Repository navigation
Fix virtualenv seed cache identity with wheel hashes - #19732
Closed
SeanDougherty wants to merge 2 commits into
Closed
SeanDougherty wants to merge 2 commits into
SeanDougherty wants to merge 2 commits into
Conversation
Key installation images by the selected wheel SHA-256 while retaining installer, Python, and wheel-name separation. Preserve legacy images and reuse identical content without maintaining release-specific cache generations. Add regressions for legacy images, successive same-name replacements with stable size and mtime, unchanged content across paths, rollback, copy/symlink modes, and unreadable wheels. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
microsoft-github-policy-service
Bot
added
Packaging
fasttrack/3.0
This was referenced Oct 25, 2026
Distinguish automatically bypassed seed images from existing environments that still need a pip update or recreation. Explain that legacy files are retained for environments referencing them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Closing this draft because commit f59907689a01f381c20e92b2461e45e46b1f3968 in #19708 blocks the known compromised eMudhra intermediate keys in CPython's TLS verification, even with stale cached pip CA bundles. Once the patched runtime is deployed and loaded by restarted processes, cache invalidation is not required for that protection. Certificate verification must remain enabled. The branch is retained for any future work on general same-filename cache consistency. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Either/or alternative
Draft alternative to #19721. Choose one approach, not both.
Both PRs independently target
fasttrack/3.0and updatepython-virtualenvfrom 20.36.1-8 to 20.36.1-9. Neither depends on theother. The original trust-store update, #19710, has already merged.
This PR uses wheel-content hashes instead of #19721's one-time cache
namespace bump.
Change
Include the selected wheel's SHA-256 in the existing seed-image key,
preserving Python-version, installer, and wheel-filename separation.
Different contents select a new image even when the filename, size, and
timestamp are unchanged. Identical contents reuse the image, including
after reinstalling the RPM. No release-specific cache constant is needed.
Deployment and cache cleanup
New environments seeded from the corrected bundled wheels automatically
bypass legacy seed images. No manual cache reset or additional package
update is needed for this cache invalidation.
Legacy files remain on disk to avoid breaking existing symlinked
environments. This does not repair existing environments that still use
affected pip CA bundles; those require a pip update or recreation.
Unused legacy images may be removed after confirming no environments
reference them. Deleting them is not required to protect new environments.
Validation
with hashing. They cover legacy images, successive same-filename
replacements, unchanged size/mtime, reuse across locations, rollback,
unreadable wheels, both pip versions, and copy/symlink seeding.
cache tests.
%checkpassed:408 passed, 40 skipped, 2 deselected.
release 9 corrected retained caches. Both pip versions rejected all 14
incident chains in copy and symlink modes, with fresh and retained caches.
were reused when appropriate and existing environments remained unchanged.
embedded pip wheel on the validation VM, not an end-to-end latency measure.
were verified.
ARM64 native validation remains pending.