FAILURE MAP
← Case archive

FA-9451 / Dependency resolution / Open access

Lockfile consistency report: A package can silently change origin · case 01

A package can silently change origin.

Verified by executionVariant 1 · 7 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The implementation substitutes False for wanted[n][2] != locked[n][2], so a package can silently change origin.

VERIFIED REPAIR

Compare source identity independently of name and version.

Unsuccessful approach: The attempted repair substitutes wanted[n][2] == locked[n][2]. Fixture 4 still yields {'missing': [], 'extra': [], 'version': ['a'], 'digest': [], 'source': ['a']} instead of {'missing': [], 'extra': [], 'version': ['a'], 'digest': [], 'source': []}.

Case contract

Report missing names, extra names, version mismatches, digest mismatches, and source mismatches as separate sorted lists. Only compare names present on both sides.

Why this case matters

An offline model of lockfile consistency report, suitable for testing build and release tooling without external services.

1 / The failure

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(wanted, locked):
    common = set(wanted) & set(locked)
    return {
     'missing': sorted(set(wanted) - set(locked)),
     'extra': sorted(set(locked) - set(wanted)),
     'version': sorted(n for n in common if wanted[n][0] != locked[n][0]),
     'digest': sorted(n for n in common if wanted[n][1] != locked[n][1]),
     'source': sorted(n for n in common if False)
    }
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve({}, {}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': []})
check('fixture 2', solve({'a': ('1', 'd', 'public')}, {}), {'missing': ['a'], 'extra': [], 'version': [], 'digest': [], 'source': []})
check('fixture 3', solve({}, {'b': ('1', 'd', 'public')}), {'missing': [], 'extra': ['b'], 'version': [], 'digest': [], 'source': []})
check('fixture 4', solve({'a': ('1', 'd', 'public')}, {'a': ('2', 'd', 'public')}), {'missing': [], 'extra': [], 'version': ['a'], 'digest': [], 'source': []})
check('fixture 5', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'e', 'public')}), {'missing': [], 'extra': [], 'version': [], 'digest': ['a'], 'source': []})
check('fixture 6', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'd', 'private')}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': ['a']})
check('fixture 7', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'd', 'public')}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': []})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed
fixture 2{'digest': [], 'extra': [], 'missing': ['a'], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': ['a'], 'source': [], 'version': []}Passed
fixture 3{'digest': [], 'extra': ['b'], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': ['b'], 'missing': [], 'source': [], 'version': []}Passed
fixture 4{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': ['a']}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': ['a']}Passed
fixture 5{'digest': ['a'], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': ['a'], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed
fixture 6{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': ['a'], 'version': []}Failed
fixture 7{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed

SHA-256 / 9234ab7a979e975cb908fa2295a185fbe77c7e697bfb6feb4c5a2f67be1f15e5

2 / The unsuccessful fix

Exit 1
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(wanted, locked):
    common = set(wanted) & set(locked)
    return {
     'missing': sorted(set(wanted) - set(locked)),
     'extra': sorted(set(locked) - set(wanted)),
     'version': sorted(n for n in common if wanted[n][0] != locked[n][0]),
     'digest': sorted(n for n in common if wanted[n][1] != locked[n][1]),
     'source': sorted(n for n in common if wanted[n][2] == locked[n][2])
    }
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve({}, {}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': []})
check('fixture 2', solve({'a': ('1', 'd', 'public')}, {}), {'missing': ['a'], 'extra': [], 'version': [], 'digest': [], 'source': []})
check('fixture 3', solve({}, {'b': ('1', 'd', 'public')}), {'missing': [], 'extra': ['b'], 'version': [], 'digest': [], 'source': []})
check('fixture 4', solve({'a': ('1', 'd', 'public')}, {'a': ('2', 'd', 'public')}), {'missing': [], 'extra': [], 'version': ['a'], 'digest': [], 'source': []})
check('fixture 5', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'e', 'public')}), {'missing': [], 'extra': [], 'version': [], 'digest': ['a'], 'source': []})
check('fixture 6', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'd', 'private')}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': ['a']})
check('fixture 7', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'd', 'public')}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': []})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed
fixture 2{'digest': [], 'extra': [], 'missing': ['a'], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': ['a'], 'source': [], 'version': []}Passed
fixture 3{'digest': [], 'extra': ['b'], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': ['b'], 'missing': [], 'source': [], 'version': []}Passed
fixture 4{'digest': [], 'extra': [], 'missing': [], 'source': ['a'], 'version': ['a']}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': ['a']}Failed
fixture 5{'digest': ['a'], 'extra': [], 'missing': [], 'source': ['a'], 'version': []}{'digest': ['a'], 'extra': [], 'missing': [], 'source': [], 'version': []}Failed
fixture 6{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': ['a'], 'version': []}Failed
fixture 7{'digest': [], 'extra': [], 'missing': [], 'source': ['a'], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}Failed

SHA-256 / 9ade86177bf4ecd9a9967bbb37593808c2bb63c0f9d84da8786c009bb38a88e7

3 / The verified repair

Exit 0
"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(wanted, locked):
    common = set(wanted) & set(locked)
    return {
     'missing': sorted(set(wanted) - set(locked)),
     'extra': sorted(set(locked) - set(wanted)),
     'version': sorted(n for n in common if wanted[n][0] != locked[n][0]),
     'digest': sorted(n for n in common if wanted[n][1] != locked[n][1]),
     'source': sorted(n for n in common if wanted[n][2] != locked[n][2])
    }
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve({}, {}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': []})
check('fixture 2', solve({'a': ('1', 'd', 'public')}, {}), {'missing': ['a'], 'extra': [], 'version': [], 'digest': [], 'source': []})
check('fixture 3', solve({}, {'b': ('1', 'd', 'public')}), {'missing': [], 'extra': ['b'], 'version': [], 'digest': [], 'source': []})
check('fixture 4', solve({'a': ('1', 'd', 'public')}, {'a': ('2', 'd', 'public')}), {'missing': [], 'extra': [], 'version': ['a'], 'digest': [], 'source': []})
check('fixture 5', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'e', 'public')}), {'missing': [], 'extra': [], 'version': [], 'digest': ['a'], 'source': []})
check('fixture 6', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'd', 'private')}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': ['a']})
check('fixture 7', solve({'a': ('1', 'd', 'public')}, {'a': ('1', 'd', 'public')}), {'missing': [], 'extra': [], 'version': [], 'digest': [], 'source': []})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
Boundary fixtureActualExpectedOutcome
fixture 1{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed
fixture 2{'digest': [], 'extra': [], 'missing': ['a'], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': ['a'], 'source': [], 'version': []}Passed
fixture 3{'digest': [], 'extra': ['b'], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': ['b'], 'missing': [], 'source': [], 'version': []}Passed
fixture 4{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': ['a']}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': ['a']}Passed
fixture 5{'digest': ['a'], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': ['a'], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed
fixture 6{'digest': [], 'extra': [], 'missing': [], 'source': ['a'], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': ['a'], 'version': []}Passed
fixture 7{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}{'digest': [], 'extra': [], 'missing': [], 'source': [], 'version': []}Passed

SHA-256 / 6d068b8e742d9824d4234224771f4bbf5faf8b1df4b67e08124dfe59331b4905

Verification & scope

This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:30.082684+00:00.

Case digest / 0c14d16933d7366ff5cdbe5a12c9b54375a2f286907b5844a2d2c4c90b2f687c