hotcell-core 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b90b3c31e988d71fe6f9b1da6c1e727d8c25b934c5085757367fe6e38ffd5aef
-  data.tar.gz: d8eed61e4eeb2d52fe65571ff75b34ff0f73d37ef96c615ec5ab88b7e4d64696
+  metadata.gz: e60aebb6474f67f6a35f01d9fe1e3a686c422a073e11ebf785af0816ade80e79
+  data.tar.gz: eb13e25de57e23ff35d57fe100926cd64c11ecad18af96104dd3864d2246411b
 SHA512:
-  metadata.gz: 5b8e87d2713d7d8aae5091a469f3a16be1a1dc860e37c4a0b40aa2b3819a1ee3336f7807e88cbb4ae35892f4a6ad5ad892a3c239a6f4928108ecd584946d1d19
-  data.tar.gz: 16ea6b1a37ab997e25d4553f697a6fd390b3b4dbe6869a6b703e0bccf1a1a8467fb14e95921e19c0125e48462aecc4ac578214729573106d4f00e5c0a8ac509c
+  metadata.gz: 0c0373bb9b2831d65e5fce1b02c7cb0ede24eed5a3d64144d905abbd93d72a7dcbf3d46250acb24caf195e1e1f9e0a530fa07ef2845c1ccba2118aed4f4e1aa2
+  data.tar.gz: a087aedd5855c87b413c53085e23d9d579a59176bc9453d1e07e4712592d1c1405f8939d42c6123ae3fa5bcf9b50ad3d0112353d3adba359a7814d55a0e0b10f

data/lib/hot_cell/codes.rb

@@ -79,6 +79,18 @@ module HotCell
     # from somewhere it cannot see: a cgroup OOM kill chosen on aggregate pressure across concurrent workers,
     # or one worker signalling another — they share a uid, and nothing stops that. Attributing either to the
     # input this worker happened to be holding condemns a file for something it did not do.
+    #
+    # So the supervisor never infers either of them from a signal. They are decided in the worker, which is
+    # the process that holds the request: `memory` when it catches NoMemoryError itself, and `fsize` when a
+    # write of its own returns EFBIG. See Worker#disarm_file_size_signal for why the file-size verdict has
+    # to be earned that way rather than read off a wait status.
+    #
+    # That is a narrower guarantee than "a permanent verdict cannot be forged", and the difference matters.
+    # It removes the supervisor as an instrument: a sibling's signal no longer travels through a wait status
+    # into someone else's blob. It does nothing about a cell that has been compromised outright and answers
+    # a connection itself — `from_wire` believes a `permanent` boolean off the wire, and a worker that stole
+    # `work.sock` writes whatever it likes. That is the socket-theft residual `docs/DESIGN.md` records, and
+    # it is not closed here.
     PERMANENT_BY_CAUSE = {
       FSIZE    => true,
       MEMORY   => true,

data/lib/hot_cell/core/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module HotCell
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/hot_cell/failure.rb

@@ -76,6 +76,14 @@ module HotCell
             error_class: wire[:class], message: wire[:message]
       end
 
+      # For a message that is about to be written as one line of a log. `sanitize` leaves CR and LF alone,
+      # which is right for a message an application stores or re-raises, but a peer that puts a newline in
+      # one writes a second log line of its own — formatted and indented like the real ones. Escape them,
+      # and the rest of the control characters with them.
+      def one_line(text)
+        sanitize(text)&.gsub(/[[:cntrl:]]/) { |character| character.dump[1..-2] }
+      end
+
       def sanitize(message)
         return nil if message.nil?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hotcell-core
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -10,12 +10,9 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies: []
 description: |
-  HotCell runs untrusted media conversion in an unprivileged sibling container with no network,
-  reached over a Unix socket that carries file descriptors rather than paths or bytes.
-
-  This gem holds what both sides must agree on: the request and response format, SCM_RIGHTS
-  marshalling, descriptor access-mode verification, payload validation, and the error taxonomy.
-  It performs no I/O of its own and loads no media library.
+  The wire protocol between an application and a HotCell container: the request and response format,
+  file descriptor passing over SCM_RIGHTS, payload validation, and the error taxonomy. Both
+  hotcell-client and hotcell-server depend on it. Install one of those rather than this.
 email:
 - mike@37signals.com
 executables: []
@@ -46,8 +43,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.1.0/hotcell-core
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.1.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.2.0/hotcell-core
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.2.0/CHANGELOG.md
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []