Adds Pyodide version check to prevent incorrect bundle release.

cloudflare · Feb 27, 2025 · 7d6f4af · 7d6f4af
1 parent c97c8a6
commit 7d6f4af
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 2 deletions.
diff --git a/src/pyodide/internal/python.ts b/src/pyodide/internal/python.ts
@@ -29,6 +29,7 @@ import { default as SetupEmscripten } from 'internal:setup-emscripten';
 import { default as UnsafeEval } from 'internal:unsafe-eval';
 import { simpleRunPython } from 'pyodide-internal:util';
 import { loadPackages } from 'pyodide-internal:loadPackage';
+import { default as MetadataReader } from 'pyodide-internal:runtime-generated/metadata';
 
 /**
  * After running `instantiateEmscriptenModule` but before calling into any C
@@ -79,6 +80,28 @@ function maybeAddVendorDirectoryToPath(pyodide: Pyodide) {
   `);
 }
 
+/**
+ * Verifies that the Pyodide version in our compat flag matches our actual version. This is to
+ * prevent us accidentally releasing a Pyodide bundle built against a different version than one
+ * we expect.
+ */
+function validatePyodideVersion(Module: Module) {
+  const expectedPyodideVersion = MetadataReader.getPyodideVersion();
+  if (expectedPyodideVersion == 'dev') {
+    return;
+  }
+  try {
+    simpleRunPython(
+      Module,
+      `from pyodide import __version__ as v; assert v == \'${expectedPyodideVersion}\'; del v`
+    );
+  } catch {
+    throw new Error(
+      `Pyodide version mismatch, expected '${expectedPyodideVersion}'`
+    );
+  }
+}
+
 export async function loadPyodide(
   isWorkerd: boolean,
   lockfile: PackageLock,
@@ -118,6 +141,8 @@ export async function loadPyodide(
 
   finishSnapshotSetup(pyodide);
 
+  validatePyodideVersion(Module);
+
   // Need to set these here so that the logs go to the right context. If we don't they will go
   // to SetupEmscripten's context and end up being KJ_LOG'd, which we do not want.
   Module.API.initializeStreams(

diff --git a/src/workerd/io/compatibility-date.capnp b/src/workerd/io/compatibility-date.capnp
@@ -430,7 +430,7 @@ struct CompatibilityFlags @0x8f8c1b68151b6cef {
   pythonWorkers @43 :Bool
       $compatEnableFlag("python_workers")
       $pythonSnapshotRelease(pyodide = "0.26.0a2", pyodideRevision = "2024-03-01",
-          packages = "20240829.4", backport = 17,
+          packages = "20240829.4", backport = 18,
           baselineSnapshotHash = "d13ce2f4a0ade2e09047b469874dacf4d071ed3558fec4c26f8d0b99d95f77b5")
       $impliedByAfterDate(name = "pythonWorkersDevPyodide", date = "2000-01-01");
   # Enables Python Workers. Access to this flag is not restricted, instead bundles containing
@@ -721,7 +721,7 @@ struct CompatibilityFlags @0x8f8c1b68151b6cef {
       $impliedByAfterDate(name = "nodeJsCompat", date = "2025-04-01");
   # Automatically populate process.env from text bindings only
   # when nodejs_compat is being used.
-  
+
   cacheApiRequestCfOverridesCacheRules @77 :Bool
       $compatEnableFlag("cache_api_request_cf_overrides_cache_rules")
       $experimental