diff --git a/modules/distribution/cmd/distribution-tools/main.go b/modules/distribution/cmd/distribution-tools/main.go index 9d9ed628..8b548cad 100644 --- a/modules/distribution/cmd/distribution-tools/main.go +++ b/modules/distribution/cmd/distribution-tools/main.go @@ -104,12 +104,26 @@ func finding(kind, subject, words string, raised bool) { } } -// removeBootstrap discards the bootstrap's one-off credential once a publish is answered (design 51 *On a fresh mesh*). -var removeBootstrap = sync.OnceFunc(func() { - if err := os.Remove(holder.BootstrapFile); err == nil { - logf("the bootstrap's one-off credential is discarded: the holders serve publish") - } -}) +// closeBootstrap asks the program to discard the bootstrap's one-off credential once a publish is answered (design 51 +// *On a fresh mesh*): the window bootstrap-push closed in the state windows, which the program follows and then removes +// the file. The tools bundle runs in the tool runner's account, which cannot remove a file in distribution's state +// directory. Once per process; the window's record says it to the next. +var closeBootstrap func() + +func bootstrapCloser(windows kept[holder.Window]) func() { + return sync.OnceFunc(func() { + cur, _, err := windows.Get(holder.BootstrapWindow) + if err == nil && !cur.Closed.IsZero() { + return + } + w := holder.Window{Name: holder.BootstrapWindow, Closed: time.Now().UTC()} + if err := windows.Put(w); err != nil { + logf("the bootstrap's one-off credential could not be asked away: %v", err) + return + } + logf("the bootstrap's one-off credential is asked away: the holders serve publish") + }) +} func arg[T any](args map[string]any) (T, error) { var v T @@ -142,8 +156,8 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool { } _, _ = v.DropIdle() a, err := v.Publish(seat, stdio.CallerOf(args), r) - if err == nil { - removeBootstrap() + if err == nil && closeBootstrap != nil { + closeBootstrap() } return a, err }}, @@ -254,8 +268,12 @@ func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool { return nil, err } } - _, bootstrap := os.Stat(holder.BootstrapFile) - return map[string]any{"window": cur, "bootstrap_credential_present": bootstrap == nil}, nil + b, _, err := windows.Get(holder.BootstrapWindow) + if err != nil { + return nil, err + } + // The program removes the file when this window closes and writes it closed again with its removal's time. + return map[string]any{"window": cur, "bootstrap_credential_discarded": !b.Closed.IsZero(), "bootstrap": b}, nil }}) } return out @@ -273,6 +291,7 @@ func main() { Transfers: kept[holder.Transfer]{state: holder.TransfersState, key: func(t holder.Transfer) string { return t.Transfer }}} v := &holder.Verbs{Holder: h, Catalog: store, Holds: kept[holder.Hold]{state: "holds", key: holder.Hold.Key}} windows := kept[holder.Window]{state: "windows", key: func(w holder.Window) string { return w.Name }} + closeBootstrap = bootstrapCloser(windows) if err := stdio.Serve("", tools(v, windows)); err != nil { logf("%v", err) os.Exit(1) diff --git a/modules/distribution/cmd/distribution/main.go b/modules/distribution/cmd/distribution/main.go index ccf51512..9c61d806 100644 --- a/modules/distribution/cmd/distribution/main.go +++ b/modules/distribution/cmd/distribution/main.go @@ -10,6 +10,7 @@ import ( "encoding/json" "errors" "fmt" + "io/fs" "log" "net/http" "net/url" @@ -57,6 +58,7 @@ func run(ctx context.Context, getenv func(string) string) error { windows := process.OptionalBucket(ctx, js, "distribution_windows", "the direct-write window is read as open until the program starts again", logger.Printf) if windows != nil { go follow(ctx, windows, &open, logger) + go followBootstrap(ctx, windows, logger) } front := &holder.Front{Store: store, Window: &open, Logf: logger.Printf, Published: func(name, tag string) (bool, error) { @@ -109,6 +111,42 @@ func follow(ctx context.Context, kv jetstream.KeyValue, open *atomic.Bool, logge } } +// followBootstrap removes the bootstrap's one-off credential (holder.BootstrapFile) when the tools bundle closes the +// window bootstrap-push at its first answered publish (design 51 *On a fresh mesh*): the program runs as distribution's +// account, which owns the file. A file already gone is no fault; one that cannot be removed is said each time the +// window is written. +func followBootstrap(ctx context.Context, kv jetstream.KeyValue, logger *log.Logger) { + w, err := kv.Watch(ctx, holder.BootstrapWindow) + if err != nil { + logger.Printf("the bootstrap's credential window cannot be watched (%v): its file stays until the program starts again", err) + return + } + for e := range w.Updates() { + if e == nil || e.Operation() != jetstream.KeyValuePut { + continue + } + var win holder.Window + if json.Unmarshal(e.Value(), &win) != nil || win.Closed.IsZero() { + continue + } + if why := removeBootstrap(holder.BootstrapFile); why != "" { + logger.Printf("%s", why) + } + } +} + +// removeBootstrap removes the credential's file; it answers what went wrong, or "" when the file is gone. +func removeBootstrap(path string) string { + switch err := os.Remove(path); { + case err == nil: + return "the bootstrap's one-off credential is discarded: the holders serve publish" + case errors.Is(err, fs.ErrNotExist): + return "" + default: + return fmt.Sprintf("the bootstrap's one-off credential could not be discarded, so it is still accepted: %v", err) + } +} + func or(v, d string) string { if strings.TrimSpace(v) == "" { return d diff --git a/modules/distribution/cmd/distribution/main_test.go b/modules/distribution/cmd/distribution/main_test.go new file mode 100644 index 00000000..f9ef3acf --- /dev/null +++ b/modules/distribution/cmd/distribution/main_test.go @@ -0,0 +1,35 @@ +package main + +import ( + "os" + "path/filepath" + "strings" + "testing" +) + +// The program, which runs as distribution's account, removes the bootstrap's one-off credential when its window +// closes (design 51 *On a fresh mesh*; a3-publish-contract): removed once, a file already gone is no fault, and one +// that cannot be removed is said, since the front still accepts it. +func TestTheProgramDiscardsTheBootstrapCredential(t *testing.T) { + dir := t.TempDir() + file := filepath.Join(dir, "bootstrap-push") + if err := os.WriteFile(file, []byte("token\n"), 0o600); err != nil { + t.Fatal(err) + } + if why := removeBootstrap(file); !strings.Contains(why, "discarded") { + t.Fatalf("first removal = %q, want it said discarded", why) + } + if _, err := os.Stat(file); !os.IsNotExist(err) { + t.Fatalf("the file is still there: %v", err) + } + if why := removeBootstrap(file); why != "" { + t.Fatalf("a file already gone = %q, want nothing said", why) + } + stuck := filepath.Join(dir, "stuck") + if err := os.MkdirAll(filepath.Join(stuck, "child"), 0o700); err != nil { + t.Fatal(err) + } + if why := removeBootstrap(stuck); !strings.Contains(why, "still accepted") { + t.Fatalf("an unremovable file = %q, want it said still accepted", why) + } +} diff --git a/modules/distribution/internal/holder/window.go b/modules/distribution/internal/holder/window.go index 8b626823..3336d74c 100644 --- a/modules/distribution/internal/holder/window.go +++ b/modules/distribution/internal/holder/window.go @@ -16,6 +16,10 @@ import ( const ( OldNameWindow = "old-name" DirectWritesWindow = "direct-writes" + // BootstrapWindow is the bootstrap's one-off credential (BootstrapFile): open while the file is there. The tools + // bundle closes it at its first answered publish; the program, which runs as distribution's account and alone may + // remove the file in distribution's state directory, removes it on that close. + BootstrapWindow = "bootstrap-push" // WindowFindingAfter is how long a node holds a window open before it is distribution's finding naming the node. WindowFindingAfter = 7 * 24 * time.Hour // The events a window's close says on distribution's own family distribution.events (7 days, 16 MiB, drop