bullion 0.11.5 → 0.11.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1e03e0297625063a198db254192ac85e7389a46bd1ebd0be1161f1221300e4d
-  data.tar.gz: 2c5a0729d0521920a378fa235f928b6c7eb4c16cd3ee9a63bf74fa89eca7168c
+  metadata.gz: 44ad24a873adf3bab2e535688588282797d477c7f973835094b52d00cb9c6592
+  data.tar.gz: ee339845aaaca5001f5a33f21c75448c8d59b19893191bbc91055d41b13edc66
 SHA512:
-  metadata.gz: 06e5aa78438a991e3e2cf9db8519a2c81bb35c3b872f1fc511ca7ea6d397088e3fce4642631d3dd7d77e9105e9fb4b808dfdc2b185fc121d3deebf8f3614e0d2
-  data.tar.gz: e3809f863bd43ff203a580b65a36e6d1f8f088cf12b1650ab7057cca3220019db00bfb231f7d85bbce983600d6488cd75f2748d3c164692c41646bbc9166c043
+  metadata.gz: 2f663b5f7aedb812648c9065fd324ab0ab70a49b4ecb58c2b1160e12c84c93a5e340512be14812ec1e9d6790cce41344182df20e942d4ade2383ff81cf686dae
+  data.tar.gz: 7145c2c82d0e710de29bfc97dbe481464696d74a5381ac4dd55e56bd06605dc225dc6bd2a0593df459413d962c9583f5b3e6d133757b1e5ed75654af880b271f

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.11.6](https://github.com/jgnagy/bullion/compare/bullion/v0.11.5...bullion/v0.11.6) (2026-10-02)
+
+
+### Bug Fixes
+
+* give each request fiber its own database connection ([c47a277](https://github.com/jgnagy/bullion/commit/c47a2779ab6b115bbb0c9af75559c17010353962))
+* give each request fiber its own database connection ([cca3b31](https://github.com/jgnagy/bullion/commit/cca3b313a6adf04ef9680698ca64f53027b58d3b))
+* return orderNotReady instead of badCSR for non-ready finalize ([2d5fc6f](https://github.com/jgnagy/bullion/commit/2d5fc6f15f98ba39253b294868674073d56e5f81))
+
 ## [0.11.5](https://github.com/jgnagy/bullion/compare/bullion/v0.11.4...bullion/v0.11.5) (2026-09-21)
 
 

data/README.md

@@ -160,7 +160,7 @@ Whether run locally or via Docker, the following environment variables configure
 | `CA_CERT_PATH` | `$CA_DIR/tls.crt` | Public cert for Bullion. If Bullion is an intermediate CA, you'll want to include the root CA's public cert in this file as well the signed cert for Bullion. |
 | `CA_DOMAINS` | `example.com` | A comma-delimited list of domains for which Bullion will sign certificate requests. Subdomains are automatically allowed. Certificates containing other domains will be rejected. |
 | `CERT_VALIDITY_DURATION` | `7776000` | How long should issued certs be valid (in seconds)? Default is 90 days. |
-| `DATABASE_URL` | _None_ | **(Required)** A shorthand for telling Bullion how to connect to a database. Acceptable URLs will either begin with `sqlite3:` or [`trilogy://`](https://github.com/trilogy-libraries/trilogy/tree/main/contrib/ruby). |
+| `DATABASE_URL` | _None_ | **(Required)** A shorthand for telling Bullion how to connect to a database. Acceptable URLs will either begin with `sqlite3:` or [`trilogy://`](https://github.com/trilogy-libraries/trilogy/tree/main/contrib/ruby). ActiveRecord connection options may be passed as query parameters, e.g. `trilogy://user:pass@host:3306/bullion?max_connections=25&checkout_timeout=5`. |
 | `DNS01_NAMESERVERS` | _None_ | A comma-delimited list of nameservers to use for resolving [DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) challenges. Usually you'll want this to be set to your _internal_ nameservers so internal names resolve correctly. When not set, it'll use the host's DNS. |
 | `LOG_LEVEL` | `warn` | Log level for Bullion. Supported levels (starting with the noisiest) are debug, info, warn, error, and fatal. |
 | `BULLION_PORT` | `9292` | TCP port Bullion will listen on. |
@@ -169,6 +169,8 @@ Whether run locally or via Docker, the following environment variables configure
 | `WORKER_MEMORY_LIMIT` | `1024**3` | [Itsi worker memory limit](https://itsi.fyi/options/worker_memory_limit/) for each worker process (in bytes). Default is 1GiB. |
 | `RACK_ENV` | `production`* | When run via Docker, the default is `production`, when run via `rake local_demo` it is `development`. Used to tell Bullion if it is run in development mode or for testing. |
 
+Because Bullion serves requests through Itsi's [fiber scheduler](https://itsi.fyi/options/fiber_scheduler/), each in-flight request leases its own database connection. ActiveRecord's connection pool defaults to 5 connections, so raise `max_connections` on `DATABASE_URL` if you expect more concurrent requests. `checkout_timeout` (default 5 seconds) controls how long a request waits for a connection before failing.
+
 ### Integrating
 
 Any client that speaks the [ACMEv2](https://tools.ietf.org/html/rfc8555) protocol can be pointed at `/acme/directory` and everything else can be auto-discovered.

data/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2025_08_23_073342) do
+ActiveRecord::Schema[8.1].define(version: 2026_07_16_000000) do
   create_table "accounts", force: :cascade do |t|
     t.text "contacts", null: false
     t.datetime "created_at", null: false
@@ -40,6 +40,9 @@ ActiveRecord::Schema[8.1].define(version: 2025_08_23_073342) do
     t.string "csr_fingerprint", null: false
     t.text "data", null: false
     t.string "requester"
+    t.integer "revocation_reason"
+    t.boolean "revoked", default: false, null: false
+    t.datetime "revoked_at"
     t.bigint "serial", null: false
     t.string "subject", null: false
     t.datetime "updated_at", null: false

data/lib/bullion/acme/error.rb

@@ -64,6 +64,11 @@ module Bullion
         def acme_type = "malformed"
       end
 
+      # ACME exception for orders that aren't ready to be finalized
+      class OrderNotReady < Bullion::Acme::Error
+        def acme_type = "orderNotReady"
+      end
+
       # ACME exception for unsupported contacts in accounts
       class UnsupportedContact < Bullion::Acme::Error
         def acme_type = "unsupportedContact"

data/lib/bullion/helpers/acme.rb

@@ -125,7 +125,6 @@ module Bullion
         # Make sure the CSR has a valid public key
         raise Bullion::Acme::Errors::BadCsr unless csr.verify(csr.public_key)
 
-        return false unless order.ready_status?
         raise Bullion::Acme::Errors::BadCsr if csr_cn && !csr_domains.include?(csr_cn)
         raise Bullion::Acme::Errors::BadCsr unless csr_domains.sort == order.domains.sort
 
@@ -192,6 +191,24 @@ module Bullion
           Bullion.config.ca.domains.none? { domain["value"].end_with?(it) }
         end
       end
+
+      # Builds the ACMEv2 order resource representation
+      # @see https://tools.ietf.org/html/rfc8555#section-7.1.3
+      def order_data(order)
+        data = {
+          status: order.status,
+          expires: order.expires,
+          notBefore: order.not_before,
+          notAfter: order.not_after,
+          identifiers: order.identifiers,
+          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
+          finalize: uri("/orders/#{order.id}/finalize")
+        }
+
+        data[:certificate] = uri("/certificates/#{order.certificate.id}") if order.valid_status?
+
+        data
+      end
     end
   end
 end

data/lib/bullion/services/ca.rb

@@ -214,15 +214,7 @@ module Bullion
         content_type "application/json"
         add_acme_headers @new_nonce, additional: { "Location" => uri("/orders/#{order.id}") }
 
-        halt 201, {
-          status: order.status,
-          expires: order.expires,
-          notBefore: order.not_before,
-          notAfter: order.not_after,
-          identifiers: order.identifiers,
-          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
-          finalize: uri("/orders/#{order.id}/finalize")
-        }.to_json
+        halt 201, order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
         halt 400, { type: e.acme_error, detail: e.message }.to_json
@@ -237,19 +229,7 @@ module Bullion
 
         order = Models::Order.find(params[:id])
 
-        data = {
-          status: order.status,
-          expires: order.expires,
-          notBefore: order.not_before,
-          notAfter: order.not_after,
-          identifiers: order.identifiers,
-          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
-          finalize: uri("/orders/#{order.id}/finalize")
-        }
-
-        data[:certificate] = uri("/certificates/#{order.certificate.id}") if order.valid_status?
-
-        data.to_json
+        order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
         halt 400, { type: e.acme_error, detail: e.message }.to_json
@@ -267,6 +247,17 @@ module Bullion
 
         order_csr = Models::OrderCsr.from_acme_request(order, @payload_data["csr"])
 
+        unless order.ready_status?
+          # Finalize is idempotent for orders that have already been finalized
+          halt 200, order_data(order).to_json if %w[processing valid].include?(order.status)
+
+          content_type "application/problem+json"
+          halt 403, {
+            type: Bullion::Acme::Errors::OrderNotReady.new.acme_error,
+            detail: "Order is not ready to be finalized"
+          }.to_json
+        end
+
         unless acme_csr_valid?(order_csr)
           content_type "application/problem+json"
           halt 400, {
@@ -281,19 +272,7 @@ module Bullion
         order.status = "valid"
         order.save
 
-        data = {
-          status: order.status,
-          expires: order.expires,
-          notBefore: order.not_before,
-          notAfter: order.not_after,
-          identifiers: order.identifiers,
-          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
-          finalize: uri("/orders/#{order.id}/finalize")
-        }
-
-        data[:certificate] = uri("/certificates/#{order.certificate.id}") if order.valid_status?
-
-        data.to_json
+        order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
         halt 422, { type: e.acme_error, detail: e.message }.to_json

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.11.5"
+  VERSION = "0.11.6"
 end

data/lib/bullion.rb

@@ -140,6 +140,19 @@ Bullion.configure do |config|
   config.nameservers = nameservers if nameservers
 end
 
+# Itsi processes each request inside its own Fiber, but all fibers on a thread
+# share an ActiveSupport execution context by default. ActiveRecord leases a
+# database connection per execution context, so without fiber isolation every
+# concurrent request fiber on a thread shares (and races on) the same
+# connection. Trilogy detects this and raises Trilogy::SynchronizationError.
+# Mirror Itsi's own scheduler_mode hook (which itsi-server 0.2.27 never loads)
+# and the Rails 8.1+ default by opting into fiber isolation, honoring Itsi's
+# opt-out.
+# @see https://github.com/jgnagy/bullion/issues/116
+unless ENV["ITSI_DISABLE_AS_AUTO_FIBER_ISOLATION_LEVEL"]
+  ActiveSupport::IsolatedExecutionState.isolation_level = :fiber
+end
+
 # Internal requirements
 require "bullion/version"
 require "bullion/acme/error"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bullion
 version: !ruby/object:Gem::Version
-  version: 0.11.5
+  version: 0.11.6
 platform: ruby
 authors:
 - Jonathan Gnagy