verifiers 0.3.2.dev30__py3-none-any.whl → 0.3.2.dev31__py3-none-any.whl

verifiers/v1/utils/artifacts.py

@@ -1,9 +1,11 @@
-"""Artifact collection and restoration across runtimes."""
+"""Bounded, validated artifact collection and restoration across runtimes."""
 
 from __future__ import annotations
 
+import io
 import logging
 import shlex
+import tarfile
 import uuid
 from pathlib import PurePosixPath
 from typing import TYPE_CHECKING
@@ -110,7 +112,12 @@ async def collect(
 
 
 async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
-    """Extract `collected` in `runtime` at the original absolute paths."""
+    """Extract `collected` in `runtime` at the original absolute paths.
+
+    Archive bytes are untrusted: the agent controls both their source files and the
+    runtime tooling that creates them. Every archive is therefore validated on the host
+    before the grading runtime is changed. Only regular files and directories travel.
+    """
     if not collected:
         return
     # Restoring into the subprocess runtime would extract absolute paths onto the
@@ -120,6 +127,8 @@ async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
             "refusing to restore artifacts into the subprocess runtime: extraction "
             "writes to absolute paths on the host. Grade in a container."
         )
+    for root, archive in collected.items():
+        _validate_restore(root, archive)
     # Clear every root up front, not per entry: a later nested root would otherwise
     # delete content an earlier one just restored. Clearing also drops any file or
     # symlink the image left at the target.
@@ -141,23 +150,16 @@ async def _tar_out(runtime: Runtime, artifact: Artifact, budget: int) -> bytes:
     path = f"/tmp/vf-artifact-{uuid.uuid4().hex}.tar"
     excludes = " ".join(f"--exclude={shlex.quote(p)}" for p in artifact.exclude)
     try:
+        # macOS tar otherwise adds AppleDouble sidecars next to a directory root.
         await _run(
             runtime,
-            f"tar -cf {shlex.quote(path)} -C / {excludes} -- "
+            f"COPYFILE_DISABLE=1 tar -cf {shlex.quote(path)} -C / {excludes} -- "
             f"{shlex.quote(artifact.source.lstrip('/'))}",
             f"collect artifact {artifact.source!r}",
         )
-        # Size it in the box: an oversized collection is refused before it reaches host
-        # memory, not after.
-        sized = await runtime.run(["sh", "-c", f"wc -c < {shlex.quote(path)}"], {})
-        if (raw := sized.stdout.strip()).isdigit() and int(raw) > budget:
-            raise RuntimeError(
-                f"artifact {artifact.source!r} takes the collection over the "
-                f"{MAX_ARTIFACT_BYTES} byte limit. The grading box boots from the "
-                "agent's image, so only the delta needs to travel — narrow the source "
-                "or add `exclude` patterns."
-            )
-        return await runtime.read(path)
+        # The runtime enforces the remaining collection budget while transferring the
+        # bytes, so replacing or growing the archive cannot race a separate size probe.
+        return await runtime.read(path, max_bytes=budget)
     finally:
         # Best-effort: the box is about to be destroyed and the name is unique per call.
         try:
@@ -166,6 +168,43 @@ async def _tar_out(runtime: Runtime, artifact: Artifact, budget: int) -> bytes:
             logger.debug("failed to remove %s", path, exc_info=True)
 
 
+def _validate_restore(root: str, archive: bytes | None) -> None:
+    """Reject archive content that could restore outside its declared root."""
+    root_path = PurePosixPath(root)
+    if (
+        root_path.anchor != "/"
+        or ".." in root_path.parts
+        or root_path == PurePosixPath("/")
+    ):
+        raise RuntimeError(
+            f"artifact root {root!r} must be an absolute path below '/' with no '..'"
+        )
+    if archive is None:
+        return
+
+    try:
+        with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as tar:
+            for member in tar:
+                member_path = PurePosixPath(member.name)
+                destination = PurePosixPath("/") / member_path
+                if (
+                    not member.name
+                    or member_path.is_absolute()
+                    or ".." in member_path.parts
+                    or not destination.is_relative_to(root_path)
+                ):
+                    raise RuntimeError(
+                        f"artifact member {member.name!r} is outside declared root "
+                        f"{root!r}"
+                    )
+                if not (member.isfile() or member.isdir()):
+                    raise RuntimeError(
+                        f"artifact member {member.name!r} is a link or special file"
+                    )
+    except tarfile.TarError as exc:
+        raise RuntimeError(f"unreadable artifact archive for {root!r}: {exc}") from exc
+
+
 async def _run(runtime: Runtime, command: str, action: str) -> None:
     result = await runtime.run(["sh", "-c", command], {})
     if result.exit_code:

{verifiers-0.3.2.dev30.dist-info → verifiers-0.3.2.dev31.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev30
+Version: 0.3.2.dev31
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev30.dist-info → verifiers-0.3.2.dev31.dist-info}/RECORD

@@ -168,7 +168,7 @@ verifiers/v1/tasksets/textarena/__init__.py,sha256=Os2OlBY_pSH0B1DP32RitumgSLpq2
 verifiers/v1/tasksets/textarena/taskset.py,sha256=9fa_unlFiFZyuN4I02rW3x4qyRnFWXqwTUZTloQefu0,4433
 verifiers/v1/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 verifiers/v1/utils/aio.py,sha256=0yNFOqB2oO6Qktc6NI_ZSAGuo1aHsIK_wuT1BtmoZ3I,1532
-verifiers/v1/utils/artifacts.py,sha256=SPvC_N2scVlbYcCYH406TG57vliSTlNWFl5mnIHQ760,6921
+verifiers/v1/utils/artifacts.py,sha256=GowZubXGk6NhVgaAUKCVXYoBh_3L1Aw0LAHe6tNwl8g,8447
 verifiers/v1/utils/compile.py,sha256=5pxy31wx2Q-3pQjOO5B9SH6OT-wwb8r4F1LAl6HMeQA,5835
 verifiers/v1/utils/decorators.py,sha256=vhoN6YoKb15-Fkqmc9RaNlUIbt9WRvNK4zAn2bAxfS4,5367
 verifiers/v1/utils/format.py,sha256=NfQo9M5KMzWCZpQaet5YtsJx56vCKAZPfbjZZJLJhhM,2187
@@ -185,8 +185,8 @@ verifiers/v1/utils/prime.py,sha256=UTYRjp9cbjNb6CVmBHda-1wWZAIIfxNOmTyNuT7_wL4,9
 verifiers/v1/utils/retries.py,sha256=Y2ZgrAjn-qNkRKZP_RVNL_7EK0iaRcZeCa404lpGYi4,5417
 verifiers/v1/utils/score.py,sha256=493yJVMw8teCu9JxapxMFPFzI0hNUqdo0Y2nGW4kckk,6200
 verifiers/v1/utils/version.py,sha256=-obEo_-l9-D8FLef4hYxncOe-uJpxrM1g2Hig_37Sgs,1607
-verifiers-0.3.2.dev30.dist-info/METADATA,sha256=FHhvCm1bWfK4SjM09N1Lu8Hr3Dzhlidw5ga4QYTJSUg,4144
-verifiers-0.3.2.dev30.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-verifiers-0.3.2.dev30.dist-info/entry_points.txt,sha256=uqQje0TMsr7k6nXlWxlPs13Si0evb3pVCEDF6c-YL80,241
-verifiers-0.3.2.dev30.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
-verifiers-0.3.2.dev30.dist-info/RECORD,,
+verifiers-0.3.2.dev31.dist-info/METADATA,sha256=0h0tNHbRYVLoDa0whEvfRNXDH9SkdX41bAn-Ct2aC2A,4144
+verifiers-0.3.2.dev31.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+verifiers-0.3.2.dev31.dist-info/entry_points.txt,sha256=uqQje0TMsr7k6nXlWxlPs13Si0evb3pVCEDF6c-YL80,241
+verifiers-0.3.2.dev31.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
+verifiers-0.3.2.dev31.dist-info/RECORD,,