Merge pull request #195 from joseacl/issue-194

Make targz without mimetype

Author: vsoch

CHANGELOG.md

@@ -14,6 +14,7 @@ and **Merged pull requests**. Critical items to know are:
 The versions coincide with releases on pip. Only major versions will be released as tags on Github.
 
 ## [0.0.x](https://github.com/oras-project/oras-py/tree/main) (0.0.x)
+ - Make reproducible targz without mimetype (0.2.30)
  - don't include Content-Length header in upload_manifest (0.2.29)
  - propagate the tls_verify parameter to auth backends (0.2.28)
  - don't add an Authorization header is there is no token (0.2.27), closes issue [182](https://github.com/oras-project/oras-py/issues/182)

oras/tests/test_utils.py

@@ -130,3 +130,19 @@ def test_split_path_and_content():
     path_content = utils.split_path_and_content(testref)
     assert path_content.path == "path/to/config.json"
     assert not path_content.content
+
+
+def test_make_targz_files_with_same_content_generates_same_hash(tmp_path):
+    tmp_file = str(tmp_path / "written_file.txt")
+    utils.write_file(tmp_file, "hello!")
+
+    tmp_tar_1 = str(tmp_path / "test1.tar.gz")
+    utils.make_targz(tmp_file, tmp_tar_1)
+
+    tmp_tar_2 = str(tmp_path / "test2.tar.gz")
+    utils.make_targz(tmp_file, tmp_tar_2)
+
+    hash_tar_1 = utils.get_file_hash(tmp_tar_1)
+    hash_tar_2 = utils.get_file_hash(tmp_tar_2)
+
+    assert hash_tar_1 == hash_tar_2

oras/utils/fileio.py

@@ -3,6 +3,7 @@
 __license__ = "Apache-2.0"
 
 import errno
+import gzip
 import hashlib
 import io
 import json
@@ -26,13 +27,29 @@ def __init__(self, path: str, content: Optional[str] = None):
         self.content = content
 
 
+def reset(tarinfo):
+    """Helper to reset modification time for tar entries"""
+    tarinfo.mtime = 0
+    return tarinfo
+
+
 def make_targz(source_dir: str, dest_name: Optional[str] = None) -> str:
     """
-    Make a targz (compressed) archive from a source directory.
+    Make a reproducible (no mtime) targz (compressed) archive from a source directory.
     """
     dest_name = dest_name or get_tmpfile(suffix=".tar.gz")
-    with tarfile.open(dest_name, "w:gz") as tar:
-        tar.add(source_dir, arcname=os.path.basename(source_dir))
+
+    # os.O_WRONLY tells the computer you are only going to writo to the file, not read
+    # os.O_CREATE tells the computer to create the file if it doesn't exist
+    with os.fdopen(
+        os.open(dest_name, os.O_WRONLY | os.O_CREAT, 0o644), "wb"
+    ) as out_file:
+        with gzip.GzipFile(mode="wb", fileobj=out_file, mtime=0) as gzip_file:
+            with tarfile.open(fileobj=gzip_file, mode="w:") as tar_file:
+                tar_file.add(
+                    source_dir, filter=reset, arcname=os.path.basename(source_dir)
+                )
+
     return dest_name
 
 

oras/version.py

@@ -2,7 +2,7 @@
 __copyright__ = "Copyright The ORAS Authors."
 __license__ = "Apache-2.0"
 
-__version__ = "0.2.29"
+__version__ = "0.2.30"
 AUTHOR = "Vanessa Sochat"
 EMAIL = "vsoch@users.noreply.github.com"
 NAME = "oras"