ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(installer): require the wheelhouse to satisfy requirements.txt, and lock the real payload

Browse Source 
The lock records what IS in the wheelhouse, not what the application NEEDS, so
an incomplete wheelhouse was locked, blessed and shipped - and only failed on an
air-gapped server.

That is not hypothetical. Assembling the wheelhouse anywhere other than Windows
silently omits colorama, a win32-only dependency of click, because pip evaluates
environment markers against the machine doing the downloading rather than the
machine being targeted. The bundle built here was short exactly that one wheel.

Both verifiers now cross-check wheels/ against the staged requirements.txt,
ignoring markers, since a requirement guarded by sys_platform == 'win32' is
precisely the one that must be present. Names are normalised to PEP 427 wheel
form, so mysql-connector-python matches mysql_connector_python.

bundle-lock.json is the first real lock: 42 files, cp314/win_amd64 - 39 wheels,
Python 3.14.6, HttpPlatformHandler 1.2 and URL Rewrite. MySQL is absent and
optional; a site choosing the bundled-database option adds it and re-locks.

The naming gate now skips the installer's build output. It contains a staged
copy of the application plus a second SPA build under dist-subpath, which
--exclude-dir=dist does not match, so a staged bundle failed the gate on
vendored minified JS nobody in this repository wrote.
This commit is contained in:
cproudlock
2026-08-03 11:46:39 -04:00
parent 44237b5cbd
commit 13d831eb90
5 changed files with 327 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

197
deploy/windows/installer/bundle-lock.json Normal file
View File

@@ -0,0 +1,197 @@
{
"schema": 1,
"generated": "2026-08-03T15:45:11Z",
"pythontag": "cp314",
"platform": "win_amd64",
"note": "Exact third-party payload of the installer bundle. Regenerate with refresh-bundle-lock.ps1 and COMMIT the change as a reviewed dependency bump.",
"payloads": {
"wheels": {
"required": true,
"files": {
"jinja2-3.1.6-py3-none-any.whl": {
"size": 134899,
"sha256": "85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"
},
"itsdangerous-2.2.0-py3-none-any.whl": {
"size": 16234,
"sha256": "c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef"
},
"cffi-2.1.0-cp314-cp314-win_amd64.whl": {
"size": 187937,
"sha256": "1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb"
},
"email_validator-2.3.0-py3-none-any.whl": {
"size": 35604,
"sha256": "80f13f623413e6b197ae73bb10bf4eb0908faf509ad8362c5edeb0be7fd450b4"
},
"urllib3-2.7.0-py3-none-any.whl": {
"size": 131087,
"sha256": "9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897"
},
"flask_jwt_extended-4.7.3-py2.py3-none-any.whl": {
"size": 22698,
"sha256": "905ac807b52b5409bc9244dbcca434968c13ca6f9d91bffe7d4cb71e0e6231cb"
},
"flask_sqlalchemy-3.1.1-py3-none-any.whl": {
"size": 25125,
"sha256": "4ba4be7f419dc72f4efd8802d69974803c37259dd42f3913b0dcf75c9447e0a0"
},
"pycparser-3.0-py3-none-any.whl": {
"size": 48172,
"sha256": "b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992"
},
"requests-2.33.1-py3-none-any.whl": {
"size": 64947,
"sha256": "4e6d1ef462f3626a1f0a0a9c42dd93c63bad33f9f1c1937509b8c5c8718ab56a"
},
"blinker-1.9.0-py3-none-any.whl": {
"size": 8458,
"sha256": "ba0efaa9080b619ff2f3459d1d500c57bddea4a6b424b60a91141db6fd2f08bc"
},
"greenlet-3.5.0-cp314-cp314-win_amd64.whl": {
"size": 239835,
"sha256": "3bc59be3945ae9750b9e7d45067d01ae3fe90ea5f9ade99239dabdd6e28a5033"
},
"marshmallow_sqlalchemy-1.5.0-py3-none-any.whl": {
"size": 16582,
"sha256": "3865232672f3dd38c4d5e4e85fdedce76904200742c3594948a2d11d0af93258"
},
"alembic-1.18.4-py3-none-any.whl": {
"size": 263893,
"sha256": "a5ed4adcf6d8a4cb575f3d759f071b03cd6e5c7618eb796cb52497be25bfe19a"
},
"pyjwt-2.12.1-py3-none-any.whl": {
"size": 29726,
"sha256": "28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c"
},
"mako-1.3.12-py3-none-any.whl": {
"size": 78521,
"sha256": "8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9"
},
"waitress-3.0.2-py3-none-any.whl": {
"size": 56232,
"sha256": "c56d67fd6e87c2ee598b76abdd4e96cfad1f24cacdea5078d382b1f9d7b5ed2e"
},
"colorama-0.4.6-py2.py3-none-any.whl": {
"size": 25335,
"sha256": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
},
"certifi-2026.4.22-py3-none-any.whl": {
"size": 135707,
"sha256": "3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a"
},
"cachelib-0.13.0-py3-none-any.whl": {
"size": 20914,
"sha256": "8c8019e53b6302967d4e8329a504acf75e7bc46130291d30188a6e4e58162516"
},
"pymysql-1.1.3-py3-none-any.whl": {
"size": 45356,
"sha256": "8164ba62c552f6105f3b11753352d0f16b90d1703ba67d81923d5a8a5d1c5289"
},
"werkzeug-3.1.8-py3-none-any.whl": {
"size": 226459,
"sha256": "63a77fb8892bf28ebc3178683445222aa500e48ebad5ec77b0ad80f8726b1f50"
},
"idna-3.13-py3-none-any.whl": {
"size": 68629,
"sha256": "892ea0cde124a99ce773decba204c5552b69c3c67ffd5f232eb7696135bc8bb3"
},
"python_dotenv-1.2.2-py3-none-any.whl": {
"size": 22101,
"sha256": "1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a"
},
"flask_marshmallow-1.5.0-py3-none-any.whl": {
"size": 12161,
"sha256": "99951c77e5654111ed733811c6dc9310bfb4c3688c78a9e76f80b5ae0b2279a6"
},
"markupsafe-3.0.3-cp314-cp314-win_amd64.whl": {
"size": 15341,
"sha256": "bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581"
},
"flask_cors-6.0.2-py3-none-any.whl": {
"size": 13257,
"sha256": "e57544d415dfd7da89a9564e1e3a9e515042df76e12130641ca6f3f2f03b699a"
},
"flask_caching-2.4.0-py3-none-any.whl": {
"size": 28727,
"sha256": "d15b8135f055c4f28f6f7dbcf8d36a3de4af1224def975ae6e0b43cbfa684486"
},
"tzdata-2026.3-py2.py3-none-any.whl": {
"size": 348168,
"sha256": "dc096730c87af6cab1b171c9d532be840741ff5d459015e7f6947bd7d7e54931"
},
"charset_normalizer-3.4.7-cp314-cp314-win_amd64.whl": {
"size": 159634,
"sha256": "92a0a01ead5e668468e952e4238cccd7c537364eb7d851ab144ab6627dbbe12f"
},
"sqlalchemy-2.0.49-cp314-cp314-win_amd64.whl": {
"size": 2144204,
"sha256": "77641d299179c37b89cf2343ca9972c88bb6eef0d5fc504a2f86afd15cd5adf5"
},
"marshmallow-4.3.0-py3-none-any.whl": {
"size": 49148,
"sha256": "46c4fe6984707e3cbd485dfebbf0a59874f58d695aad05c1668d15e8c6e13b46"
},
"dnspython-2.8.0-py3-none-any.whl": {
"size": 331094,
"sha256": "01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af"
},
"typing_extensions-4.15.0-py3-none-any.whl": {
"size": 44614,
"sha256": "f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548"
},
"flask-3.1.3-py3-none-any.whl": {
"size": 103424,
"sha256": "f4bcbefc124291925f1a26446da31a5178f9483862233b23c0c96a20701f670c"
},
"tabulate-0.10.0-py3-none-any.whl": {
"size": 39814,
"sha256": "f0b0622e567335c8fabaaa659f1b33bcb6ddfe2e496071b743aa113f8774f2d3"
},
"mysql_connector_python-9.7.0-cp314-cp314-win_amd64.whl": {
"size": 18197576,
"sha256": "5a5abbc152bc28cb2e64a04605ecd9941eff6b0dc5f9528cb84adb873e9a1e49"
},
"Flask_Migrate-4.1.0-py3-none-any.whl": {
"size": 21237,
"sha256": "24d8051af161782e0743af1b04a152d007bad9772b2bca67b7ec1e8ceeb3910d"
},
"cryptography-50.0.0-cp311-abi3-win_amd64.whl": {
"size": 3840395,
"sha256": "bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30"
},
"click-8.3.3-py3-none-any.whl": {
"size": 110502,
"sha256": "a2bf429bb3033c89fa4936ffb35d5cb471e3719e1f3c8a7c3fff0b8314305613"
}
}
},
"python": {
"required": true,
"files": {
"python-3.14.6-amd64.exe": {
"size": 30774112,
"sha256": "14b3e9a710a3fcf0bd9b55ab6b60412bd91227563f813fc49040cabc0209e0bd"
}
}
},
"urlrewrite": {
"required": false,
"files": {
"rewrite_amd64_en-US.msi": {
"size": 6078464,
"sha256": "37342ff2f585f263f34f48e9de59eb1051d61015a8e967dbde4075716230a32a"
}
}
},
"httpplatformhandler": {
"required": true,
"files": {
"httpPlatformHandler_amd64.msi": {
"size": 557056,
"sha256": "90f8d4905a0ab4f2c95223b3c79e2807a0b74507747d240e43c4302e8db4b5ef"
}
}
}
}
}