hotcell-core 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8891b08ef8f6bea20b5d0046b865792da18374918fd310d1c521eda6c20b5cac
-  data.tar.gz: fe246492b615e044c9762b629de4082f4ac88167a1cedc1b07e13cf235611aae
+  metadata.gz: 6649b9636b553b02ac5d1a178dd39eadb95884a83665b15d7d0278ae8af20260
+  data.tar.gz: 6726a7fa1abff37e8c478e2d7ee0818b7c1038983da282b237c4575c67da4e07
 SHA512:
-  metadata.gz: 0d8e8e358a731b951f94716eec4793aca4f7595213c12b7ebbff89079eef01a205812fe87a4ddac00ed428e8a99412ee81c2bc4812efffbaeab0854da43573e3
-  data.tar.gz: 7b349aff2ee4ccf6e48a3d6545923285337c8b59c00016dd1416ea55f18f5a3b5b7e9786197febc5865bdc07702cf45574461af0717449984074d77e6a2dc368
+  metadata.gz: ea9a2f0004527eef4f9078df8e4acef195fe86988372991a1488900b2d1e6c122de3f1bb5abd29cd8edd371538776a6a8a5b456a2db592b15cb1bf9760b35b9b
+  data.tar.gz: 8ab1b757c91463fe99380c7af6a878545578c5b1bf74b70c65a87ff61312c5cd6d905fe5be5b3804c5f4bb59cbb0e50e5563b80d50d09ffabf0d085de542ca9d

data/lib/hot_cell/core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module HotCell
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/lib/hot_cell/descriptors.rb

@@ -39,8 +39,30 @@ module HotCell
     # readable at any size, where staging it would be a write and RLIMIT_FSIZE bounds writes. Reopening
     # `/dev/fd/N` gives a fresh file description at offset zero, so a read here does not disturb the
     # descriptor the supervisor still holds.
-    def fd_path
-      "/dev/fd/#{io.fileno}"
+    #
+    # Darwin cannot keep that promise, so it keeps the behavior instead. `/dev/fd` has no procfs behind it
+    # there, and opening the path is dup(2): one shared offset, so what one reader consumes the next open
+    # skips. libvips sniffs a format by opening the path once per candidate loader, so the second loader
+    # reads past the magic bytes and a readable file is called unreadable.
+    #
+    # Darwin answers with the filename behind the descriptor, which a by-name open does start at zero. That
+    # hands a tool a path the cold side chose, which the rest of this class exists to prevent — a corner cut
+    # on purpose. Darwin is a development platform and nothing else: no container, no isolation, the cell
+    # running as the caller on the caller's own filesystem, where hiding a path it could already reach
+    # protected nothing. What has to match across platforms is what an operation sees — a path that reads
+    # from the first byte however many times it is opened — not how that is arrived at.
+    if RUBY_PLATFORM.include?("darwin")
+      F_GETPATH = 50 # sys/fcntl.h; Ruby's Fcntl module does not carry it
+
+      def fd_path
+        buffer = "\0" * 1024 # F_GETPATH writes the path into a buffer the caller supplies, MAXPATHLEN wide
+        io.fcntl F_GETPATH, buffer
+        buffer[/\A[^\0]+/]
+      end
+    else
+      def fd_path
+        "/dev/fd/#{io.fileno}"
+      end
     end
 
     def close

data/lib/hot_cell/payload.rb

@@ -22,27 +22,21 @@ module HotCell
         JSON.generate object
       end
 
-      # Keys are deep-symbolized here rather than in an operation, so an operation never has to know
-      # whether to reach for payload[:format] or payload["format"], and a nested hash can be splatted
-      # straight into a library's keyword arguments. Only keys: a Symbol value would not survive the
-      # round trip, which the JSON-native rule already forbids.
+      # Keys are symbolized so operations read payload[:format] and can splat a nested hash into keyword
+      # arguments. Values are not: a Symbol would not survive the round trip, which the JSON-native rule
+      # already forbids.
       #
-      # JSON.parse only. Never JSON.load, and never create_additions, both of which instantiate
-      # arbitrary classes named by a json_class key in the document.
+      # One rescue for the whole JSON layer. Naming what JSON.parse raises has been wrong twice: a report
+      # that was not an object raised TypeError past a rescue for JSON::ParserError, and a key holding
+      # invalid UTF-8 raised EncodingError past both. The supervisor parses worker reports inside its
+      # deadline loop with nothing above it rescuing, so each miss denies service to every request in the
+      # cell.
       #
-      # Every way this can fail becomes one named failure, and the catch-all is the point rather than
-      # laziness. Callers used to name what JSON.parse raises, and naming it has now been wrong twice: a
-      # report that was not an object raised TypeError past a rescue for JSON::ParserError, and a key
-      # holding bytes that are not valid UTF-8 raises EncodingError past both. The supervisor reads worker
-      # reports through here inside the loop that enforces every request's deadline, and nothing above it
-      # rescues anything, so each miss is a one-line denial of service against every request in the cell.
-      #
-      # The body is a single JSON.parse call, so this is scoped to "the JSON layer failed" and cannot
-      # swallow a bug in our own code. NoMemoryError is deliberately not caught: it is not a StandardError,
-      # and a document large enough to raise it is the worker's own memory verdict rather than a bad line.
+      # The body is one JSON.parse call, so the rescue cannot hide a bug of our own. NoMemoryError is not
+      # a StandardError and stays uncaught: a document that large is the worker's memory verdict, not a
+      # bad line.
       def parse(json)
-        JSON.parse json, symbolize_names: true, max_nesting: MAX_NESTING, allow_nan: false,
-                         create_additions: false
+        JSON.parse json, symbolize_names: true, max_nesting: MAX_NESTING, allow_nan: false
       rescue StandardError => error
         raise MessageError, "#{error.class}: #{Failure.sanitize(error.message)}"
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hotcell-core
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -43,8 +43,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.3.0/hotcell-core
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.3.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.4.0/hotcell-core
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.4.0/CHANGELOG.md
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []