vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Phase 4: the runner uploads the log, so the server cannot write it

86fe5bb49ddeeb89a5d58459f27a86a83f82481a · Keenan Nemetz · 17d ago · parent 9cc2f087

Phase 4: the runner uploads the log, so the server cannot write it

Streaming made the server the author of bytes the runner produced. Heartbeats
carried output chunks; the server concatenated them into a SQLite column and, at
finish, hashed the result itself with `LFS.PutBytes`. So the archived object's id was
the server's, not the writer's — the one output in the system that worked that way,
since artifacts are uploaded by the runner through put-object and pages/releases are
pushed by it. Nothing depended on it, which is why it was harmless; a signed run
record could never have bound it, which is why it had to go.

Streaming is dropped. At finish the runner uploads its log through the same
git-lfs-transfer path artifacts use, gets the object id the store computed from the
content, and names it in the finish message. The server's rule is the artifact rule:
the store is the authority on whether the bytes exist, and a claimed size that is not
the object's size is refused. Heartbeats now carry nothing but the lease.

A log is per attempt, not per run. A job that kills a runner is requeued, so one run
can have several logs, and the interesting one is usually the attempt that died:
`run_logs(run_id, attempt, oid, size)` replaces the single column, `AttemptLogs`
reads them oldest first, `/runs/<id>/log` serves the newest and `?attempt=N` picks
one, and `vole gc` treats every attempt's object as a root. Rows written before this
change still have their `log_oid`, which reads keep honouring; `Store.Log` and
`SetLogOID` are gone with the code that used them.

The cost, stated plainly: there is no live tail any more, and an attempt whose runner
was killed leaves no log at all — the attempt that hung is exactly the log somebody
wants. That is the trade: a log that can be shown to be the runner's is worth more
than one that arrives early. It also removes an unbounded text column from the queue,
which was growing into the WAL and every backup until a run finished.

Verified: TestCheckRunLogTrustsTheStore pins the new rule at the boundary (stored log
accepted, size mismatch refused, object absent refused, non-oid refused, no store
refused); TestLogsAreRecordedPerAttempt shows two attempts recorded separately,
`Get` returning the newest, both objects named for the sweep, and a finished run
refusing a log; TestHeartbeatAndFinishNeedTheLease now proves a stranger can neither
heartbeat, nor finish, nor record a log, and that a finished run carries no log text;
and the end-to-end test that runs the real binary now asserts the served log hashes
to the object id in the run row and that the queue kept no copy of it. scripts/ci.sh
green (gofmt, vet, build, markdown links, go test -race ./...).

internal/sshserver/runlog_test.go +49

@@ -0,0 +1,49 @@
	1	package sshserver
	2
	3	// A run log is a claim about bytes, and the store is what makes it checkable: the
	4	// runner uploads the log, names the object id it computed, and the server records
	5	// that id only if the bytes are really there and are the size claimed. These tests
	6	// pin the rule for logs the way the artifact tests pin it for outputs — the log is
	7	// no longer assembled by the server, so this check is the whole guarantee.
	8
	9	import (
	10	"testing"
	11
	12	"github.com/rodent-software/vole/internal/lfs"
	13	)
	14
	15	func TestCheckRunLogTrustsTheStore(t *testing.T) {
	16	store := lfs.New(t.TempDir(), 1<<20)
	17	s := &Server{cfg: Config{LFS: store}}
	18
	19	text := []byte("=== demo · build · main @ 6beaa53\nok\n")
	20	oid, err := store.PutBytes(text)
	21	if err != nil {
	22	t.Fatal(err)
	23	}
	24	if err := s.checkRunLog(oid, int64(len(text))); err != nil {
	25	t.Fatalf("a stored log was refused: %v", err)
	26	}
	27
	28	// The size is part of the claim: a log that says the wrong length is a log whose
	29	// reader would be reading a different file than the one attested to.
	30	if err := s.checkRunLog(oid, 1); err == nil {
	31	t.Fatal("a size mismatch was accepted")
	32	}
	33
	34	// An object the store does not have is not a log, whatever it is called.
	35	missing := "0000000000000000000000000000000000000000000000000000000000000000"
	36	if err := s.checkRunLog(missing, 1); err == nil {
	37	t.Fatal("a log naming an object that is not in the store was accepted")
	38	}
	39	if err := s.checkRunLog("not-an-oid", 1); err == nil {
	40	t.Fatal("a log naming something that is not an object id was accepted")
	41	}
	42
	43	// An instance with no store cannot archive a log, and says so rather than
	44	// recording a pointer to nothing.
	45	bare := &Server{cfg: Config{}}
	46	if err := bare.checkRunLog(oid, int64(len(text))); err == nil {
	47	t.Fatal("an instance with no object store accepted a log")
	48	}
	49	}