Repository navigation
bug(infra): backend image floats on python:3.13-slim — Debian release drift (bookworm→trixie) shipped libmagic 5.46 unnoticed, pin the codename or add a capability parity test #3079
Description
Summary
#3046 was closed by a code-side workaround in upload_service.py (PR #3066: trust the ZIP container signature for a declared application/zip). The underlying cause is still live: docker/backend/Dockerfile builds FROM python:3.13-slim with no Debian codename, so a rebuild on any host silently follows Docker Hub when the tag is repointed. That is how bookworm→trixie brought in libmagic1t64 1:5.46-5 (buffer-detection regression, Debian bug #1115393) and, earlier, dropped the tzdata backward-compat links (#1823).
Two occurrences of the same class within one release cycle. Each was patched at the symptom; nothing stops the third.
Options (either closes this)
- Pin the codename in
docker/{backend,scheduler,base-image}/Dockerfile—python:3.13-slim-bookworm(or-trixiedeliberately, once trixie's libmagic is verified) — so a base-image change is a reviewed diff, not a rebuild side effect. Pair with the Python-version parity guard so the pin has one home (tests/unit/test_1891_python_version_parity.pyis the precedent). - Capability parity test for libmagic, the shape bug: legacy IANA timezone aliases (Europe/Kiev et al.) crash schedule creation with a 500 — pytz accepts, APScheduler's zoneinfo lookup can't resolve them inside the shipped image #1823 used for tz: a test that runs inside the built backend image (the
prod-image-smoke/backend-image-smokejob is the natural host) builds a real in-memory ZIP and assertsmagic.from_buffer(data, mime=True) == "application/zip", so the next libmagic regression fails CI instead of production.
The #3046 unit test test_real_zip_accepted_with_unmocked_magic runs on the CI runner's libmagic, not the image's, so it does not cover this — it passes on ubuntu-latest regardless of what the shipped image resolves.
Related
- bug(uploads): every ZIP attachment is rejected as 'file type mismatch' — libmagic 5.46 (trixie) misdetects ZIP via from_buffer #3046 / fix: accept declared ZIP uploads by signature when libmagic 5.46 misdetects them (#3046) #3066 — the ZIP symptom and its code-side fix
- bug: legacy IANA timezone aliases (Europe/Kiev et al.) crash schedule creation with a 500 — pytz accepts, APScheduler's zoneinfo lookup can't resolve them inside the shipped image #1823 —
tzdata-legacy, the previous occurrence of this drift class - bug: CI validates on Python 3.11 while every shipped image runs 3.13 #1891 — Python-version parity guard (the "one declaration, guarded" precedent)
Activity
fix(uploads): accept declared ZIP uploads by signature when libmagic …
test: require backend and scheduler to share a Debian codename; parse…
harimaruthachalam commentedon Sep 29, 2026
@vybe PR for this: #3082
python:3.13-slim-trixie. Trixie rather than bookworm, because both already install trixie-only packages (tzdata-legacy,postgresql-client-17). The tag resolves to the same image ID as today'spython:3.13-slim, so nothing rebuilds differently.FROM python:to name a codename (not a specific one, per test_1823), and requires backend and scheduler to share it, so validator and executor keep one tz database. It handles--platform, multi-stageAS, digest and alpine tags.#3081 and #3082 each add an entry at the top of
tests/registry.json. Whichever merges second, I'll resolve that with a follow-up commit.fix: pin the Debian codename on the backend and scheduler base images (…