[focal/core20][python3.7+] staging conflicts when multiple python parts have the same python dependencies
Metadata
Current evaluation
Staging conflicts when multiple python parts share identical dependencies: Python 3.7+ .pyc files embed source timestamps, so identical sources produce different .pyc/RECORD hashes across parts. Reported for focal/core20, no maintainer response, 0 comments, open ~6 years.
Suggested action: needs triage
Reason: The issue has zero comments, no labels, and no maintainer interaction in ~6 years, so it has never been triaged. It is a genuine bug (reproducible staging conflict with clear root-cause analysis and a proposed SOURCE_DATE_EPOCH workaround), not a support request, but the focal/core20 target is now an EOL base, so a maintainer needs to decide whether to address it in current bases or close it as outdated.
Impact:
40
Quick Win:
18.0
Staleness:
90
Complexity:
55
Confidence:
60
Support Request:
15
Issue body
TL;DR: as of python 3.7, .pyc files by default include a timestamp and a size of the source file which results in a change of a hash every time a .pyc file is generated for a given source file. This results in staging conflicts for python parts.
https://docs.python.org/3/library/py_compile.html#py_compile.compile
https://docs.python.org/3/library/py_compile.html#py_compile.PycInvalidationMode.TIMESTAMP
Even if this is set, there is still an issue https://github.com/pypa/pip/issues/8414
Description/analysis:
When building a project with multiple identical python dependencies I consistently get an error like this:
Failed to stage: Parts 'openstack-projects' and 'cluster' have the following files, but with different contents:
bin/activate
bin/activate.csh
bin/activate.fish
bin/python3
pyvenv.cfg
bin/python3
lib/python3.8/site-packages/Flask-1.1.2.dist-info/RECORD
lib/python3.8/site-packages/__pycache__/easy_install.cpython-38.pyc
lib/python3.8/site-packages/certifi/__pycache__/__init__.cpython-38.pyc
lib/python3.8/site-packages/certifi/__pycache__/__main__.cpython-38.pyc
# many other .pyc files ...
While snapcraft suggests that I use something like `organize`, `filesets` and `stage`, the issue is that the source files for those dependencies are identical - there is no reason for any manual work here.
Source hashes are the same:
snapcraft-microstack # sha256sum ./parts/cluster/install/lib/python3.8/site-packages/click/_textwrap.py
6a30b3933165cb9b639bd7e843937dfcc39e69824c063025b6e15aebd9f88976
./parts/cluster/install/lib/python3.8/site-packages/click/_textwrap.py
snapcraft-microstack # sha256sum ./parts/openstack-projects/install/lib/python3.8/site-packages/click/_textwrap.py
6a30b3933165cb9b639bd7e843937dfcc39e69824c063025b6e15aebd9f88976 ./parts/openstack-projects/install/lib/python3.8/site-packages/click/_textwrap.py
.pyc files are different:
snapcraft-microstack # sha256sum ./parts/openstack-projects/install/lib/python3.8/site-packages/click/__pycache__/_textwrap.cpython-38.pyc
398b47a5abfc87e9da73153e42d48dcd5d917bd637a0e0af1eb6999f19fb1085 ./parts/openstack-projects/install/lib/python3.8/site-packages/click/__pycache__/_textwrap.cpython-38.pyc
snapcraft-microstack # sha256sum ./parts/cluster/install/lib/python3.8/site-packages/click/__pycache__/_textwrap.cpython-38.pyc
d4642cfecd727d228944a1d31ff728e7ef6529a7a88898f6568ea6e96d1f8f82 ./parts/cluster/install/lib/python3.8/site-packages/click/__pycache__/_textwrap.cpython-38.pyc
RECORD files include hashes as well, hence they are also different:
snapcraft-microstack # diff ./parts/openstack-projects/install/lib/python3.8/site-packages/Flask-1.1.2.dist-info/RECORD ./parts/cluster/install/lib/python3.8/site-packages/Flask-1.1.2.dist-info/RECORD
1c1
< ../../../bin/flask,sha256=VXQqccMeG03Rn8_yN8Kq3Up13rzyaoHsEckFnCxHor4,242
---
> ../../../bin/flask,sha256=NAzPpe84iZFX3PYsCZEirt3fAFObAjBuCpM25792kSU,231
Apparently, as of python 3.7, .pyc files include a timestamp and a size of the source by default (PycInvalidationMode.TIMESTAMP). There is a way to override this behavior by setting the SOURCE_DATE_EPOCH environment variable to switch py_compile to using PycInvalidationMode.CHECKED_HASH:
https://docs.python.org/3/library/py_compile.html
py_compile.compile(file, cfile=None, dfile=None, doraise=False, optimize=-1, invalidation_mode=PycInvalidationMode.TIMESTAMP, quiet=0)
invalidation_mode should be a member of the PycInvalidationMode enum and controls how the generated bytecode cache is invalidated at runtime. The default is PycInvalidationMode.CHECKED_HASH ***if the SOURCE_DATE_EPOCH environment variable is set***, otherwise ***the default is PycInvalidationMode.TIMESTAMP***.
https://docs.python.org/3/library/py_compile.html#py_compile.PycInvalidationMode.TIMESTAMP
TIMESTAMP
The .pyc file includes the timestamp and size of the source file, which Python will compare against the metadata of the source file at runtime to determine if the .pyc file needs to be regenerated.
https://docs.python.org/3/library/py_compile.html#py_compile.PycInvalidationMode.CHECKED_HASH
CHECKED_HASH
The .pyc file includes a hash of the source file content, which Python will compare against the source at runtime to determine if the .pyc file needs to be regenerated.
Adding something like this seems to be needed:
build-environment:
- SOURCE_DATE_EPOCH: '1591640328'
However, see https://bugs.launchpad.net/snapcraft/+bug/1882535/comments/2
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
40
Quick Win:
18.0
Staleness:
90
Complexity:
55
Confidence:
60
Support Request:
15
|
needs triage | Staging conflicts when multiple python parts share identical dependencies: Python 3.7+ .pyc files embed source timestamps, so identical sources produce different .pyc/RECORD hashes across parts. Reported for focal/core20, no maintainer response, 0 comments, open ~6 years. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
98
Complexity:
45
Confidence:
90
Support Request:
15
|
close stale | Staging conflicts arise when multiple Python parts share dependencies due to differing .pyc hashes from Python 3.7+ timestamp behavior. Reported six years ago with no maintainer response, targeting outdated Ubuntu releases. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
45
Confidence:
85
Support Request:
15
|
close stale | Snapcraft staging conflicts occur when multiple Python parts share dependencies due to Python 3.7+ .pyc timestamp hashing. Untriaged, inactive for ~2.7 years, no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
65
Confidence:
85
Support Request:
5
|
close stale | Snapcraft staging conflicts occur when multiple Python parts share identical dependencies due to differing .pyc file hashes in Python 3.7+. Issue is unlabelled, has zero comments, and has been inactive for over six years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
50
Confidence:
75
Support Request:
10
|
close stale | Snapcraft staging conflicts occur when multiple Python parts share dependencies. Python 3.7+ embeds timestamps in .pyc files, causing hash mismatches despite identical sources. Open, inactive for two years, awaiting a fix for deterministic .pyc generation. |
Update history
No update history recorded yet.
Related work
-
Related To:
pypa/pip#8414
(confidence 70%)
Referenced in the issue body as a related upstream pip issue affecting .pyc determinism even with hash-based invalidation.
Related issues
No related issues found above the similarity threshold.