fix(bundler): order bundle members by canonical POSIX arcname (reproducible builds)#3658
Open
jawwad-ali wants to merge 1 commit into
Open
fix(bundler): order bundle members by canonical POSIX arcname (reproducible builds)#3658jawwad-ali wants to merge 1 commit into
jawwad-ali wants to merge 1 commit into
Conversation
…ucible builds) _collect_files returned sorted(collected), i.e. pathlib.Path order, which is platform-dependent: on Windows PurePath compares case-folded with backslash separators, whereas the zip member NAMES are the canonical POSIX arcnames (build_bundle: file_path.relative_to(bundle_dir).as_posix()). So the same bundle built on Windows vs Linux/macOS produced archives whose members were laid out in different order — not byte-for-byte identical across build hosts, contradicting the packager's reproducible-build guarantee (fixed timestamps + canonical modes). Order by the same canonical POSIX-arcname key used to name members, so member order is host-independent. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
_collect_filesreturnedsorted(collected)— i.e.pathlib.Pathcomparison order. That ordering is platform-dependent: on WindowsPurePathcompares case-folded with backslash separators, while on Linux/macOS it compares the case-preserving forward-slash string.But the zip member names are the canonical POSIX arcnames (
build_bundle:file_path.relative_to(bundle_dir).as_posix()), which are platform-independent. So member order was derived from a platform-dependent key while member names were canonical — the same bundle built on Windows vs Linux/macOS produced archives whose members were laid out in different order, i.e. not byte-for-byte identical across build hosts. That contradicts the packager's stated reproducible-build guarantee (fixed timestamps + canonical 0644/0755 modes;test_build_is_deterministicasserts "byte-for-byte reproducible").Fix
Order by the same canonical POSIX-arcname key used to name the members:
Tests
tests/unit/test_bundler_packager.py::test_member_order_is_platform_independent— builds a bundle with mixed-case sibling files and assertsarchive.namelist() == sorted(archive.namelist()). Fails before the fix on Windows (Path order groups case differently:apple.txtsorts beforeFoo.txt); passes after. CI'swindows-latestmatrix exercises this. All existing packager tests (incl.test_build_is_deterministic) still pass.ruffclean.AI-assisted: authored with Claude Code. Verified the arcname key matches
build_bundle's naming, and confirmed fail-before on Windows / pass-after.