Lexicon.save_zip() can produce an archive containing the same .lift-ranges twice — once stale, once current — under names differing only in case.
Preconditions
Both must hold, which is why this is not seen in ordinary use:
- The LIFT folder is on a case-folding filesystem, and its
.lift and companion disagree in case (Dict.LIFT beside Dict.lift-ranges). This is what makes RangesFile.path carry a spelling that is not the on-disk name — _existing_file returns the candidate's spelling when the exact stat succeeds, and on a folding filesystem it succeeds for a case variant.
TMPDIR is on a case-sensitive filesystem. On macOS that is a case-sensitive APFS volume; on Linux, a LIFT folder on ciopfs / exfat / casefold-enabled ext4 with /tmp on ext4.
Normally these are the same filesystem — the divergence needs folding, and staging happens on the same machine — so the second write lands on the first file and nothing goes wrong.
Mechanism
save_zip (src/sil_lift/_zip.py) stages into a TemporaryDirectory, copies the whole source package in, then overwrites the rendered files by name:
shutil.copytree(source_root, content, dirs_exist_ok=True) # brings in Dict.lift-ranges
...
name = ranges_file.path.name if ranges_file.path is not None else Path(key).name
(content / name).write_bytes(render_ranges_document(ranges_file)) # writes Dict.LIFT-ranges
_write_zip then walks the staging directory, so members come from the filesystem rather than from the names. Where staging folds case, the second write overwrites the copied file and leaves its directory entry alone: one file, one member, correct bytes. Where staging does not fold, it creates a second file, and the archive gets both — the stale copytree'd bytes under the on-disk spelling and the rendered bytes under the href's spelling.
On read-back the duplicate is not rejected: _select_lift_member only guards against multiple .lift members, and two case-variant .lift-ranges are resolved the way any such folder is — one wins.
Fix options
- Narrow, in
save_zip: before writing, look for a file already in staging whose name folds onto name and write to that spelling instead. Keeps the change local to packaging.
- At the root, in
_resolve_ranges: hand RangesFile.load the canonical path so RangesFile.path always matches what is on disk. Tempting one-liner, but the canonical path is absolute and symlink-collapsed, so it changes a public attribute's value and what RangesFile.save() targets for every caller — a much wider blast radius than the defect.
The first looks right; the second is worth ruling out deliberately rather than by omission.
Notes
Pre-existing: _resolve_ranges passed the candidate's spelling to RangesFile.load before #19 as well. Split out of review discussion on #19, which kept its scope to companion resolution.
Lexicon.save_zip()can produce an archive containing the same.lift-rangestwice — once stale, once current — under names differing only in case.Preconditions
Both must hold, which is why this is not seen in ordinary use:
.liftand companion disagree in case (Dict.LIFTbesideDict.lift-ranges). This is what makesRangesFile.pathcarry a spelling that is not the on-disk name —_existing_filereturns the candidate's spelling when the exact stat succeeds, and on a folding filesystem it succeeds for a case variant.TMPDIRis on a case-sensitive filesystem. On macOS that is a case-sensitive APFS volume; on Linux, a LIFT folder on ciopfs / exfat / casefold-enabled ext4 with/tmpon ext4.Normally these are the same filesystem — the divergence needs folding, and staging happens on the same machine — so the second write lands on the first file and nothing goes wrong.
Mechanism
save_zip(src/sil_lift/_zip.py) stages into aTemporaryDirectory, copies the whole source package in, then overwrites the rendered files by name:_write_zipthen walks the staging directory, so members come from the filesystem rather than from the names. Where staging folds case, the second write overwrites the copied file and leaves its directory entry alone: one file, one member, correct bytes. Where staging does not fold, it creates a second file, and the archive gets both — the stale copytree'd bytes under the on-disk spelling and the rendered bytes under the href's spelling.On read-back the duplicate is not rejected:
_select_lift_memberonly guards against multiple.liftmembers, and two case-variant.lift-rangesare resolved the way any such folder is — one wins.Fix options
save_zip: before writing, look for a file already in staging whose name folds ontonameand write to that spelling instead. Keeps the change local to packaging._resolve_ranges: handRangesFile.loadthe canonical path soRangesFile.pathalways matches what is on disk. Tempting one-liner, but the canonical path is absolute and symlink-collapsed, so it changes a public attribute's value and whatRangesFile.save()targets for every caller — a much wider blast radius than the defect.The first looks right; the second is worth ruling out deliberately rather than by omission.
Notes
Pre-existing:
_resolve_rangespassed the candidate's spelling toRangesFile.loadbefore #19 as well. Split out of review discussion on #19, which kept its scope to companion resolution.