stateman 2.0.0__tar.gz → 2.0.1__tar.gz

{stateman-2.0.0 → stateman-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stateman
-Version: 2.0.0
+Version: 2.0.1
 Summary: This module provides tools to track changes in the content of a directory and create compact binary patches that can be used to synchronize another copy of that directory.
 License: MIT
 Author: vpuhoff
@@ -61,6 +61,9 @@ Starting with v2.0, patches are safe to apply even when they come from an untrus
 
 ## Changelog
 
+### 2.0.1
+* Fixed #4: a failure mid-extraction (corrupted ZIP stream, hash mismatch) could leave a partially written file in the target directory after rollback. Files are now extracted to a temporary file, hash-verified, and atomically moved into place (`os.replace`), so a partial file can never appear at the target path.
+
 ### 2.0.0
 * **Breaking:** `ApplyPatch` now raises `PatchVerificationError` when the final state hash does not match the patch target state (previously it printed a warning and returned `True`), and when a file extracted from the patch fails its hash check.
 * **Breaking:** default hash algorithm switched from MD5 to SHA-256. Legacy v1 (MD5) patches are still applied correctly.

{stateman-2.0.0 → stateman-2.0.1}/README.md

@@ -44,6 +44,9 @@ Starting with v2.0, patches are safe to apply even when they come from an untrus
 
 ## Changelog
 
+### 2.0.1
+* Fixed #4: a failure mid-extraction (corrupted ZIP stream, hash mismatch) could leave a partially written file in the target directory after rollback. Files are now extracted to a temporary file, hash-verified, and atomically moved into place (`os.replace`), so a partial file can never appear at the target path.
+
 ### 2.0.0
 * **Breaking:** `ApplyPatch` now raises `PatchVerificationError` when the final state hash does not match the patch target state (previously it printed a warning and returned `True`), and when a file extracted from the patch fails its hash check.
 * **Breaking:** default hash algorithm switched from MD5 to SHA-256. Legacy v1 (MD5) patches are still applied correctly.

{stateman-2.0.0 → stateman-2.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stateman"
-version = "2.0.0"
+version = "2.0.1"
 description = "This module provides tools to track changes in the content of a directory and create compact binary patches that can be used to synchronize another copy of that directory."
 readme = "README.md"
 license = { text = "MIT" }

{stateman-2.0.0 → stateman-2.0.1}/stateman/__init__.py

@@ -387,6 +387,10 @@ def ApplyPatch(target, patch_file, exclude=None,
         backed_up = {}
         created = []
         total_extracted = 0
+        # Current umask, used to give extracted files the same permissions
+        # they would get from a plain open(path, "wb") (mkstemp uses 0600).
+        umask = os.umask(0)
+        os.umask(umask)
 
         def _rollback():
             """Restore the target directory to its pre-patch state."""
@@ -442,43 +446,58 @@ def ApplyPatch(target, patch_file, exclude=None,
                         f"({member.file_size} / {member.compress_size}), possible zip bomb."
                     )
 
-                # Extract manually to the validated path (never trust arcname
-                # resolution), enforcing the actual byte count while streaming.
-                written = 0
-                with patch.open(member) as src, open(target_path, "wb") as dst:
-                    while True:
-                        chunk = src.read(_CHUNK_SIZE)
-                        if not chunk:
-                            break
-                        written += len(chunk)
-                        if written > max_member_size:
-                            raise PatchVerificationError(
-                                f"Archive member '{filename}' expanded beyond the "
-                                f"per-member limit of {max_member_size} bytes."
-                            )
-                        dst.write(chunk)
-                total_extracted += written
-                if total_extracted > max_total_size:
-                    raise PatchVerificationError(
-                        f"Patch expanded beyond the total size limit of {max_total_size} bytes."
-                    )
+                # Extract to a temporary file in the same directory, verify its
+                # hash, and only then atomically move it into place. A failure
+                # at any point (corrupted stream, hash mismatch) can never
+                # leave a partially written file at the target path (issue #4).
+                fd, tmp_path = tempfile.mkstemp(prefix=".stateman-tmp-", dir=target_file_dir)
+                os.close(fd)
+                try:
+                    written = 0
+                    with patch.open(member) as src, open(tmp_path, "wb") as dst:
+                        while True:
+                            chunk = src.read(_CHUNK_SIZE)
+                            if not chunk:
+                                break
+                            written += len(chunk)
+                            if written > max_member_size:
+                                raise PatchVerificationError(
+                                    f"Archive member '{filename}' expanded beyond the "
+                                    f"per-member limit of {max_member_size} bytes."
+                                )
+                            dst.write(chunk)
+                    total_extracted += written
+                    if total_extracted > max_total_size:
+                        raise PatchVerificationError(
+                            f"Patch expanded beyond the total size limit of {max_total_size} bytes."
+                        )
+
+                    # Verify the hash of the extracted file before moving it into place
+                    extracted_hash = get_hash(tmp_path, algo)
+                    expected_hash = expected_hashes.get(filename)
+                    if not expected_hash:
+                        raise PatchVerificationError(
+                            f"No expected hash found in patch metadata for {filename}."
+                        )
+                    if extracted_hash != expected_hash:
+                        raise PatchVerificationError(
+                            f"Hash mismatch for extracted file {target_path}! "
+                            f"Expected {expected_hash}, got {extracted_hash}. Patch is corrupted."
+                        )
+
+                    os.chmod(tmp_path, 0o666 & ~umask)  # mkstemp creates 0600
+                    os.replace(tmp_path, target_path)  # atomic on POSIX and Windows
+                finally:
+                    # Clean up the temp file if anything failed before the replace
+                    if os.path.exists(tmp_path):
+                        try:
+                            os.remove(tmp_path)
+                        except OSError:
+                            pass
 
                 if filename not in backed_up:
                     created.append(filename)
 
-                # Verify the hash of the extracted file
-                extracted_hash = get_hash(target_path, algo)
-                expected_hash = expected_hashes.get(filename)
-                if not expected_hash:
-                    raise PatchVerificationError(
-                        f"No expected hash found in patch metadata for {filename}."
-                    )
-                if extracted_hash != expected_hash:
-                    raise PatchVerificationError(
-                        f"Hash mismatch for extracted file {target_path}! "
-                        f"Expected {expected_hash}, got {extracted_hash}. Patch is corrupted."
-                    )
-
                 action = "+" if filename in added else "*"
                 print(f"{action} Extracted: {target_path}")