folds into the content hash, so changing an override re-keys
-that lambda's artifact while leaving the others untouched.
+The resolved per-lambda builder (base-image digest + include/exclude lists)
+folds into the content hash, so changing an override re-keys that lambda's
+artifact while leaving the others untouched.
 
 ## Declarative sources - `[[lambda.source]]`
 

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "repro-lambda"
-version = "0.8.1"
+version = "0.8.2"
 description = "Build reproducible AWS Lambda packages outside Terraform, optimized for terraform-aws-lambda by serverless.tf."
 readme = "README.md"
 requires-python = ">=3.11"

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/src/repro_lambda/__init__.py

@@ -1,3 +1,3 @@
 """repro-lambda — reproducible AWS Lambda packaging outside Terraform."""
 
-__version__ = "0.8.1"  # x-release-please-version
+__version__ = "0.8.2"  # x-release-please-version

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/src/repro_lambda/build.py

@@ -11,7 +11,7 @@ from pathlib import Path
 from repro_lambda import __version__
 from repro_lambda.catalog import Catalog, CatalogEntry
 from repro_lambda.docker_runner import build_nodejs_lambda, build_python_lambda
-from repro_lambda.hasher import compute_content_hash
+from repro_lambda.hasher import HASH_CONTRACT, compute_content_hash
 from repro_lambda.manifest import BuilderConfig, LambdaSpec, resolve_builder
 from repro_lambda.s3_uploader import S3Uploader, UploadResult
 from repro_lambda.source_stager import stage_source
@@ -83,7 +83,7 @@ def compute_sha_for(
             requirements_lock=lock_path,
             spec=spec,
             base_image=primary_base_image,
-            builder_version=__version__,
+            builder_version=HASH_CONTRACT,
             extra_files=extras,
             payload_exec=[(ef.dest, ef.executable) for ef in spec.extra_files],
             include_patterns=builder.include_patterns,
@@ -130,7 +130,7 @@ def build_one(
             requirements_lock=lock_path,
             spec=spec,
             base_image=primary_base_image,
-            builder_version=__version__,
+            builder_version=HASH_CONTRACT,
             extra_files=extras,
             payload_exec=[(ef.dest, ef.executable) for ef in spec.extra_files],
             include_patterns=builder.include_patterns,
@@ -144,7 +144,7 @@ def build_one(
 
         uploader = S3Uploader(region=spec.region)
         if uploader.exists(bucket=target_bucket, key=bucket_key):
-            _record(catalog, spec, sha, source_commit, builder)
+            _record(catalog, spec, sha, source_commit, builder, built=False)
             return BuildOutcome(BuildResult.CACHE_HIT, sha, bucket_key)
 
         # Cache miss only: fetch + verify + extract declarative sources into the staged
@@ -182,7 +182,7 @@ def build_one(
 
         result = uploader.upload(bucket=target_bucket, key=bucket_key, body_path=out_zip)
         assert result in {UploadResult.UPLOADED, UploadResult.ALREADY_PRESENT}
-        _record(catalog, spec, sha, source_commit, builder)
+        _record(catalog, spec, sha, source_commit, builder, built=True)
         return BuildOutcome(BuildResult.BUILT_AND_UPLOADED, sha, bucket_key)
 
 
@@ -192,6 +192,8 @@ def _record(
     sha: str,
     source_commit: str,
     builder: BuilderConfig,
+    *,
+    built: bool,
 ) -> None:
     if spec.package_manager == "npm":
         primary_image = builder.base_image_nodejs
@@ -205,7 +207,9 @@ def _record(
             runtime=spec.runtime,
             arch=spec.arch,
             region=spec.region,
-            builder_version=__version__,
+            # A cache hit did not build the object, and the key no longer carries the
+            # package version, so only the hash contract is known to match it.
+            builder_version=__version__ if built else f"hash-contract:{HASH_CONTRACT}",
             base_image_digest=primary_image.split("@", 1)[-1],
             built_at=datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
         ),

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/src/repro_lambda/hasher.py

@@ -7,6 +7,15 @@ from pathlib import Path
 
 from repro_lambda.manifest import LambdaSpec, Source
 
+# The builder's contribution to every artifact key. NOT the package version: a
+# release that leaves the packaged bytes alone must keep every key, or promote-by-key
+# sees two keys for one zip. Bump it only when the same inputs would produce different
+# zip bytes (packaging, normalisation, install flags, base-image handling), and update
+# the fingerprints in tests/test_hash_contract.py with it. Frozen at "0.8.0", the last
+# package version folded here, so keys minted by 0.8.0 stay valid; the packaging
+# modules did not change between 0.7.2 and 0.8.1.
+HASH_CONTRACT = "0.8.0"
+
 
 def _sha256_file(path: Path) -> str:
     h = hashlib.sha256()
@@ -32,6 +41,7 @@ def compute_content_hash(
     """
     sha256 over: sorted (relative-path, sha256(content)) tuples for the staged tree
     + sha256(requirements_lock) + spec scalars + base_image + builder_version
+    (the HASH_CONTRACT, not the package version)
     + optional resolved include/exclude filter lists + optional extra_files keyed by
     destination relname (e.g. "package.json").
 

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/tests/test_build_integration.py

@@ -7,6 +7,7 @@ from moto import mock_aws
 
 from repro_lambda.build import BuildResult, build_one, compute_sha_for
 from repro_lambda.catalog import Catalog
+from repro_lambda.hasher import HASH_CONTRACT
 from repro_lambda.manifest import BuilderConfig, LambdaSpec
 
 
@@ -84,6 +85,8 @@ def test_build_one_cache_hit_skips_docker_and_returns_existing_sha(
     assert outcome.sha256 == sha
     mock_docker.assert_not_called()
     assert catalog.lambdas["app"].current == sha
+    # This process did not build the object; claim only the hash contract.
+    assert catalog.lambdas["app"].history[0].builder_version == f"hash-contract:{HASH_CONTRACT}"
 
 
 def test_build_one_cache_miss_runs_docker_uploads_and_records(git_repo_with_sample: Path, mocker):

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/tests/test_extra_files.py

@@ -220,3 +220,31 @@ def test_compute_sha_for_reflects_payload_binary(tmp_path: Path):
     sha_b = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
 
     assert sha_a != sha_b, "content hash must track the bundled binary's bytes"
+
+
+def test_compute_sha_for_ignores_the_package_version(tmp_path: Path, monkeypatch):
+    # A release that does not change the packaged bytes must not re-key artifacts:
+    # identical zips under two keys break promote-by-key between accounts.
+    repo = _git_repo_with_source(tmp_path)
+    (repo / "handler" / "requirements.arm64.lock").write_text("")
+    builder = BuilderConfig(base_image_python=PINNED_IMAGE)
+    spec = _spec()
+
+    sha_a = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+    monkeypatch.setattr("repro_lambda.build.__version__", "99.0.0")
+    sha_b = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+
+    assert sha_a == sha_b
+
+
+def test_compute_sha_for_rekeys_on_hash_contract_bump(tmp_path: Path, monkeypatch):
+    repo = _git_repo_with_source(tmp_path)
+    (repo / "handler" / "requirements.arm64.lock").write_text("")
+    builder = BuilderConfig(base_image_python=PINNED_IMAGE)
+    spec = _spec()
+
+    sha_a = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+    monkeypatch.setattr("repro_lambda.build.HASH_CONTRACT", "bumped", raising=False)
+    sha_b = compute_sha_for(repo_root=repo, spec=spec, builder=builder)
+
+    assert sha_a != sha_b

repro_lambda-0.8.2/tests/test_hash_contract.py

@@ -0,0 +1,82 @@
+"""Guards for HASH_CONTRACT: artifact keys must change exactly when packaged bytes can."""
+
+from __future__ import annotations
+
+import hashlib
+from pathlib import Path
+
+import repro_lambda
+from repro_lambda.hasher import HASH_CONTRACT, compute_content_hash
+from repro_lambda.manifest import LambdaSpec
+
+_PKG = Path(repro_lambda.__file__).parent
+
+# Modules that shape the zip bytes or the key beyond the hashed inputs. Editing one
+# means deciding whether the same inputs can now produce different bytes: if yes, bump
+# HASH_CONTRACT; either way, record the new fingerprints here under the (possibly new)
+# contract. A fingerprint update is cheap; a key change re-keys every artifact.
+# Known gap: npm packaging uses base_image_python, which is not in the key (issue #20).
+PACKAGING_FINGERPRINTS = {
+    "0.8.0": {
+        "build.py": "2dc3140e8af9e7e68d70199f85f261db04eef3e847d60ac21c9276133e9ec041",
+        "hasher.py": "c5eb56e00737efdca6c4bb47b694390b3dbd8941569f6c5cb299ba4cd5b18704",
+        "zip_packager.py": "56810a5e337a2fd5f72c269ba81bab06ca2f019e14e0edb728d6c37881d7cf0a",
+        "docker_runner.py": "0092a103b8dd11e6c0a00979e4c38272ccc6d707f2ee74035d8d84e61fed4988",
+        "source_stager.py": "38186277fb94ab6feac8a07cad2ae35f5adfaa52bde3d51ac71daccb003d3c68",
+        "sources.py": "10415ccc89b85f521fb64ef199f084f0bea1842032d414cb3d3537334f6caa0b",
+    },
+}
+
+
+def test_packaging_modules_match_the_hash_contract():
+    expected = PACKAGING_FINGERPRINTS.get(HASH_CONTRACT)
+    assert expected, f"no packaging fingerprints recorded for HASH_CONTRACT={HASH_CONTRACT!r}"
+    actual = {name: hashlib.sha256((_PKG / name).read_bytes()).hexdigest() for name in expected}
+    changed = sorted(n for n in expected if actual[n] != expected[n])
+    assert not changed, (
+        f"packaging module(s) changed: {changed}. If the same inputs can now produce "
+        "different zip bytes, bump HASH_CONTRACT in hasher.py. Then record these "
+        f"fingerprints under the contract: {actual}"
+    )
+
+
+def test_content_hash_golden_key(tmp_path: Path):
+    # Pins the hash layout: any change to what is folded, or how, re-keys every artifact.
+    src = tmp_path / "source"
+    src.mkdir()
+    (src / "app.py").write_text("ok\n")
+    lock = tmp_path / "lock.txt"
+    lock.write_text("\n")
+    spec = LambdaSpec(
+        logical_name="fn",
+        source_dir="src/fn",
+        requirements_lock="src/fn/requirements.${arch}.lock",
+        runtime="python3.13",
+        arch="arm64",
+        handler="app.handler",
+        region="eu-west-1",
+    )
+    got = compute_content_hash(src, lock, spec, "img@sha256:0", HASH_CONTRACT)
+    assert got == "de8da0c8801288758e8dc86edc15b085ffadc6eb915dcc45d875bfb235854dea"
+
+
+# The zip command's exclusion list lives in cli.py; changing it changes the zip bytes.
+ZIP_EXCLUDES = {
+    "0.8.0": [
+        "*__pycache__*",
+        "*.pyc",
+        "*.dist-info/RECORD",
+        "*.dist-info/INSTALLER",
+        "*.dist-info/direct_url.json",
+        "*.dist-info/REQUESTED",
+    ],
+}
+
+
+def test_zip_excludes_match_the_hash_contract():
+    from repro_lambda.cli import _LAMBDA_ZIP_EXCLUDES
+
+    assert ZIP_EXCLUDES.get(HASH_CONTRACT) == _LAMBDA_ZIP_EXCLUDES, (
+        "the lambda zip exclusion list changed: bump HASH_CONTRACT in hasher.py "
+        "and record the new list under the contract"
+    )

{repro_lambda-0.8.1 → repro_lambda-0.8.2}/uv.lock

@@ -646,7 +646,7 @@ wheels = [
 
 [[package]]
 name = "repro-lambda"
-version = "0.8.1"
+version = "0.8.2"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },

repro_lambda-0.8.1/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.8.1"
-}