novox/mesh-catalog
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

F-catalog-B: distribution's front takes no bootstrap credential

Browse Source 
The lead's ENG-5 ruling: on a fresh mesh the bootstrap pushes the holders' own images to the store on its
loopback with no credential, so the front's bootstrap token, its file, the bootstrap-push window and the
program's removal of the file go. Fewer secrets; nothing to refuse once a window closes.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
This commit is contained in:
jschoubben
2026-11-04 17:05:24 +01:00
parent 1f79a4d52a
commit 7cd9b611d2
6 changed files with 12 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/distribution/cmd/distribution/main.go
+1 -46
View File
@@ -1,7 +1,7 @@
// Command distribution is distribution's program (novox/hq design 51): it serves the artifact store's port in front of
// the registry container, which listens on its node's loopback only. Reads (GET, HEAD) go through to every node's
// container runtime; a write is refused but while the direct-write window is open, never over a tag the seat holds
// published, or with the bootstrap's one-off credential (holder.Front). The windows are distribution's state windows:
// published (holder.Front). The windows are distribution's state windows:
// the program moves them (windows.go) and follows the direct-write window's record on each change; it holds no timer.
package main
@@ -10,7 +10,6 @@ import (
"encoding/json"
"errors"
"fmt"
"io/fs"
"log"
"net/http"
"net/url"
@@ -58,7 +57,6 @@ func run(ctx context.Context, getenv func(string) string) error {
windows := process.OptionalBucket(ctx, js, "distribution_windows", "the direct-write window is read as open until the program starts again", logger.Printf)
if windows != nil {
go follow(ctx, windows, &open, logger)
go followBootstrap(ctx, windows, logger)
calls, err := process.Connect(cred)
if err != nil {
return err
@@ -72,13 +70,6 @@ func run(ctx context.Context, getenv func(string) string) error {
Published: func(name, tag string) (bool, error) {
d, err := oci.Digest(name, tag)
return d != "", err
},
Bootstrap: func() (string, bool) {
b, err := os.ReadFile(holder.BootstrapFile)
if err != nil {
return "", false
}
return strings.TrimSpace(string(b)), true
}}
srv := &http.Server{Addr: or(getenv("MESH_REGISTRY_LISTEN"), ":5000"), Handler: front, ReadHeaderTimeout: 30 * time.Second}
errs := make(chan error, 1)
@@ -119,42 +110,6 @@ func follow(ctx context.Context, kv jetstream.KeyValue, open *atomic.Bool, logge
}
}
// followBootstrap removes the bootstrap's one-off credential (holder.BootstrapFile) when the tools bundle closes the
// window bootstrap-push at its first answered publish (design 51 *On a fresh mesh*): the program runs as distribution's
// account, which owns the file. A file already gone is no fault; one that cannot be removed is said each time the
// window is written.
func followBootstrap(ctx context.Context, kv jetstream.KeyValue, logger *log.Logger) {
w, err := kv.Watch(ctx, holder.BootstrapWindow)
if err != nil {
logger.Printf("the bootstrap's credential window cannot be watched (%v): its file stays until the program starts again", err)
return
}
for e := range w.Updates() {
if e == nil || e.Operation() != jetstream.KeyValuePut {
continue
}
var win holder.Window
if json.Unmarshal(e.Value(), &win) != nil || win.Closed.IsZero() {
continue
}
if why := removeBootstrap(holder.BootstrapFile); why != "" {
logger.Printf("%s", why)
}
}
}
// removeBootstrap removes the credential's file; it answers what went wrong, or "" when the file is gone.
func removeBootstrap(path string) string {
switch err := os.Remove(path); {
case err == nil:
return "the bootstrap's one-off credential is discarded: the holders serve publish"
case errors.Is(err, fs.ErrNotExist):
return ""
default:
return fmt.Sprintf("the bootstrap's one-off credential could not be discarded, so it is still accepted: %v", err)
}
}
func or(v, d string) string {
if strings.TrimSpace(v) == "" {
return d
modules/distribution/cmd/distribution/main_test.go
-35
View File
@@ -1,35 +0,0 @@
package main
import (
"os"
"path/filepath"
"strings"
"testing"
)
// The program, which runs as distribution's account, removes the bootstrap's one-off credential when its window
// closes (design 51 *On a fresh mesh*; a3-publish-contract): removed once, a file already gone is no fault, and one
// that cannot be removed is said, since the front still accepts it.
func TestTheProgramDiscardsTheBootstrapCredential(t *testing.T) {
dir := t.TempDir()
file := filepath.Join(dir, "bootstrap-push")
if err := os.WriteFile(file, []byte("token\n"), 0o600); err != nil {
t.Fatal(err)
}
if why := removeBootstrap(file); !strings.Contains(why, "discarded") {
t.Fatalf("first removal = %q, want it said discarded", why)
}
if _, err := os.Stat(file); !os.IsNotExist(err) {
t.Fatalf("the file is still there: %v", err)
}
if why := removeBootstrap(file); why != "" {
t.Fatalf("a file already gone = %q, want nothing said", why)
}
stuck := filepath.Join(dir, "stuck")
if err := os.MkdirAll(filepath.Join(stuck, "child"), 0o700); err != nil {
t.Fatal(err)
}
if why := removeBootstrap(stuck); !strings.Contains(why, "still accepted") {
t.Fatalf("an unremovable file = %q, want it said still accepted", why)
}
}