Skip to content

gh-134261: ZipFile - Don't rely on local time for reproducible builds & tests#134264

Merged
jaraco merged 9 commits into
python:mainfrom
ctrlaltf2:main
May 20, 2026
Merged

gh-134261: ZipFile - Don't rely on local time for reproducible builds & tests#134264
jaraco merged 9 commits into
python:mainfrom
ctrlaltf2:main

Conversation

@ctrlaltf2
Copy link
Copy Markdown
Contributor

@ctrlaltf2 ctrlaltf2 commented May 19, 2025

See #134261 for issue background and technical detail on causes. This solves the issue by using gmtime whenever SOURCE_DATE_EPOCH is involved, to prevent pulling in system timezone information when performing time calculations.

@python-cla-bot
Copy link
Copy Markdown

python-cla-bot Bot commented May 19, 2025

All commit authors signed the Contributor License Agreement.

CLA signed

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 19, 2025

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

@Wulian233
Copy link
Copy Markdown
Contributor

I added this feature 8 months ago. There was a reason for using localtime. See #124435 (review) and 54a7116

Maybe we can ask @jaraco

Comment thread Misc/NEWS.d/next/Library/2025-05-19-21-08-25.gh-issue-134261.ravGYm.rst Outdated
@emmatyping
Copy link
Copy Markdown
Member

@jaraco would you have time to look at this one? Would appreciate your expertise on whether changing to UTC time would be acceptable only for cases where SOURCE_DATE_EPOCH is set.

@github-actions
Copy link
Copy Markdown

This PR is stale because it has been open for 30 days with no activity.

@github-actions github-actions Bot added the stale Stale PR or inactive for long period of time. label Apr 24, 2026
Copy link
Copy Markdown
Member

@jaraco jaraco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is the conversation where we discussed localtime vs. gmtime.

My concern at the time was that the code was changing localtime(time.time()) to gmtime(time.time()) even for the case where SOURCE_DATE_EPOCH was unset. And at the time, there was no explanation for why that change should be made and it seemed unrelated to the proposed change.

I'm pleased to see that this PR addresses my concern by keeping the behavior unchanged for unset SOURCE_DATE_EPOCH.

Unfortunately, even the tests are merely reflecting the implementation, so aren't capturing an external expectation. We can improve that situation in this PR, at least for the SOURCE_DATE_EPOCH case.

I do think we should apply this proposed change as a bugfix to all relevant Pythons. It seems to me this value was never correct. It will mean some instability, but I'm struggling to think of any other option. Better to have consistent behavior across all patched Pythons than have reproducibility dependent on minor Python version.

It's conceivable that gmtime should also be used unconditionally, but that's a broader problem with greater backward compatibility concerns and would demand larger scrutiny.

Comment thread Lib/test/test_zipfile/test_core.py Outdated
Comment thread Lib/test/test_zipfile/test_core.py Outdated
@jaraco jaraco added needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels May 19, 2026
@read-the-docs-community
Copy link
Copy Markdown

read-the-docs-community Bot commented May 19, 2026

Comment thread Lib/test/test_zipfile/test_core.py
@jaraco jaraco enabled auto-merge (squash) May 19, 2026 19:34
Co-authored-by: Emma Smith <emma@emmatyping.dev>
@jaraco
Copy link
Copy Markdown
Member

jaraco commented May 20, 2026

CI runners are flaky. I've had to retry the jobs twice, both for unrelated reasons. I expect them to pass soon.

@jaraco jaraco removed the stale Stale PR or inactive for long period of time. label May 20, 2026
@jaraco
Copy link
Copy Markdown
Member

jaraco commented May 20, 2026

Sadly the second retry failed in the same Ubuntu job. Sadly, it's a spurious error unrelated to this change. Here's Copilot's analysis:

This job did not fail because of a code or test regression in the PR. It was terminated by the runner infrastructure:

make ci was still running tests when the job was killed with exit code 143
the log ends with: The runner has received a shutdown signal
there is no Python traceback, assertion failure, compiler error, or failing test name before termination

Relevant evidence:

The failing step is the ASAN test job’s final test command in .github/workflows/build.yml:547-548:
    [build.yml#L547-L548](https://github.com/python/cpython/blob/0f962dc8601f31d7b9e1be6745a7cf7c4d5ef94e/.github/workflows/build.yml#L547-L548)
    run: xvfb-run make ci
The job was progressing normally through the test suite when it was interrupted.
make ci is the broad CI target from the top-level Makefile, so the interruption happened during the general test run, not in a specific failing source file.

Solution:

Treat this as a spurious CI failure and rerun the job.
No code change is justified based on these logs alone.
If this becomes repeatable in the same job, reduce susceptibility to runner interruption by narrowing the ASAN test workload rather than changing product code.

If you want a code-level mitigation for repeat occurrences, the best change is in the workflow, not CPython itself. For example, replace the broad ASAN command with a more targeted test invocation in .github/workflows/build.yml:
YAML

  • name: Tests
    run: xvfb-run ./python -m test --fast-ci --timeout 1200

or, if ASAN-specific coverage is still desired but runtime needs to be reduced, run a curated subset instead of make ci.

Bottom line: the correct solution for this job is to rerun it; there is no evidence of a bug in the referenced code from this log.

@jaraco jaraco merged commit 9dcf94e into python:main May 20, 2026
165 of 171 checks passed
@miss-islington-app
Copy link
Copy Markdown

Thanks @ctrlaltf2 for the PR, and @jaraco for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 20, 2026

GH-150137 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 20, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 20, 2026

GH-150138 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 20, 2026
@jaraco
Copy link
Copy Markdown
Member

jaraco commented May 20, 2026

I thought maybe there was a timeout, but that doesn't seem likely, as the second attempt ended after ~15 minutes and the third after ~9 minutes. The fourth attempt (second retry/third attempt of ubuntu freethreading) succeeded. So whatever it is is spurious.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants