withcache 0.13.1__tar.gz → 0.13.3__tar.gz

{withcache-0.13.1 → withcache-0.13.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: withcache
-Version: 0.13.1
+Version: 0.13.3
 Summary: Operator-curated, URL-keyed artifact cache for a small lab (CUDA/ROCm/DOCA/firmware)
 Project-URL: Homepage, https://github.com/safl/withcache
 Author-email: "Simon A. F. Lund" <safl@safl.dk>

{withcache-0.13.1 → withcache-0.13.3}/shim/build.zig.zon

@@ -2,7 +2,7 @@
     .name = .withcache_shim,
     // Zig requires a literal here; keep it in lockstep with the project's
     // single source (src/withcache/__init__.py) via `make bump` / `make version-check`.
-    .version = "0.13.1",
+    .version = "0.13.3",
     .fingerprint = 0xd7d96c5ed212ccaa,
     .minimum_zig_version = "0.16.0",
     .paths = .{

{withcache-0.13.1 → withcache-0.13.3}/src/withcache/__init__.py

@@ -22,6 +22,6 @@ inherit the framework floor.
 from . import oras
 from .client import blob_url, cache_base, is_cached, serve_url
 
-__version__ = "0.13.1"
+__version__ = "0.13.3"
 
 __all__ = ["__version__", "blob_url", "cache_base", "is_cached", "oras", "serve_url"]

{withcache-0.13.1 → withcache-0.13.3}/src/withcache/_api.py

@@ -234,9 +234,29 @@ def register_api_routes(app: FastAPI) -> None:
         entries_out: list[dict[str, Any]] = []
         for e in cs.entries:
             fetch_url = e.get("resolved_src") or e.get("src") or ""
-            if not fetch_url or store.get_blob(fetch_url) is None:
+            if not fetch_url:
                 continue
-            entries_out.append(dict(e))
+            blob = store.get_blob(fetch_url)
+            if blob is None:
+                continue
+            out = dict(e)
+            # Enrich with the downloaded blob's authoritative sha256 +
+            # size. The catalog TOML may or may not carry these (nosi's
+            # gen_catalog omits them at emit time because the blob
+            # digest isn't known until the artifact is packed); the
+            # blob store computed both during the actual download so
+            # the /catalog response is the right place to surface
+            # them. Bty consumes ``sha256`` to gate machine binds --
+            # without this enrichment a downloaded-but-unhashed entry
+            # can never satisfy bty's ``^[0-9a-f]{64}$`` ref check
+            # and the whole ramboot flow deadlocks.
+            blob_sha = blob["sha256"]
+            if isinstance(blob_sha, str) and blob_sha and not out.get("sha256"):
+                out["sha256"] = blob_sha
+            blob_size = blob["size"]
+            if isinstance(blob_size, int) and blob_size > 0 and not out.get("size_bytes"):
+                out["size_bytes"] = blob_size
+            entries_out.append(out)
         return JSONResponse(
             {
                 "url": cs.url,
@@ -256,9 +276,19 @@ def register_api_routes(app: FastAPI) -> None:
         """Insert one catalog entry.
 
         Body: ``{"name": "...", "src": "...", "format?", "arch?",
-        "sha256?", "size_bytes?", "resolved_src?", "description?"}``.
-        Only ``src`` is required; every other field is optional and
-        gets persisted through the ``catalog.toml`` round-trip.
+        "sha256?", "size_bytes?", "resolved_src?", "description?",
+        "netboot_ref?"}``. Only ``src`` is required; every other
+        field is optional and gets persisted through the
+        ``catalog.toml`` round-trip.
+
+        ``netboot_ref`` names another catalog entry (by ``name``)
+        whose bytes are a nosi netboot bundle (vmlinuz + initrd +
+        manifest) that nbdmux extracts at warm time so bty can
+        ramboot the image using its own kernel. Present iff the
+        entry is a disk image that has a matching netboot bundle;
+        the bundle entry itself never carries a ``netboot_ref``.
+        Withcache does not validate that the referenced entry
+        exists -- the sibling may be added in either order.
 
         409 when an entry with the same ``name`` already exists;
         rejecting on duplicate name (not src) because the display
@@ -278,6 +308,7 @@ def register_api_routes(app: FastAPI) -> None:
             "sha256",
             "size_bytes",
             "description",
+            "netboot_ref",
         }
         if not isinstance(body, dict):
             raise HTTPException(status_code=400, detail="body must be a JSON object")

{withcache-0.13.1 → withcache-0.13.3}/src/withcache/client.py

@@ -221,7 +221,10 @@ def add_catalog_entry(
 
     ``entry`` must carry at least ``name`` + ``src``. Optional
     fields: ``format``, ``arch``, ``sha256``, ``size_bytes``,
-    ``resolved_src``, ``description``.
+    ``resolved_src``, ``description``, ``netboot_ref`` (name of
+    a sibling entry carrying the matching nosi netboot bundle;
+    consumed by nbdmux to serve vmlinuz + initrd alongside the
+    disk-image export).
 
     Raises :class:`WithcacheError` on any HTTP failure (409 if the
     entry name already exists; 401 if auth is enabled and no valid

{withcache-0.13.1 → withcache-0.13.3}/src/withcache/server.py

@@ -147,18 +147,31 @@ def _serialise_catalog(entries: list[dict[str, Any]]) -> bytes:
     row can't smuggle arbitrary TOML through.
 
     Scalar keys emitted: ``name``, ``src``, ``resolved_src``,
-    ``format``, ``arch``, ``sha256``, ``description``. Integer:
-    ``size_bytes``. ``resolved_src`` is the canonical fetch URL
-    (for ``oras://`` refs; equal to ``src`` for plain HTTPS);
-    bty needs it to render iPXE flash chains against the byte
-    URL directly. ``description`` is operator-supplied prose so
-    the /ui/images page has something better than the URL to
-    display.
+    ``format``, ``arch``, ``sha256``, ``description``,
+    ``netboot_ref``. Integer: ``size_bytes``. ``resolved_src`` is
+    the canonical fetch URL (for ``oras://`` refs; equal to
+    ``src`` for plain HTTPS); bty needs it to render iPXE flash
+    chains against the byte URL directly. ``description`` is
+    operator-supplied prose so the /ui/images page has something
+    better than the URL to display. ``netboot_ref`` names a
+    sibling catalog entry carrying the matching nosi netboot
+    bundle (kernel + initrd) so nbdmux can pair the disk image
+    with its own kernel at warm time; see the ``add_catalog_entry``
+    docstring in ``_api.py`` for the pairing story.
     """
     out: list[str] = ["version = 1", ""]
     for e in entries:
         out.append("[[images]]")
-        for key in ("name", "src", "resolved_src", "format", "arch", "sha256", "description"):
+        for key in (
+            "name",
+            "src",
+            "resolved_src",
+            "format",
+            "arch",
+            "sha256",
+            "description",
+            "netboot_ref",
+        ):
             val = e.get(key)
             if val is None or val == "":
                 continue

{withcache-0.13.1 → withcache-0.13.3}/tests/test_fastapi_catalog_api.py

@@ -122,6 +122,63 @@ class ListCatalogTests(_CatalogApiBase):
         self.assertEqual(entries[0]["sha256"], "a" * 64)
         self.assertEqual(entries[0]["description"], "downloaded")
 
+    def test_list_enriches_sha256_and_size_from_blob_store(self) -> None:
+        """A catalog TOML entry whose bytes are downloaded but that
+        omits ``sha256`` / ``size_bytes`` (nosi's gen_catalog does
+        exactly this: the OCI blob digest and content-length aren't
+        knowable at TOML-emit time) must still surface those two
+        fields in ``GET /catalog`` -- withcache computed them during
+        the download and stashed them in the blob row.
+
+        Bty's ``bty_image_ref`` regex is ``^[0-9a-f]{64}$``; without
+        this enrichment a downloaded-but-not-hashed entry can never
+        satisfy the check and the ramboot machine bind 422s. Pin the
+        wire so a future regression fails the test suite instead of
+        the deploy.
+        """
+        self.catalog.entries = [
+            {
+                "name": "no-sha-in-toml",
+                "src": "https://example/toml-quiet.img.gz",
+                "format": "img.gz",
+                "resolved_src": "https://example/toml-quiet.img.gz",
+            }
+        ]
+        self._seed_store_row("https://example/toml-quiet.img.gz", "b" * 64)
+
+        r = self.client.get("/catalog")
+        self.assertEqual(r.status_code, 200)
+        entries = r.json()["entries"]
+        self.assertEqual(len(entries), 1)
+        self.assertEqual(entries[0]["sha256"], "b" * 64)
+        # ``_seed_store_row`` writes 1024-byte blob rows.
+        self.assertEqual(entries[0]["size_bytes"], 1024)
+
+    def test_list_does_not_overwrite_toml_provided_sha256(self) -> None:
+        """When the catalog TOML already carries ``sha256`` (e.g. a
+        future gen_catalog that emits it), the enrichment path must
+        not clobber the operator-declared value with the blob's
+        computed one. The TOML value wins. Same for ``size_bytes``.
+        """
+        toml_sha = "c" * 64
+        blob_sha = "d" * 64
+        self.catalog.entries = [
+            {
+                "name": "declared-sha",
+                "src": "https://example/declared.img.gz",
+                "format": "img.gz",
+                "sha256": toml_sha,
+                "size_bytes": 42,
+                "resolved_src": "https://example/declared.img.gz",
+            }
+        ]
+        self._seed_store_row("https://example/declared.img.gz", blob_sha)
+
+        r = self.client.get("/catalog")
+        entries = r.json()["entries"]
+        self.assertEqual(entries[0]["sha256"], toml_sha)
+        self.assertEqual(entries[0]["size_bytes"], 42)
+
     def _seed_store_row(self, url: str, sha256: str) -> None:
         """Insert a blobs row for ``url`` so ``store.get_blob`` returns
         it; skips the actual file write because ``list_catalog`` only
@@ -167,12 +224,28 @@ class AddCatalogEntryTests(_CatalogApiBase):
                 "sha256": "b" * 64,
                 "size_bytes": 2048,
                 "description": "Debian sysdev",
+                "netboot_ref": "debian-netboot",
             },
         )
         self.assertEqual(r.status_code, 201, r.text)
         stored = self.catalog.entries[0]
         self.assertEqual(stored["description"], "Debian sysdev")
         self.assertEqual(stored["resolved_src"], "https://example/debian.img.gz")
+        self.assertEqual(stored["netboot_ref"], "debian-netboot")
+
+    def test_netboot_ref_persists_through_toml_round_trip(self) -> None:
+        """netboot_ref must survive the catalog.toml write-then-reload."""
+        self.client.post(
+            "/catalog/entries",
+            json={
+                "name": "debian",
+                "src": "https://example/debian.img.gz",
+                "netboot_ref": "debian-netboot",
+            },
+        )
+        toml_path = os.path.join(self._tmpdir, "catalog.toml")
+        content = open(toml_path, encoding="utf-8").read()
+        self.assertIn('netboot_ref = "debian-netboot"', content)
 
     def test_add_persists_to_disk(self) -> None:
         self.client.post(