Artifact c5c59e1bbd790bf871a436c5520978694e6733f5b582105002ee7bf31544ac13:
- File
internal/manifest/schedule.go
— part of check-in
[ed5e3ce5b5]
at
2026-10-24 03:44:17
on branch main
— fix(sync): refuse pushed seeds by hash; judge only what a fill grounds (#471)
Horizon F.1, push side, and the fourth review's blocking finding.
Refusal by hash: - seedcheck keeps two store-local tables, carried by no config group: seedpending(rid, root) and seedrefused(uuid). - A seed judged after the request that pushed it, because a later push, pull, check-in or tag filled its basis, has its hash refused. Its rows are deleted by Sweep, and only where no receive pass holds rids: end of request, end of sync, check-in, tag and rebuild. A deleted rid is reused by the next row, and a pass's caches are keyed by rid. - Until swept, such a row is withheld and never linked. A delta on a refused seed is left unreadable and pending under no root. - requestPhantoms never asks for a refused hash. ownSeedReadable refuses a re-push of one, and a full-text re-push is refused on its bytes. - A purge still forgets pending rows (ForgetDeleted). Refusals are keyed by hash, so rid reuse cannot pass them on.
Judging only what a fill grounds: - JudgeReadable rescanned every pending row on each fill. A pusher could plant dangling deltas without bound and make every later fill pay for all of them. - Pending rows now record the root of their basis chain, re-rooted when that root is itself stored as a dangling delta. - JudgeFilled judges only the rows pending on the rids just stored, and reports how many it examined. - Callers: AfterDephantomize and its batch, manifest.Checkin (its files and manifest) and tag.AddTag. linkArtifact still judges a pending row it reaches, caching which tables exist per transaction. - The sweep no longer judges.
A seed-shaped artifact received by pull or clone stays ordinary, per the 0.7.1 B.2. Docs and the HZ-5.2-4 scope note cite F.1.
Tests: - A seed package test: one fill examines its own row, not 200 planted elsewhere. Run as a rescan mutant, it fails. - A tag whose control artifact is a seed's basis refuses the seed. - The link step refuses a seed made readable by a raw store. - A re-push refused by hash, and an igot of the hash not gimme'd. - A delta on a refused seed withheld. - A purged pending rid reused by an innocent blob. - Disabling any judge call (cascade, check-in, tag, link) or any Sweep call (request, sync, check-in, tag) fails a test. (user: [email protected], size: 4455) [annotate] [blame] [check-ins using] [more...]
package manifest import ( "slices" "github.com/danmestas/go-libfossil/db" libfossil "github.com/danmestas/go-libfossil/internal/fsltype" "github.com/danmestas/go-libfossil/internal/leaf" "github.com/danmestas/go-libfossil/internal/repo" "github.com/danmestas/go-libfossil/internal/seedcheck" ) // batchSchedule is the work a crosslink batch defers to its repair gate: the // leaf rechecks its branch writes schedule (leaf.Pending, // draft-fossil-repo-state-01 Section 7.3), the primary parents whose tags // must be propagated again because the batch gave each of them a child, and // whether it linked anything since its last gate, which owes the reparent pass // even when it scheduled nothing else. All three describe writes in the // batch's transactions, so they are marked, rolled back and reset together. // // It is not safe for concurrent use; one batch owns one. type batchSchedule struct { leaves *leaf.Pending parents parentSet owed bool // seedTables caches, for one transaction, which seedcheck tables exist // (nil: not yet asked), so linking does not look them up per artifact. seedTables *seedcheck.Tables } // linkTx runs link in one transaction on r and, when link linked anything, // runs the whole repair gate (repairOnTx) before that transaction commits: // the reparent pass, tag propagation from the parents sched holds, and the // leaf rechecks sched holds. Fossil's manifest_crosslink_end does the same // inside the transaction that linked the check-ins (src/manifest.c; its // leaf_do_pending_checks runs before db_end_transaction). A link and the // repair it owes therefore commit or roll back together: no committed // check-in waits on a later gate for its parent's tags (issue #432) or its // leaf row (draft-fossil-repo-state-01 Section 7.3). On commit sched is // spent; on rollback everything this transaction scheduled is dropped. func linkTx(r *repo.Repo, sched *batchSchedule, link func(tx *db.Tx) error) error { if r == nil { panic("manifest.linkTx: r must not be nil") } if sched == nil { panic("manifest.linkTx: sched must not be nil") } mark := sched.mark() err := r.WithTx(func(tx *db.Tx) error { if err := link(tx); err != nil { return err } if !sched.owed { return nil // linked nothing: no gate is owed } return repairOnTx(tx, sched) }) if err != nil { sched.rollback(mark) return err } sched.reset() return nil } // scheduleMark is a point a batchSchedule can be rolled back to. type scheduleMark struct { leaves leaf.Mark parents int owed bool } func newBatchSchedule() *batchSchedule { return &batchSchedule{ leaves: leaf.NewPending(), parents: parentSet{seen: make(map[libfossil.FslID]struct{})}, } } // mark records the schedule's current extent, for a caller whose transaction // or savepoint may roll back. func (s *batchSchedule) mark() scheduleMark { return scheduleMark{leaves: s.leaves.Mark(), parents: len(s.parents.order), owed: s.owed} } // rollback forgets everything scheduled since m. func (s *batchSchedule) rollback(m scheduleMark) { s.leaves.Rollback(m.leaves) s.parents.truncate(m.parents) s.owed = m.owed s.seedTables = nil } // reset empties the schedule once the gate that ran it has committed. func (s *batchSchedule) reset() { s.leaves.Reset() s.parents.truncate(0) s.owed = false s.seedTables = nil } // parentSet holds the primary parents a batch wrote plink rows for, in the // order it first recorded them, so a rollback drops exactly what it added. // They are the parents repairTagPropagation starts from (issue #432). type parentSet struct { seen map[libfossil.FslID]struct{} order []libfossil.FslID } // add records pid, a primary parent whose plink row the batch just wrote. func (p *parentSet) add(pid libfossil.FslID) { if pid <= 0 { panic("manifest.parentSet.add: pid must be positive") } if _, ok := p.seen[pid]; ok { return } p.seen[pid] = struct{}{} p.order = append(p.order, pid) } func (p *parentSet) truncate(n int) { if n < 0 || n > len(p.order) { panic("manifest.parentSet.truncate: mark is past the set's end") } for _, pid := range p.order[n:] { delete(p.seen, pid) } p.order = p.order[:n] } // sorted returns the parents in ascending rid order, the order the // whole-repository pass visited them in, so a gate's writes are reproducible. func (p *parentSet) sorted() []libfossil.FslID { out := slices.Clone(p.order) slices.Sort(out) return out }