hotcell-core 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e60aebb6474f67f6a35f01d9fe1e3a686c422a073e11ebf785af0816ade80e79
-  data.tar.gz: eb13e25de57e23ff35d57fe100926cd64c11ecad18af96104dd3864d2246411b
+  metadata.gz: 214b910102e639e8d5e5d7f5f145046c53d7fe45146a661054097731303d12db
+  data.tar.gz: 02db6536062e350ae67eefae22b50d83d8aa629b24487fdb01339e97308c045e
 SHA512:
-  metadata.gz: 0c0373bb9b2831d65e5fce1b02c7cb0ede24eed5a3d64144d905abbd93d72a7dcbf3d46250acb24caf195e1e1f9e0a530fa07ef2845c1ccba2118aed4f4e1aa2
-  data.tar.gz: a087aedd5855c87b413c53085e23d9d579a59176bc9453d1e07e4712592d1c1405f8939d42c6123ae3fa5bcf9b50ad3d0112353d3adba359a7814d55a0e0b10f
+  metadata.gz: e4be2dd15734d9b3958ee98408866b9302f0a854a6ad16d652954e42f7f986a53286034b2af38eef9f09dc2ba2cc348d20b9707cf07c0e473a74a5742c2f9076
+  data.tar.gz: 6251a4224a51c24ce0b8bc245335973e2ccc33670594e41bb374242e8d70a46d0226247225415d61945ec1c2220db0ce6bd837779c9477e22b5529582a43f112

data/lib/hot_cell/codes.rb

@@ -47,9 +47,9 @@ module HotCell
     # updated by a deploy, so an application that ships a client for a new operation before anybody reboots
     # the cell gets `unsupported` at one hundred percent for as long as that takes.
     #
-    # The two mistakes are not symmetrical. Retrying a caller's typo costs some work and shows up in the
-    # `unsupported` rate and in the client's boot-time warning. Recording a deploy window as permanent
-    # condemns every blob uploaded during it, and needs a hand-written backfill to undo.
+    # The two mistakes are not symmetrical. Retrying a caller's typo costs some work, and it says which
+    # operation in the refusal `worker.rb` writes and in the `unsupported` rate. Recording a deploy window
+    # as permanent condemns every blob uploaded during it, and needs a hand-written backfill to undo.
 
     # `killed` splits on what the worker hit, because a caller cannot otherwise tell a decompression
     # bomb from a slow afternoon. Size and memory are properties of the input, so the same bytes will

data/lib/hot_cell/core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module HotCell
-  VERSION = "0.2.0"
+  VERSION = "0.3.1"
 end

data/lib/hot_cell/descriptors.rb

@@ -39,8 +39,30 @@ module HotCell
     # readable at any size, where staging it would be a write and RLIMIT_FSIZE bounds writes. Reopening
     # `/dev/fd/N` gives a fresh file description at offset zero, so a read here does not disturb the
     # descriptor the supervisor still holds.
-    def fd_path
-      "/dev/fd/#{io.fileno}"
+    #
+    # Darwin cannot keep that promise, so it keeps the behavior instead. `/dev/fd` has no procfs behind it
+    # there, and opening the path is dup(2): one shared offset, so what one reader consumes the next open
+    # skips. libvips sniffs a format by opening the path once per candidate loader, so the second loader
+    # reads past the magic bytes and a readable file is called unreadable.
+    #
+    # Darwin answers with the filename behind the descriptor, which a by-name open does start at zero. That
+    # hands a tool a path the cold side chose, which the rest of this class exists to prevent — a corner cut
+    # on purpose. Darwin is a development platform and nothing else: no container, no isolation, the cell
+    # running as the caller on the caller's own filesystem, where hiding a path it could already reach
+    # protected nothing. What has to match across platforms is what an operation sees — a path that reads
+    # from the first byte however many times it is opened — not how that is arrived at.
+    if RUBY_PLATFORM.include?("darwin")
+      F_GETPATH = 50 # sys/fcntl.h; Ruby's Fcntl module does not carry it
+
+      def fd_path
+        buffer = "\0" * 1024 # F_GETPATH writes the path into a buffer the caller supplies, MAXPATHLEN wide
+        io.fcntl F_GETPATH, buffer
+        buffer[/\A[^\0]+/]
+      end
+    else
+      def fd_path
+        "/dev/fd/#{io.fileno}"
+      end
     end
 
     def close

data/lib/hot_cell/failure.rb

@@ -15,19 +15,24 @@ module HotCell
   class Failure
     MAX_MESSAGE_BYTES = 512
 
-    attr_reader :code, :message, :error_class, :cause, :signal
+    attr_reader :code, :message, :error_class, :cause, :signal, :stderr
 
-    # Every field is sanitized, not only the message. All five arrive from the wire on the client side, so
-    # all five carry whatever the peer put there — and they travel further than the message does, into
+    # Every field is sanitized, not only the message. All of them arrive from the wire on the client side,
+    # so all of them carry whatever the peer put there — and they travel further than the message does, into
     # `to_s`, into the `perform.hot_cell` event, and into whatever a subscriber writes down. `code` in
-    # particular is the field applications store. Scrubbing one and not the other four left the same
-    # poisoned row the scrub exists to prevent, reachable through a different key.
-    def initialize(code:, permanent: nil, message: nil, error_class: nil, cause: nil, signal: nil)
+    # particular is the field applications store. Scrubbing one and not the rest left the same poisoned row
+    # the scrub exists to prevent, reachable through a different key.
+    def initialize(code:, permanent: nil, message: nil, error_class: nil, cause: nil, signal: nil,
+                   stderr: nil)
       @code = self.class.sanitize(code).to_s
       @cause = self.class.sanitize(cause)
       @signal = self.class.sanitize(signal)
       @error_class = self.class.sanitize(error_class)
       @message = self.class.sanitize(message)
+
+      # The tail, because this is a transcript and its last line is the one that ended the request. Every
+      # other field is one message, where the head is what matters.
+      @stderr = self.class.sanitize(stderr, keep: :tail)
       @permanent = permanent.nil? ? Codes.permanent?(@code, cause: @cause) : permanent
     end
 
@@ -40,11 +45,15 @@ module HotCell
     # `permanent` is the exception and survives, because compact drops only nil.
     def to_h
       { code: code, permanent: permanent? }
-        .merge(cause: cause, signal: signal, class: error_class, message: message).compact
+        .merge(cause: cause, signal: signal, class: error_class, message: message, stderr: stderr).compact
     end
 
+    # `one_line` rather than raw interpolation: `to_s` becomes the exception message an application logs, and
+    # a transcript ends in a newline — so a peer that put newlines in one writes extra lines into that log.
+    # The attribute keeps the raw text.
     def to_s
-      [ code, cause, error_class, message ].compact.join(": ")
+      text = [ code, cause, error_class, message ].compact.join(": ")
+      stderr ? "#{text} (#{self.class.one_line(stderr)})" : text
     end
 
     class << self
@@ -73,7 +82,7 @@ module HotCell
         end
 
         new code: wire[:code], permanent: permanent, cause: wire[:cause], signal: wire[:signal],
-            error_class: wire[:class], message: wire[:message]
+            error_class: wire[:class], message: wire[:message], stderr: wire[:stderr]
       end
 
       # For a message that is about to be written as one line of a log. `sanitize` leaves CR and LF alone,
@@ -84,11 +93,20 @@ module HotCell
         sanitize(text)&.gsub(/[[:cntrl:]]/) { |character| character.dump[1..-2] }
       end
 
-      def sanitize(message)
+      # `keep: :tail` is for a captured stream rather than a message, and it is load-bearing on `from_wire`:
+      # a cell this client does not trust can fill that field to the response limit, and head-truncating
+      # there hands the caller the noise a decoder printed first instead of the fatal that ended it.
+      def sanitize(message, keep: :head)
         return nil if message.nil?
 
-        String(message).dup.force_encoding(Encoding::UTF_8)
-          .scrub("").byteslice(0, MAX_MESSAGE_BYTES).scrub("")
+        text = String(message).dup.force_encoding(Encoding::UTF_8).scrub("")
+        text = if keep == :tail && text.bytesize > MAX_MESSAGE_BYTES
+          text.byteslice(text.bytesize - MAX_MESSAGE_BYTES, MAX_MESSAGE_BYTES)
+        else
+          text.byteslice(0, MAX_MESSAGE_BYTES)
+        end
+
+        text.scrub("")
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hotcell-core
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Mike Dalessio
@@ -43,8 +43,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.2.0/hotcell-core
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.2.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.3.1/hotcell-core
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.3.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []