Add torture script

[woodruffw]

Just saving this as a development artifact, should not be merged as-is.

[woodruffw]

Current failures:

{
  "elapsed_seconds": 0.177,
  "filename": "griffe-2.0.2.tar.gz",
  "outcome": "failed_extract",
  "project": "griffe",
  "rank": 780,
  "sha256": "c5d56326d159f274492e9bf93a9895cec101155d944caa66d0fc4e0c13751b92",
  "stderr": "error: at byte 269312: invalid link griffe-2.0.2/docs/logo.svg -> \"../logo.svg\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/4a/49/eb6d2935e27883af92c930ed40cc4c69bcd32c402be43b8ca4ab20510f67/griffe-2.0.2.tar.gz"
}
{
  "elapsed_seconds": 0.08,
  "filename": "flask_wtf-1.3.0.tar.gz",
  "outcome": "failed_extract",
  "project": "flask-wtf",
  "rank": 960,
  "sha256": "61d5dabc50c3df885c297dcbd80810443a5d632106c8a69cab8ce740f0cdd7cc",
  "stderr": "error: at byte 158208: invalid link flask_wtf-1.3.0/.hgignore -> \".dotfiles/mercurial/.hgignore\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/91/f1/605a56d4ea217b307f3e6f4d663e0351253d85d841edc93ba559f0648e19/flask_wtf-1.3.0.tar.gz"
}
{
  "elapsed_seconds": 0.52,
  "filename": "bio-1.8.3.tar.gz",
  "outcome": "failed_extract",
  "project": "bio",
  "rank": 2178,
  "sha256": "5c01920d842fdc7a15212c1af50296db30fa76a3bd3597f8c65724b294557937",
  "stderr": "error: at byte 11540480: invalid link bio-1.8.3/test/run/alias.txt -> \"../data/alias.txt\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/4d/5c/9e28f4b7902160965f7901126d303cfa8255821b25a3c8348a3d91317953/bio-1.8.3.tar.gz"
}
{
  "elapsed_seconds": 22.0,
  "filename": "nbclassic-1.3.3.tar.gz",
  "outcome": "failed_extract",
  "project": "nbclassic",
  "rank": 2627,
  "sha256": "434228763f8cee754318cd6dfa42370db191af630dabab8e30bafc8c1aa3eee6",
  "stderr": "error: at byte 86036480: invalid link nbclassic-1.3.3/nbclassic/static/components/jquery-typeahead/node_modules/.bin/lz-string -> \"../../../lz-string/bin/bin.js\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/ec/cc/a495b5eb9a964b70c6ae8c861168b78386d2520fd89c68390932f96400b2/nbclassic-1.3.3.tar.gz"
}
{
  "elapsed_seconds": 0.086,
  "filename": null,
  "outcome": "failed_metadata",
  "project": "aaaaaaaaa",
  "rank": 4285,
  "sha256": null,
  "stderr": "HTTP Error 404: Not Found",
  "url": null
}
{
  "elapsed_seconds": 1.215,
  "filename": "scanpy-1.12.1.tar.gz",
  "outcome": "failed_extract",
  "project": "scanpy",
  "rank": 5086,
  "sha256": "489c6a3763311721089bf0d78e65fd1555606b45f1a9ee97aa85291a12ade67a",
  "stderr": "error: at byte 2942464: invalid link scanpy-1.12.1/docs/how-to/cell-cycle.ipynb -> \"../../notebooks/how-to/cell-cycle.ipynb\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/11/18/1ed26bd2231d9bbe9bfe6ba678fdd261d1ec664ab1bca1d30401dc2a9193/scanpy-1.12.1.tar.gz"
}
{
  "elapsed_seconds": 0.049,
  "filename": "logging-0.4.9.6.tar.gz",
  "outcome": "failed_extract",
  "project": "logging",
  "rank": 6054,
  "sha256": "26f6b50773f085042d301085bd1bf5d9f3735704db9f37c1ce6d8b85c38f2417",
  "stderr": "error: at byte 0: invalid tar checksum: stored None, computed 4903",
  "url": "https://files.pythonhosted.org/packages/93/4b/979db9e44be09f71e85c9c8cfc42f258adfb7d93ce01deed2788b2948919/logging-0.4.9.6.tar.gz"
}
{
  "elapsed_seconds": 0.053,
  "filename": "bgutil_ytdlp_pot_provider-1.3.1.tar.gz",
  "outcome": "failed_extract",
  "project": "bgutil-ytdlp-pot-provider",
  "rank": 6869,
  "sha256": "130635912e2450757438f72068b900076ac1a62d9f26a00afbe6f2ab258e8b25",
  "stderr": "error: at byte 31744: unsafe member path \"bgutil_ytdlp_pot_provider-1.3.1/../README.md\": contains a parent-directory component",
  "url": "https://files.pythonhosted.org/packages/ad/3f/fae025f0f4f4e8c40ca24a97f618abba82ad2a221d37ac3df7d6ff705df2/bgutil_ytdlp_pot_provider-1.3.1.tar.gz"
}
{
  "elapsed_seconds": 4.583,
  "filename": "openmeteo_requests-1.7.5.tar.gz",
  "outcome": "failed_extract",
  "project": "openmeteo-requests",
  "rank": 6853,
  "sha256": "5557b5df957aa00f5e673d85ddc47f8b5bcadde6c72a98c0ec1999b538db39f9",
  "stderr": "error: at byte 482816: invalid link openmeteo_requests-1.7.5/node_modules/.bin/conventional-changelog-writer -> \"../conventional-changelog-writer/dist/cli/index.js\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/f0/dd/b645df0f975c0bca1415fc7d2920615f35d4f8f092e9f6012c234ce212f5/openmeteo_requests-1.7.5.tar.gz"
}
{
  "elapsed_seconds": 3.687,
  "filename": "kuzu-0.11.3.tar.gz",
  "outcome": "failed_extract",
  "project": "kuzu",
  "rank": 6992,
  "sha256": "e7bea3ca30c4bb462792eedcaa7f2125c800b243bb4a872e1eedc16917c1967a",
  "stderr": "error: at byte 52568064: invalid link sdist/kuzu-source/tools/rust_api/kuzu-src -> \"../..\": materialization target is not a regular file",
  "url": "https://files.pythonhosted.org/packages/96/0c/f141a81485729a072dc527b474e7580d5632309c68ad1a5aa6ed9ac45387/kuzu-0.11.3.tar.gz"
}
{
  "elapsed_seconds": 0.077,
  "filename": "snowflake_cli_labs-3.20.0.tar.gz",
  "outcome": "failed_extract",
  "project": "snowflake-cli-labs",
  "rank": 9581,
  "sha256": "727d600a0f3afe8a692e220055978a823964d368a239f16cbaa51aa7f6ed6414",
  "stderr": "error: at byte 34304: unsafe symbolic-link target \"../../LICENSE\": escapes the destination root",
  "url": "https://files.pythonhosted.org/packages/1c/f6/651d744912a6fd7125bf0e599c6389b68debd3a8859e3c711ab7e78c17e3/snowflake_cli_labs-3.20.0.tar.gz"
}
{
  "elapsed_seconds": 6.373,
  "filename": "imgui_bundle-1.92.801.tar.gz",
  "outcome": "failed_extract",
  "project": "imgui-bundle",
  "rank": 9469,
  "sha256": "7d790708affe7476969d397784b40eb91760a201ce752131e5bedf4d514e3a45",
  "stderr": "error: at byte 30201344: invalid link imgui_bundle-1.92.801/external/hello_imgui/hello_imgui/docs_src/doc_api.md -> \"../src/hello_imgui/doc_api.md\": target was not created by this extraction",
  "url": "https://files.pythonhosted.org/packages/c1/b9/4217165c5fa832dbe662c2d96f0810aa7280eb2cc3bcae2b7ac4260e3f08/imgui_bundle-1.92.801.tar.gz"
}

From:

jq 'select(.outcome | contains("failed"))'  < target/tarpit-pypi/runs/20260615T204049Z/results.jsonl

[woodruffw]

After #30:

{
  "elapsed_seconds": 0.087,
  "filename": null,
  "outcome": "failed_metadata",
  "project": "aaaaaaaaa",
  "rank": 4285,
  "sha256": null,
  "stderr": "HTTP Error 404: Not Found",
  "url": null
}
{
  "elapsed_seconds": 0.04,
  "filename": "logging-0.4.9.6.tar.gz",
  "outcome": "failed_extract",
  "project": "logging",
  "rank": 6054,
  "sha256": "26f6b50773f085042d301085bd1bf5d9f3735704db9f37c1ce6d8b85c38f2417",
  "stderr": "error: at byte 0: invalid tar checksum: stored None, computed 4903",
  "url": "https://files.pythonhosted.org/packages/93/4b/979db9e44be09f71e85c9c8cfc42f258adfb7d93ce01deed2788b2948919/logging-0.4.9.6.tar.gz"
}
{
  "elapsed_seconds": 0.056,
  "filename": "bgutil_ytdlp_pot_provider-1.3.1.tar.gz",
  "outcome": "failed_extract",
  "project": "bgutil-ytdlp-pot-provider",
  "rank": 6869,
  "sha256": "130635912e2450757438f72068b900076ac1a62d9f26a00afbe6f2ab258e8b25",
  "stderr": "error: at byte 31744: unsafe member path \"bgutil_ytdlp_pot_provider-1.3.1/../README.md\": contains a parent-directory component",
  "url": "https://files.pythonhosted.org/packages/ad/3f/fae025f0f4f4e8c40ca24a97f618abba82ad2a221d37ac3df7d6ff705df2/bgutil_ytdlp_pot_provider-1.3.1.tar.gz"
}
{
  "elapsed_seconds": 0.044,
  "filename": "snowflake_cli_labs-3.20.0.tar.gz",
  "outcome": "failed_extract",
  "project": "snowflake-cli-labs",
  "rank": 9581,
  "sha256": "727d600a0f3afe8a692e220055978a823964d368a239f16cbaa51aa7f6ed6414",
  "stderr": "error: at byte 34304: unsafe symbolic-link target \"../../LICENSE\": escapes the destination root",
  "url": "https://files.pythonhosted.org/packages/1c/f6/651d744912a6fd7125bf0e599c6389b68debd3a8859e3c711ab7e78c17e3/snowflake_cli_labs-3.20.0.tar.gz"
}

Edit: (1) is a missing file, (2) is a genuinely broken tar, and (3)/(4) are rejected by both pip and uv. So these are acceptable.