perf(delivery): ship verified Python bytecode caches

2026-10-28 16:40:52 +08:00
parent 81b5258808
commit 70007a36b9
8 changed files with 303 additions and 7 deletions
@@ -0,0 +1,114 @@
+"""Ordinary owned source/cache checks; no service, isolation or recovery claims."""
+
+import importlib
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT))
+bytecode = importlib.import_module("scripts.release.bytecode")
+manifest = importlib.import_module("scripts.release.manifest")
+policy = importlib.import_module("scripts.release.policy")
+
+
+@pytest.fixture
+def compiled(tmp_path):
+    source = tmp_path / "site/toy.py"
+    source.parent.mkdir()
+    source.write_text("VALUE = (17, 'ordinary trusted fixture')\n")
+    source.chmod(0o444)
+    assert bytecode.compile_payload(tmp_path, "sd-" + "b" * 12) == 1
+    cache = source.parent / "__pycache__/toy.cpython-313.pyc"
+    return tmp_path, source, cache
+
+
+def test_complete_cache_inventory_and_actual_import_without_source_compilation(compiled):
+    payload, source, cache = compiled
+    records = manifest.inventory(payload)
+    assert {r["path"] for r in records} == {
+        "site/toy.py",
+        "site/__pycache__/toy.cpython-313.pyc",
+    }
+    assert all(r["mode"] == "0444" for r in records)
+    # Only this tiny trusted fixture executes. An attempted source compilation
+    # fails, so success demonstrates CPython actually consumes the checked cache.
+    code = """import builtins,sys
+sys.path.insert(0,sys.argv[1])
+def refuse(*args,**kwargs): raise AssertionError('unexpected source compilation')
+builtins.compile=refuse
+import toy
+assert toy.VALUE==(17,'ordinary trusted fixture')
+"""
+    before = {p: bytecode._stamp(p.lstat()) for p in (source, cache)}
+    result = subprocess.run(
+        [sys.executable, "-I", "-B", "-c", code, str(source.parent)],
+        capture_output=True,
+        timeout=15,
+    )
+    assert result.returncode == 0, result.stderr
+    assert {p: bytecode._stamp(p.lstat()) for p in before} == before
+
+
+def test_source_change_cannot_reuse_cache_even_with_restored_mtime(compiled):
+    payload, source, _ = compiled
+    before = source.stat()
+    source.chmod(0o600)
+    source.write_text("VALUE = (18, 'ordinary trusted fixture')\n")
+    source.chmod(0o444)
+    os.utime(source, ns=(before.st_atime_ns, before.st_mtime_ns))
+    with pytest.raises(policy.DeliveryError, match="bytecode source hash differs"):
+        manifest.inventory(payload)
+
+
+@pytest.mark.parametrize("offset,value", [(0, 0), (4, 0), (4, 1), (4, 2)])
+def test_wrong_magic_timestamp_and_unchecked_hash_caches_are_refused(compiled, offset, value):
+    payload, _, cache = compiled
+    data = bytearray(cache.read_bytes())
+    data[offset] = value
+    cache.chmod(0o600)
+    cache.write_bytes(data)
+    cache.chmod(0o444)
+    with pytest.raises(policy.DeliveryError, match="only pinned checked-hash"):
+        manifest.inventory(payload)
+
+
+def test_builder_refuses_inherited_cache_and_does_not_write_to_external_prefix(
+    compiled, monkeypatch
+):
+    payload, _, cache = compiled
+    before = cache.read_bytes()
+    monkeypatch.setattr(sys, "pycache_prefix", str(payload / "outside"))
+    with pytest.raises(policy.DeliveryError, match="inherited bytecode cache"):
+        bytecode.compile_payload(payload, "sd-" + "b" * 12)
+    assert cache.read_bytes() == before and not (payload / "outside").exists()
+
+
+@pytest.mark.parametrize(
+    "name",
+    [
+        "site/toy.pyc",
+        "site/__pycache__/toy.cpython-314.pyc",
+        "site/__pycache__/toy.cpython-313.opt-1.pyc",
+        "site/__pycache__/toy.py",
+        "site/__pycache__/nested/__pycache__/toy.cpython-313.pyc",
+        "site/../__pycache__/toy.cpython-313.pyc",
+        "images/python313/__pycache__/toy.cpython-313.pyc",
+        "frontend/__pycache__/toy.cpython-313.pyc",
+    ],
+)
+def test_cache_allowlist_keeps_wrong_versions_domains_and_paths_closed(name):
+    with pytest.raises(policy.DeliveryError):
+        policy.relative_name(name)
+
+
+@pytest.mark.parametrize("prefix", policy.BYTECODE_ROOTS)
+def test_only_source_adjacent_pinned_cache_paths_are_allowed(prefix):
+    name = prefix + "package/__pycache__/toy.cpython-313.pyc"
+    assert policy.relative_name(name) == name
+    assert policy.bytecode_source(name) == prefix + "package/toy.py"
+    directory = prefix + "package/__pycache__/.__directory__"
+    assert policy.relative_name(directory) == directory