tensorfs 0.3.37__tar.gz → 0.3.38__tar.gz

{tensorfs-0.3.37 → tensorfs-0.3.38}/Cargo.lock

@@ -48,6 +48,16 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
 [[package]]
 name = "fallible-iterator"
 version = "0.3.0"
@@ -128,6 +138,12 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "minicbor"
 version = "2.3.0"
@@ -290,6 +306,19 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.43"
@@ -392,19 +421,20 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.37"
+version = "0.3.38"
 dependencies = [
  "fs2",
  "minicbor",
  "rcgen",
  "rusqlite",
+ "rustix",
  "rustls",
  "webpki-roots 0.26.11",
 ]
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.37"
+version = "0.3.38"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.37 → tensorfs-0.3.38}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.37"
+version = "0.3.38"
 edition = "2021"

{tensorfs-0.3.37 → tensorfs-0.3.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.37
+Version: 0.3.38
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.37 → tensorfs-0.3.38}/crates/tensorfs-core/Cargo.toml

@@ -11,6 +11,7 @@ path = "src/bin/tfs/main.rs"
 fs2 = "0.4"
 minicbor = { version = "2.3.0", default-features = false, features = ["alloc"] }
 rusqlite = { version = "0.32", features = ["bundled"] }
+rustix = { version = "1.1.4", default-features = false, features = ["fs", "std"] }
 # tfs-049: the ONE transport (src/transport/). rustls is the one TLS stack, used only
 # there; scripts/fence.py refuses it anywhere else so a second mover cannot grow.
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }

{tensorfs-0.3.37 → tensorfs-0.3.38}/crates/tensorfs-core/src/repo_cache.rs

@@ -5,11 +5,15 @@
 //! the caller's exact digest and length while bytes move into an ordinary local Store.
 //! Cache failure is weather, never authority.
 
+use std::ffi::OsStr;
 use std::fs::{self, File, OpenOptions};
 use std::io::{Read, Write};
-use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+use std::os::unix::fs::{MetadataExt, OpenOptionsExt, PermissionsExt};
+
 use std::path::{Path, PathBuf};
 
+use rustix::fs::{self as unix, AtFlags, Mode, OFlags};
+
 use crate::err::{Code, Result};
 use crate::ids::{hex64, Doc, ObjectRef};
 use crate::limits;
@@ -241,27 +245,49 @@ impl RepoObjectCache {
         progress: Option<&dyn store::Progress>,
     ) -> Result<CacheWrite> {
         let destination = self.path(kind, &want.sha256)?;
-        if destination.exists() {
-            return Ok(match verify_path(&destination, kind, want, progress) {
-                Ok(()) => CacheWrite::Present,
-                Err(_) => CacheWrite::Unavailable,
-            });
-        }
+        let directory = match cache_parent(&self.root, &destination) {
+            Ok(directory) => directory,
+            Err(_) => return Ok(CacheWrite::Unavailable),
+        };
+        let name = destination.file_name().expect("digest path has a filename");
+        let repair = match open_at(&directory, name) {
+            Ok(file) => {
+                let metadata = match file.metadata() {
+                    Ok(metadata) if metadata.is_file() => metadata,
+                    _ => return Ok(CacheWrite::Unavailable),
+                };
+                match verify_file(file, kind, want, progress) {
+                    Ok(()) => return Ok(CacheWrite::Present),
+                    Err(SoftFailure::Corrupt) => Some(metadata),
+                    Err(_) => return Ok(CacheWrite::Unavailable),
+                }
+            }
+            Err(SoftFailure::Missing) => None,
+            Err(_) => return Ok(CacheWrite::Unavailable),
+        };
         let result = match kind {
             CacheKind::Blob => match source.open_verified(&want.sha256) {
                 Ok(mut file) if file.len() == want.length => {
-                    publish_stream(&mut file, &destination, want, progress)
+                    publish_stream(&mut file, &directory, name, want, progress, repair.as_ref())
                 }
                 Ok(_) | Err(_) => Err(SoftFailure::Unavailable),
             },
             CacheKind::Manifest => match source.read_manifest(want) {
-                Ok(manifest) => publish_bytes(&manifest.canonical_bytes(), &destination, progress),
+                Ok(manifest) => publish_bytes(
+                    &manifest.canonical_bytes(),
+                    &directory,
+                    name,
+                    progress,
+                    repair.as_ref(),
+                ),
                 Err(_) => Err(SoftFailure::Unavailable),
             },
         };
         Ok(match result {
             Ok(true) => CacheWrite::Stored,
-            Ok(false) => match verify_path(&destination, kind, want, progress) {
+            Ok(false) => match open_at(&directory, name)
+                .and_then(|file| verify_file(file, kind, want, progress))
+            {
                 Ok(()) => CacheWrite::Present,
                 Err(_) => CacheWrite::Unavailable,
             },
@@ -451,80 +477,181 @@ fn read_manifest(path: &Path, want: &ObjectRef) -> std::result::Result<Manifest,
     Manifest::parse(&bytes).map_err(|_| SoftFailure::Corrupt)
 }
 
+#[cfg(test)]
 fn verify_path(
     path: &Path,
     kind: CacheKind,
     want: &ObjectRef,
     progress: Option<&dyn store::Progress>,
 ) -> std::result::Result<(), SoftFailure> {
+    verify_file(open_exact(path, want.length)?, kind, want, progress)
+}
+
+fn verify_file(
+    mut file: File,
+    kind: CacheKind,
+    want: &ObjectRef,
+    progress: Option<&dyn store::Progress>,
+) -> std::result::Result<(), SoftFailure> {
+    let metadata = file.metadata().map_err(|_| SoftFailure::Unavailable)?;
+    if !metadata.is_file() {
+        return Err(SoftFailure::Unavailable);
+    }
+    if metadata.len() != want.length {
+        return Err(SoftFailure::Corrupt);
+    }
     match kind {
-        CacheKind::Blob => {
-            let mut file = open_exact(path, want.length)?;
-            let mut sink = std::io::sink();
-            stream_exact(&mut file, &mut sink, want, progress)
+        CacheKind::Blob => stream_exact(&mut file, &mut std::io::sink(), want, progress),
+        CacheKind::Manifest => {
+            if want.length > Manifest::MAX_BYTES as u64 {
+                return Err(SoftFailure::Corrupt);
+            }
+            let mut bytes = Vec::with_capacity(want.length as usize);
+            file.take(want.length + 1)
+                .read_to_end(&mut bytes)
+                .map_err(|_| SoftFailure::Unavailable)?;
+            if bytes.len() as u64 != want.length || sha256::hex_digest(&bytes) != want.sha256 {
+                return Err(SoftFailure::Corrupt);
+            }
+            Manifest::parse(&bytes)
+                .map(|_| ())
+                .map_err(|_| SoftFailure::Corrupt)
         }
-        CacheKind::Manifest => read_manifest(path, want).map(|_| ()),
     }
 }
 
+// The configured root is the caller's location authority. Pin it once, then refuse
+// symlinks in every cache-owned fanout directory and publish relative to the pinned fd.
+fn cache_parent(root: &Path, destination: &Path) -> std::result::Result<File, SoftFailure> {
+    fs::create_dir_all(root).map_err(|_| SoftFailure::Unavailable)?;
+    let mut directory = File::from(
+        unix::open(
+            root,
+            OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC,
+            Mode::empty(),
+        )
+        .map_err(|_| SoftFailure::Unavailable)?,
+    );
+    let relative = destination
+        .parent()
+        .and_then(|parent| parent.strip_prefix(root).ok())
+        .ok_or(SoftFailure::Unavailable)?;
+    for component in relative.components() {
+        let std::path::Component::Normal(name) = component else {
+            return Err(SoftFailure::Unavailable);
+        };
+        match unix::mkdirat(&directory, name, Mode::from_raw_mode(0o755)) {
+            Ok(()) | Err(rustix::io::Errno::EXIST) => {}
+            Err(_) => return Err(SoftFailure::Unavailable),
+        }
+        directory = File::from(
+            unix::openat(
+                &directory,
+                name,
+                OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
+                Mode::empty(),
+            )
+            .map_err(|_| SoftFailure::Unavailable)?,
+        );
+    }
+    Ok(directory)
+}
+
+fn open_at(directory: &File, name: &OsStr) -> std::result::Result<File, SoftFailure> {
+    unix::openat(
+        directory,
+        name,
+        OFlags::RDONLY | OFlags::NOFOLLOW | OFlags::NONBLOCK | OFlags::CLOEXEC,
+        Mode::empty(),
+    )
+    .map(File::from)
+    .map_err(|error| {
+        if error == rustix::io::Errno::NOENT {
+            SoftFailure::Missing
+        } else {
+            SoftFailure::Unavailable
+        }
+    })
+}
+
 fn publish_bytes(
     bytes: &[u8],
-    destination: &Path,
+    directory: &File,
+    name: &OsStr,
     progress: Option<&dyn store::Progress>,
+    repair: Option<&fs::Metadata>,
 ) -> std::result::Result<bool, SoftFailure> {
-    let mut source = bytes;
-    let want = ObjectRef::of(bytes);
-    publish_stream(&mut source, destination, &want, progress)
+    publish_stream(
+        &mut &bytes[..],
+        directory,
+        name,
+        &ObjectRef::of(bytes),
+        progress,
+        repair,
+    )
 }
 
 fn publish_stream(
     source: &mut impl Read,
-    destination: &Path,
+    directory: &File,
+    name: &OsStr,
     want: &ObjectRef,
     progress: Option<&dyn store::Progress>,
+    repair: Option<&fs::Metadata>,
 ) -> std::result::Result<bool, SoftFailure> {
-    let Some(directory) = destination.parent() else {
-        return Err(SoftFailure::Unavailable);
-    };
-    fs::create_dir_all(directory).map_err(|_| SoftFailure::Unavailable)?;
-    let name = destination
-        .file_name()
-        .and_then(|value| value.to_str())
-        .unwrap_or("object");
-    let temporary = directory.join(format!(
-        ".{name}.{}.{}.tmp",
+    let temporary = format!(
+        ".{}.{}.{}.tmp",
+        name.to_string_lossy(),
         std::process::id(),
         store::now_nanos_unique()
-    ));
-    let mut output = OpenOptions::new()
-        .write(true)
-        .create_new(true)
-        .mode(0o600)
-        .open(&temporary)
-        .map_err(|_| SoftFailure::Unavailable)?;
-    if let Err(error) = stream_exact(source, &mut output, want, progress) {
-        let _ = fs::remove_file(&temporary);
-        return Err(error);
-    }
-    if output.sync_all().is_err()
-        || fs::set_permissions(&temporary, fs::Permissions::from_mode(0o444)).is_err()
-    {
-        let _ = fs::remove_file(&temporary);
-        return Err(SoftFailure::Unavailable);
-    }
-    let admitted = match fs::hard_link(&temporary, destination) {
-        Ok(()) => true,
-        Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => false,
-        Err(_) => {
-            let _ = fs::remove_file(&temporary);
-            return Err(SoftFailure::Unavailable);
+    );
+    let mut output = File::from(
+        unix::openat(
+            directory,
+            temporary.as_str(),
+            OFlags::WRONLY | OFlags::CREATE | OFlags::EXCL | OFlags::NOFOLLOW | OFlags::CLOEXEC,
+            Mode::from_raw_mode(0o600),
+        )
+        .map_err(|_| SoftFailure::Unavailable)?,
+    );
+    let publish = (|| {
+        stream_exact(source, &mut output, want, progress)?;
+        output.sync_all().map_err(|_| SoftFailure::Unavailable)?;
+        output
+            .set_permissions(fs::Permissions::from_mode(0o444))
+            .map_err(|_| SoftFailure::Unavailable)?;
+        let admitted = if let Some(previous) = repair {
+            let current = unix::statat(directory, name, AtFlags::SYMLINK_NOFOLLOW)
+                .map_err(|_| SoftFailure::Unavailable)?;
+            if current.st_dev != previous.dev() || current.st_ino != previous.ino() {
+                false
+            } else {
+                // Both racing successful repairs publish exactly the same verified object.
+                // renameat replaces the directory entry, never follows a changed symlink.
+                unix::renameat(directory, temporary.as_str(), directory, name)
+                    .map_err(|_| SoftFailure::Unavailable)?;
+                true
+            }
+        } else {
+            match unix::linkat(
+                directory,
+                temporary.as_str(),
+                directory,
+                name,
+                AtFlags::empty(),
+            ) {
+                Ok(()) => true,
+                Err(rustix::io::Errno::EXIST) => false,
+                Err(_) => return Err(SoftFailure::Unavailable),
+            }
+        };
+        if admitted {
+            directory.sync_all().map_err(|_| SoftFailure::Unavailable)?;
         }
-    };
-    let _ = fs::remove_file(&temporary);
-    if admitted && store::fsync_dir(directory).is_err() {
-        return Err(SoftFailure::Unavailable);
-    }
-    Ok(admitted)
+        Ok(admitted)
+    })();
+    let _ = unix::unlinkat(directory, temporary.as_str(), AtFlags::empty());
+    publish
 }
 
 fn stream_exact(
@@ -1040,7 +1167,14 @@ mod backfill_tests {
             length: object.length,
         };
         assert_eq!(
-            publish_stream(&mut input, &destination, &object, None),
+            publish_stream(
+                &mut input,
+                &cache_parent(&root, &destination).unwrap(),
+                destination.file_name().unwrap(),
+                &object,
+                None,
+                None
+            ),
             Ok(true)
         );
         assert!(!source.contains(&object.sha256));
@@ -1077,7 +1211,14 @@ mod backfill_tests {
             }
         }
         assert_eq!(
-            publish_stream(&mut Fails(false), &destination, &object, None),
+            publish_stream(
+                &mut Fails(false),
+                &cache_parent(&root, &destination).unwrap(),
+                destination.file_name().unwrap(),
+                &object,
+                None,
+                None
+            ),
             Err(SoftFailure::Unavailable)
         );
         assert!(!destination.exists());
@@ -1153,7 +1294,14 @@ mod exit_wait_tests {
         let wanted = object.clone();
         let (finish, finishing) = mpsc::channel();
         let copy = std::thread::spawn(move || {
-            let result = publish_stream(&mut Paced(&data), &target, &wanted, Some(&observed));
+            let result = publish_stream(
+                &mut Paced(&data),
+                &cache_parent(target.parent().unwrap(), &target).unwrap(),
+                target.file_name().unwrap(),
+                &wanted,
+                Some(&observed),
+                None,
+            );
             finishing.recv().unwrap();
             observed.activity.finished();
             result
@@ -1185,3 +1333,140 @@ mod exit_wait_tests {
         fs::remove_dir_all(root).unwrap();
     }
 }
+
+#[cfg(test)]
+mod repair_tests {
+    use super::*;
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    struct Swap {
+        once: AtomicBool,
+        path: PathBuf,
+        replacement: PathBuf,
+        outside: Option<PathBuf>,
+    }
+    impl store::Progress for Swap {
+        fn admitted(&self) {}
+        fn moved(&self, _: u64) {
+            if self.once.swap(true, Ordering::SeqCst) {
+                return;
+            }
+            if let Some(outside) = &self.outside {
+                fs::rename(&self.path, &self.replacement).unwrap();
+                std::os::unix::fs::symlink(outside, &self.path).unwrap();
+            } else {
+                fs::rename(&self.replacement, &self.path).unwrap();
+            }
+        }
+    }
+
+    #[test]
+    fn publication_stays_in_its_open_directory_after_a_fanout_swap() {
+        let root = std::env::temp_dir().join(format!(
+            "tfs-parent-swap-{}-{}",
+            std::process::id(),
+            store::now_nanos_unique()
+        ));
+        let source = Store::init(&root.join("source")).unwrap();
+        let data = vec![9; 4096];
+        let object = source
+            .put_stream(&mut data.as_slice(), None, &Fault::default())
+            .unwrap()
+            .obj;
+        let cache = RepoObjectCache::new(root.join("cache"));
+        let path = cache.path(CacheKind::Blob, &object.sha256).unwrap();
+        let outside = root.join("outside");
+        fs::create_dir_all(&outside).unwrap();
+        let parked = root.join("parked");
+        let swap = Swap {
+            once: AtomicBool::new(false),
+            path: path.parent().unwrap().to_path_buf(),
+            replacement: parked.clone(),
+            outside: Some(outside.clone()),
+        };
+        assert_eq!(
+            cache
+                .backfill_observed(&source, CacheKind::Blob, &object, Some(&swap))
+                .unwrap(),
+            CacheWrite::Stored
+        );
+        assert_eq!(fs::read_dir(outside).unwrap().count(), 0);
+        assert_eq!(
+            fs::read(parked.join(path.file_name().unwrap())).unwrap(),
+            data
+        );
+        fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn repair_adopts_a_competing_verified_final_instead_of_replacing_it() {
+        let root = std::env::temp_dir().join(format!(
+            "tfs-repair-winner-{}-{}",
+            std::process::id(),
+            store::now_nanos_unique()
+        ));
+        let source = Store::init(&root.join("source")).unwrap();
+        let data = vec![17; 4096];
+        let object = source
+            .put_stream(&mut data.as_slice(), None, &Fault::default())
+            .unwrap()
+            .obj;
+        let cache = RepoObjectCache::new(root.join("cache"));
+        let path = cache.path(CacheKind::Blob, &object.sha256).unwrap();
+        fs::create_dir_all(path.parent().unwrap()).unwrap();
+        fs::write(&path, b"bad").unwrap();
+        let winner = root.join("winner");
+        fs::write(&winner, &data).unwrap();
+        let winner_inode = fs::metadata(&winner).unwrap().ino();
+        let swap = Swap {
+            once: AtomicBool::new(false),
+            path: path.clone(),
+            replacement: winner,
+            outside: None,
+        };
+        assert_eq!(
+            cache
+                .backfill_observed(&source, CacheKind::Blob, &object, Some(&swap))
+                .unwrap(),
+            CacheWrite::Present
+        );
+        assert_eq!(fs::metadata(&path).unwrap().ino(), winner_inode);
+        assert_eq!(fs::read(path).unwrap(), data);
+        fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn interrupted_repair_keeps_the_previous_final_and_removes_its_temporary() {
+        struct Broken;
+        impl Read for Broken {
+            fn read(&mut self, _: &mut [u8]) -> std::io::Result<usize> {
+                Err(std::io::Error::other("copy interrupted"))
+            }
+        }
+        let root = std::env::temp_dir().join(format!(
+            "tfs-repair-interrupted-{}-{}",
+            std::process::id(),
+            store::now_nanos_unique()
+        ));
+        fs::create_dir_all(&root).unwrap();
+        let object = ObjectRef::of(b"right");
+        let path = root.join(&object.sha256);
+        fs::write(&path, b"wrong").unwrap();
+        let previous = fs::metadata(&path).unwrap();
+        let directory = cache_parent(&root, &path).unwrap();
+        assert_eq!(
+            publish_stream(
+                &mut Broken,
+                &directory,
+                path.file_name().unwrap(),
+                &object,
+                None,
+                Some(&previous)
+            ),
+            Err(SoftFailure::Unavailable)
+        );
+        assert_eq!(fs::read(&path).unwrap(), b"wrong");
+        assert_eq!(fs::read_dir(&root).unwrap().count(), 1);
+        fs::remove_dir_all(root).unwrap();
+    }
+}

{tensorfs-0.3.37 → tensorfs-0.3.38}/crates/tensorfs-core/tests/repo_cache.rs

@@ -5,7 +5,7 @@ use std::sync::{Arc, Barrier};
 use std::thread;
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use tensorfs_core::ids::ObjectRef;
+use tensorfs_core::ids::{Doc, ObjectRef};
 use tensorfs_core::manifest::Manifest;
 use tensorfs_core::repo_cache::{CacheKind, CacheRead, CacheWrite, RepoObjectCache};
 use tensorfs_core::store::{Fault, Store};
@@ -105,6 +105,27 @@ fn blobs_and_manifests_round_trip_through_normal_store_admission() {
     );
     assert_eq!(destination.read_manifest(&manifest_ref).unwrap(), manifest);
 
+    // Manifest repairs obey the same complete-object publication rule as blobs.
+    let manifest_path = cache
+        .path(CacheKind::Manifest, &manifest_ref.sha256)
+        .unwrap();
+    fs::set_permissions(
+        &manifest_path,
+        std::os::unix::fs::PermissionsExt::from_mode(0o600),
+    )
+    .unwrap();
+    fs::write(&manifest_path, b"damaged manifest").unwrap();
+    assert_eq!(
+        cache
+            .backfill_store(&source, CacheKind::Manifest, &manifest_ref)
+            .unwrap(),
+        CacheWrite::Stored
+    );
+    assert_eq!(
+        fs::read(&manifest_path).unwrap(),
+        manifest.canonical_bytes()
+    );
+
     let cache_root = cache.root();
     assert!(!cache_root.join("tensorfs.sqlite").exists());
     assert!(!cache_root.join("repos").exists());
@@ -203,10 +224,10 @@ fn missing_and_corrupt_cache_objects_fall_through_without_local_admission() {
         cache
             .backfill_store(&source, CacheKind::Blob, &wanted)
             .unwrap(),
-        CacheWrite::Unavailable,
-        "no-clobber leaves repair of a corrupt final entry explicit"
+        CacheWrite::Stored,
+        "verified local bytes atomically repair a corrupt regular cache entry"
     );
-    assert_eq!(fs::read(&cache_path).unwrap(), b"wrong");
+    assert_eq!(fs::read(&cache_path).unwrap(), b"right");
     fs::remove_file(&cache_path).unwrap();
     assert_eq!(
         cache
@@ -568,3 +589,66 @@ fn concurrent_offers_keep_the_offer_list_and_the_sequence_in_step() {
     assert_eq!(mirror.report().durable.objects, objects.len() as u64);
     let _ = fs::remove_dir_all(root);
 }
+
+#[test]
+fn a_symlinked_fanout_never_redirects_cache_publication() {
+    use std::os::unix::fs::symlink;
+    let root = temporary("fanout-symlink");
+    let source = Store::init(&root.join("source")).unwrap();
+    let object = put_blob(&source, b"verified");
+    let cache = RepoObjectCache::new(root.join("cache"));
+    let outside = root.join("outside");
+    fs::create_dir_all(&outside).unwrap();
+    fs::create_dir_all(cache.root()).unwrap();
+    symlink(&outside, cache.root().join("blobs")).unwrap();
+    assert_eq!(
+        cache
+            .backfill_store(&source, CacheKind::Blob, &object)
+            .unwrap(),
+        CacheWrite::Unavailable
+    );
+    assert_eq!(fs::read_dir(outside).unwrap().count(), 0);
+    fs::remove_dir_all(root).unwrap();
+}
+
+#[test]
+fn concurrent_repairs_publish_only_verified_complete_bytes() {
+    let root = temporary("repairs");
+    let source = Arc::new(Store::init(&root.join("source")).unwrap());
+    let data = vec![73; 2 << 20];
+    let object = put_blob(&source, &data);
+    let cache = Arc::new(RepoObjectCache::new(root.join("cache")));
+    let path = cache.path(CacheKind::Blob, &object.sha256).unwrap();
+    write(&path, &vec![0; data.len()]);
+    let barrier = Arc::new(Barrier::new(4));
+    let workers = (0..4)
+        .map(|_| {
+            let (source, cache, object, barrier) = (
+                source.clone(),
+                cache.clone(),
+                object.clone(),
+                barrier.clone(),
+            );
+            thread::spawn(move || {
+                barrier.wait();
+                cache
+                    .backfill_store(&source, CacheKind::Blob, &object)
+                    .unwrap()
+            })
+        })
+        .collect::<Vec<_>>();
+    for worker in workers {
+        assert!(matches!(
+            worker.join().unwrap(),
+            CacheWrite::Stored | CacheWrite::Present
+        ));
+    }
+    assert_eq!(fs::read(path).unwrap(), data);
+    assert_eq!(
+        cache
+            .backfill_store(&source, CacheKind::Blob, &object)
+            .unwrap(),
+        CacheWrite::Present
+    );
+    fs::remove_dir_all(root).unwrap();
+}

{tensorfs-0.3.37 → tensorfs-0.3.38}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "tensorfs"
-version = "0.3.37"
+version = "0.3.38"
 description = "TensorFS — canonical tensor artifact substrate"
 requires-python = ">=3.12"
 classifiers = [