fix: truncate an existing destination in make_targz

CHANGELOG.md

@@ -14,6 +14,7 @@ and **Merged pull requests**. Critical items to know are:
 The versions coincide with releases on pip. Only major versions will be released as tags on Github.
 
 ## [0.0.x](https://github.com/oras-project/oras-py/tree/main) (0.0.x)
+ - truncate an existing destination file in `make_targz`, which otherwise kept stale trailing bytes and produced a corrupt archive (0.2.44)
  - route push completion output through the logger and support the documented `quiet` option, closes issue [229](https://github.com/oras-project/oras-py/issues/229) (0.2.43)
  - add Layout `copy` for pull_from_registry capability (0.2.42)
  - make `get_manifest()` validation optional, fix `Accept` header join, and expand default `Accept` header types to cover all supported response types for the `/v2/<name>/manifests/<reference>` endpoint (0.2.41)

oras/tests/test_utils.py

@@ -6,6 +6,7 @@
 import os
 import pathlib
 import shutil
+import tarfile
 
 import pytest
 
@@ -146,3 +147,20 @@ def test_make_targz_files_with_same_content_generates_same_hash(tmp_path):
     hash_tar_2 = utils.get_file_hash(tmp_tar_2)
 
     assert hash_tar_1 == hash_tar_2
+
+
+def test_make_targz_overwrites_existing_destination(tmp_path):
+    tmp_file = str(tmp_path / "written_file.txt")
+    utils.write_file(tmp_file, "hello!")
+
+    expected = str(tmp_path / "expected.tar.gz")
+    utils.make_targz(tmp_file, expected)
+
+    # a larger, unrelated file already exists at the destination
+    dest = str(tmp_path / "existing.tar.gz")
+    utils.write_file(dest, "x" * 100000)
+    utils.make_targz(tmp_file, dest)
+
+    assert utils.get_file_hash(dest) == utils.get_file_hash(expected)
+    with tarfile.open(dest, "r:gz") as tar:
+        assert tar.getnames() == ["written_file.txt"]

oras/utils/fileio.py

@@ -41,8 +41,9 @@ def make_targz(source_dir: str, dest_name: Optional[str] = None) -> str:
 
     # os.O_WRONLY tells the computer you are only going to writo to the file, not read
     # os.O_CREATE tells the computer to create the file if it doesn't exist
+    # os.O_TRUNC discards any previous content of an existing file
     with os.fdopen(
-        os.open(dest_name, os.O_WRONLY | os.O_CREAT, 0o644), "wb"
+        os.open(dest_name, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o644), "wb"
     ) as out_file:
         with gzip.GzipFile(mode="wb", fileobj=out_file, mtime=0) as gzip_file:
             with tarfile.open(fileobj=gzip_file, mode="w:") as tar_file:

oras/version.py

@@ -2,7 +2,7 @@
 __copyright__ = "Copyright The ORAS Authors."
 __license__ = "Apache-2.0"
 
-__version__ = "0.2.43"
+__version__ = "0.2.44"
 AUTHOR = "Vanessa Sochat"
 EMAIL = "vsoch@users.noreply.github.com"
 NAME = "oras"