withcache 0.13.2__tar.gz → 0.13.3__tar.gz

{withcache-0.13.2 → withcache-0.13.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: withcache
-Version: 0.13.2
+Version: 0.13.3
 Summary: Operator-curated, URL-keyed artifact cache for a small lab (CUDA/ROCm/DOCA/firmware)
 Project-URL: Homepage, https://github.com/safl/withcache
 Author-email: "Simon A. F. Lund" <safl@safl.dk>

{withcache-0.13.2 → withcache-0.13.3}/shim/build.zig.zon

@@ -2,7 +2,7 @@
     .name = .withcache_shim,
     // Zig requires a literal here; keep it in lockstep with the project's
     // single source (src/withcache/__init__.py) via `make bump` / `make version-check`.
-    .version = "0.13.2",
+    .version = "0.13.3",
     .fingerprint = 0xd7d96c5ed212ccaa,
     .minimum_zig_version = "0.16.0",
     .paths = .{

{withcache-0.13.2 → withcache-0.13.3}/src/withcache/__init__.py

@@ -22,6 +22,6 @@ inherit the framework floor.
 from . import oras
 from .client import blob_url, cache_base, is_cached, serve_url
 
-__version__ = "0.13.2"
+__version__ = "0.13.3"
 
 __all__ = ["__version__", "blob_url", "cache_base", "is_cached", "oras", "serve_url"]

{withcache-0.13.2 → withcache-0.13.3}/src/withcache/_api.py

@@ -234,9 +234,29 @@ def register_api_routes(app: FastAPI) -> None:
         entries_out: list[dict[str, Any]] = []
         for e in cs.entries:
             fetch_url = e.get("resolved_src") or e.get("src") or ""
-            if not fetch_url or store.get_blob(fetch_url) is None:
+            if not fetch_url:
                 continue
-            entries_out.append(dict(e))
+            blob = store.get_blob(fetch_url)
+            if blob is None:
+                continue
+            out = dict(e)
+            # Enrich with the downloaded blob's authoritative sha256 +
+            # size. The catalog TOML may or may not carry these (nosi's
+            # gen_catalog omits them at emit time because the blob
+            # digest isn't known until the artifact is packed); the
+            # blob store computed both during the actual download so
+            # the /catalog response is the right place to surface
+            # them. Bty consumes ``sha256`` to gate machine binds --
+            # without this enrichment a downloaded-but-unhashed entry
+            # can never satisfy bty's ``^[0-9a-f]{64}$`` ref check
+            # and the whole ramboot flow deadlocks.
+            blob_sha = blob["sha256"]
+            if isinstance(blob_sha, str) and blob_sha and not out.get("sha256"):
+                out["sha256"] = blob_sha
+            blob_size = blob["size"]
+            if isinstance(blob_size, int) and blob_size > 0 and not out.get("size_bytes"):
+                out["size_bytes"] = blob_size
+            entries_out.append(out)
         return JSONResponse(
             {
                 "url": cs.url,

{withcache-0.13.2 → withcache-0.13.3}/tests/test_fastapi_catalog_api.py

@@ -122,6 +122,63 @@ class ListCatalogTests(_CatalogApiBase):
         self.assertEqual(entries[0]["sha256"], "a" * 64)
         self.assertEqual(entries[0]["description"], "downloaded")
 
+    def test_list_enriches_sha256_and_size_from_blob_store(self) -> None:
+        """A catalog TOML entry whose bytes are downloaded but that
+        omits ``sha256`` / ``size_bytes`` (nosi's gen_catalog does
+        exactly this: the OCI blob digest and content-length aren't
+        knowable at TOML-emit time) must still surface those two
+        fields in ``GET /catalog`` -- withcache computed them during
+        the download and stashed them in the blob row.
+
+        Bty's ``bty_image_ref`` regex is ``^[0-9a-f]{64}$``; without
+        this enrichment a downloaded-but-not-hashed entry can never
+        satisfy the check and the ramboot machine bind 422s. Pin the
+        wire so a future regression fails the test suite instead of
+        the deploy.
+        """
+        self.catalog.entries = [
+            {
+                "name": "no-sha-in-toml",
+                "src": "https://example/toml-quiet.img.gz",
+                "format": "img.gz",
+                "resolved_src": "https://example/toml-quiet.img.gz",
+            }
+        ]
+        self._seed_store_row("https://example/toml-quiet.img.gz", "b" * 64)
+
+        r = self.client.get("/catalog")
+        self.assertEqual(r.status_code, 200)
+        entries = r.json()["entries"]
+        self.assertEqual(len(entries), 1)
+        self.assertEqual(entries[0]["sha256"], "b" * 64)
+        # ``_seed_store_row`` writes 1024-byte blob rows.
+        self.assertEqual(entries[0]["size_bytes"], 1024)
+
+    def test_list_does_not_overwrite_toml_provided_sha256(self) -> None:
+        """When the catalog TOML already carries ``sha256`` (e.g. a
+        future gen_catalog that emits it), the enrichment path must
+        not clobber the operator-declared value with the blob's
+        computed one. The TOML value wins. Same for ``size_bytes``.
+        """
+        toml_sha = "c" * 64
+        blob_sha = "d" * 64
+        self.catalog.entries = [
+            {
+                "name": "declared-sha",
+                "src": "https://example/declared.img.gz",
+                "format": "img.gz",
+                "sha256": toml_sha,
+                "size_bytes": 42,
+                "resolved_src": "https://example/declared.img.gz",
+            }
+        ]
+        self._seed_store_row("https://example/declared.img.gz", blob_sha)
+
+        r = self.client.get("/catalog")
+        entries = r.json()["entries"]
+        self.assertEqual(entries[0]["sha256"], toml_sha)
+        self.assertEqual(entries[0]["size_bytes"], 42)
+
     def _seed_store_row(self, url: str, sha256: str) -> None:
         """Insert a blobs row for ``url`` so ``store.get_blob`` returns
         it; skips the actual file write because ``list_catalog`` only