From e92d19c92ae449ca92213952d8f371bd5ee8e8cf Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 3 Aug 2026 09:52:54 -0700 Subject: [PATCH] fix: read __version__ from distribution metadata `__version__` was a second hardcoded literal alongside `pyproject.toml` and never moved, so it sat at "0.2.0" through both the 0.3.0 and 0.4.0 releases. `cli.py` passes it to `@click.version_option`, so: $ trace-tests --version trace-tests, version 0.2.0 # from a 0.4.0 install $ python -c "import importlib.metadata as m; \ print(m.version('agentrust-trace-tests'))" 0.4.0 Worse than a cosmetic slip. The v0.2 profile cutover shipped in 0.4.0 and a 0.2.x suite rejects every v0.2 record, so `--version` is precisely the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer, and it actively misled: a correctly upgraded user is told they still have the version that cannot verify their records. Found while running the suite against a freshly minted record: the record failed TR-ENV on the profile sentinel, and `--version` reported 0.2.0 both before and after upgrading to 0.4.0, so it gave no signal that the upgrade had worked. Fix reads the version from installed distribution metadata, removing the duplicate literal so it cannot fall behind a release again. Stdlib only, no new dependency. A source tree importable without an install has no metadata to read, so that falls back to "0.0.0+unknown" rather than guessing a number and reintroducing the drift. Two regression tests: `--version` output must contain the distribution version, and `__version__` must equal it, which fails if anyone restores a literal. Verified: `pip install -e .` then `trace-tests --version` -> 0.4.0. Full suite 118 passed, 5 xpassed (the 5 are pre-existing `xfail(strict=False)` hardware-TEE cases in tests/test_level2.py, untouched). Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 6 ++++++ src/trace_tests/__init__.py | 19 ++++++++++++++++++- tests/unit/test_cli.py | 26 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3b17422..4f98564 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## Unreleased +### Fixed + +- **`--version` reported the wrong version.** `__version__` was a second hardcoded literal alongside `pyproject.toml` and never moved, so it sat at `0.2.0` through both the 0.3.0 and 0.4.0 releases: `trace-tests --version` printed `0.2.0` from a 0.4.0 install while `importlib.metadata` correctly returned `0.4.0`. It is now read from installed distribution metadata, so there is one source of truth and the value cannot fall behind a release again. + + This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so `--version` is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer. + ## v0.4.0 — 2026-07-28 ### Changed diff --git a/src/trace_tests/__init__.py b/src/trace_tests/__init__.py index df4daf9..6084b2a 100644 --- a/src/trace_tests/__init__.py +++ b/src/trace_tests/__init__.py @@ -1,3 +1,20 @@ """TRACE conformance test suite.""" -__version__ = "0.2.0" +from importlib.metadata import PackageNotFoundError, version + +# Read the version from installed distribution metadata rather than restating it +# here. `pyproject.toml` is what the build and PyPI publish, so a second literal +# in this file is a copy that can fall behind silently: it sat at "0.2.0" through +# both the 0.3.0 and 0.4.0 releases, so `trace-tests --version` reported 0.2.0 +# from a 0.4.0 install. That is worse than cosmetic, because the v0.2 profile +# cutover landed in 0.4.0 and `--version` is the command someone runs to find out +# whether they have a suite that accepts v0.2 records. +try: + __version__ = version("agentrust-trace-tests") +except PackageNotFoundError: # pragma: no cover - source tree with no install + # Importable without being installed (e.g. PYTHONPATH against a checkout). + # There is no metadata to read here, and guessing a number would reintroduce + # the drift this exists to prevent. + __version__ = "0.0.0+unknown" + +__all__ = ["__version__"] diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py index c70c7a7..e9f9f9d 100644 --- a/tests/unit/test_cli.py +++ b/tests/unit/test_cli.py @@ -57,3 +57,29 @@ def test_partial_cmcp_envelope_is_rejected(tmp_path): result = CliRunner().invoke(main, ["verify", "--record", str(p), "--level", "0"]) assert result.exit_code == 2, result.output assert "partial cmcp-runtime envelope" in result.output + + +def test_version_matches_distribution_metadata(): + """`--version` must report the installed distribution version. + + `__version__` was a second hardcoded literal alongside `pyproject.toml` and + fell behind through two releases, so a 0.4.0 install reported 0.2.0. Since + the v0.2 profile cutover shipped in 0.4.0, `--version` was the one command + that could not tell you whether your suite accepts v0.2 records. + """ + from importlib.metadata import version + + expected = version("agentrust-trace-tests") + result = CliRunner().invoke(main, ["--version"]) + + assert result.exit_code == 0, result.output + assert expected in result.output, f"expected {expected!r} in {result.output!r}" + + +def test_dunder_version_is_not_a_stale_literal(): + """Guard against reverting to a hardcoded `__version__`.""" + from importlib.metadata import version + + import trace_tests + + assert trace_tests.__version__ == version("agentrust-trace-tests")