From 6af68817b10b1027d0f3afd2cbc2c5860a57aabb Mon Sep 17 00:00:00 2001 From: kartikey1306 Date: Tue, 1 Sep 2026 15:53:05 +0530 Subject: [PATCH] test(packages): make the fetcher's fixture archive reproducible targz_bytes() built its .tar.gz with default timestamps, so two calls with the same marker returned different bytes -- and different SHA-256 -- whenever they landed on opposite sides of a second boundary: a = sha256(targz_bytes("x")); sleep(1.1) b = sha256(targz_bytes("x")) a == b -> False Every checksum in this module is derived from the helper and then has to match the bytes fake_download hands out later, so the suite was a coin flip on timing. It held on fast Linux runners and failed on Windows. Two timestamps are involved and both default to "now": the tar member header and the gzip header. Writing the tar uncompressed with mtime=0 and compressing it through GzipFile(mtime=0) pins both. Co-Authored-By: Claude Opus 5 (1M context) --- tests/ebuild/test_package_fetcher.py | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/tests/ebuild/test_package_fetcher.py b/tests/ebuild/test_package_fetcher.py index ea7b82d1..f01c5d66 100644 --- a/tests/ebuild/test_package_fetcher.py +++ b/tests/ebuild/test_package_fetcher.py @@ -10,6 +10,7 @@ """ import hashlib +import gzip import io import tarfile @@ -57,14 +58,28 @@ def make_recipe(name, version="2.9.3", url=None, checksum=None): def targz_bytes(marker): - """A valid .tar.gz containing a single file whose body is *marker*.""" - buf = io.BytesIO() - with tarfile.open(fileobj=buf, mode="w:gz") as tar: + """A valid .tar.gz containing a single file whose body is *marker*. + + Byte-for-byte reproducible. Both the tar header and the gzip header carry a + timestamp, and the defaults are "now" -- so two calls with the same marker + produced different bytes, and therefore different SHA-256, if they landed on + opposite sides of a second boundary. That made every checksum derived from + this helper a coin flip: the digest computed for the recipe had to match the + bytes handed out by fake_download later. It held on fast Linux runners and + failed on Windows. Pinning both timestamps to 0 removes the race. + """ + raw = io.BytesIO() + with tarfile.open(fileobj=raw, mode="w") as tar: data = marker.encode("utf-8") info = tarfile.TarInfo("pkg/marker.txt") info.size = len(data) + info.mtime = 0 tar.addfile(info, io.BytesIO(data)) - return buf.getvalue() + + out = io.BytesIO() + with gzip.GzipFile(fileobj=out, mode="wb", mtime=0) as gz: + gz.write(raw.getvalue()) + return out.getvalue() def sha256_of(data):