jschoubben
75986b2960
Until now mirror only answered a copy the store already held, so mesh-build-image had nothing to call for an upstream base (design 51: an upstream image is copied by mirror with its pinned digest). The copy takes an anonymous pull token, checks every manifest's and blob's bytes against its digest, copies an index's every platform first, and fetches only the blobs the store lacks. tags was already served. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
300 lines
13 KiB
Go
300 lines
13 KiB
Go
// Command distribution-tools serves distribution's seat verbs and tools (novox/hq design 51): the verbs of
|
|
// container-image-registry and oci-artifact-registry, each as `<seat>.<verb>`, and registry_incoming, registry_holds,
|
|
// registry_old_name and registry_direct_writes. The runtime launches it on distribution's own account; the caller of
|
|
// every verb is the one the tool runner proved (stdio.CallerOf), never a name in the arguments. stdout is the MCP
|
|
// channel; what it says, it says on stderr.
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net/url"
|
|
"os"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
stdio "git.novox.be/novox/mesh-sdk/go"
|
|
"git.novox.be/novox/mesh-sdk/go/health"
|
|
|
|
"distribution/internal/holder"
|
|
)
|
|
|
|
func logf(format string, a ...any) { fmt.Fprintf(os.Stderr, "[distribution-tools] "+format+"\n", a...) }
|
|
|
|
// kept is one state of distribution's, through the runtime.
|
|
type kept[T any] struct {
|
|
state string
|
|
key func(T) string
|
|
}
|
|
|
|
func (k kept[T]) Get(key string) (T, bool, error) {
|
|
var v T
|
|
e, err := stdio.State(k.state).Get(key)
|
|
if err != nil || e == nil {
|
|
return v, false, err
|
|
}
|
|
return v, true, json.Unmarshal(e.Value, &v)
|
|
}
|
|
func (k kept[T]) Put(v T) error {
|
|
_, err := stdio.State(k.state).Put(k.key(v), v)
|
|
return err
|
|
}
|
|
func (k kept[T]) Delete(key string) error { return stdio.State(k.state).Delete(key) }
|
|
func (k kept[T]) List() ([]T, error) {
|
|
keys, err := stdio.State(k.state).Keys()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var out []T
|
|
for _, key := range keys {
|
|
if v, ok, err := k.Get(key); err == nil && ok {
|
|
out = append(out, v)
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// errNoObjects is said while the runtime offers a bundle no object store: the helper is mesh-sdk's (ADR 0611 §7, the
|
|
// parts helper in mesh-sdk's runtime), asked of the milestone's mesh-sdk work. Until then a part is refused loudly.
|
|
var errNoObjects = errors.New("incoming cannot be written: the runtime's object store helper (mesh-sdk, ADR 0611 §7) is not in this build")
|
|
|
|
type objects struct{}
|
|
|
|
func (objects) Put(string, []byte) error { return errNoObjects }
|
|
func (objects) Get(string) ([]byte, error) { return nil, errNoObjects }
|
|
func (objects) Delete(string) error { return nil }
|
|
func (objects) Used() (uint64, error) { return 0, nil }
|
|
|
|
// builderVersions asks the builder's builder_versions (ADR 0605 §4).
|
|
type builderVersions struct{}
|
|
|
|
func (builderVersions) Recorded(name, version, digest string) (bool, string, error) {
|
|
raw, err := stdio.Ask("mesh-delivery-builder.builder_versions", map[string]any{"name": name, "version": version, "digest": digest})
|
|
if err != nil {
|
|
return false, "", err
|
|
}
|
|
var a struct {
|
|
Recorded *bool `json:"recorded"`
|
|
Why string `json:"why"`
|
|
}
|
|
if err := json.Unmarshal(raw, &a); err != nil || a.Recorded == nil {
|
|
return false, "", fmt.Errorf("builder_versions answered no recorded: %s", raw)
|
|
}
|
|
return *a.Recorded, a.Why, nil
|
|
}
|
|
|
|
func say(seat, event string, body holder.Event) error {
|
|
return stdio.SeatPublish("mesh.seat."+seat+".event."+event, body, "")
|
|
}
|
|
|
|
func finding(kind, subject, words string, raised bool) {
|
|
key := health.FindingKey(health.ScopeSeat, "distribution", kind+"."+strings.NewReplacer(".", "_", "@", "_", "/", "_").Replace(subject))
|
|
if !raised {
|
|
_ = stdio.State(health.FindingsState).Delete(key)
|
|
return
|
|
}
|
|
f := health.Finding{V: health.FindingVersion, Key: key, Kind: kind, Ref: key[strings.LastIndex(key, ".")+1:],
|
|
Subject: health.Subject{Scope: health.ScopeSeat, ID: "distribution"}, Severity: health.Warning,
|
|
Summary: words, Headline: words, Explanation: words, Resolved: "cleared once it no longer holds",
|
|
Source: kind, Observer: "distribution", At: time.Now().UTC()}
|
|
if _, err := stdio.State(health.FindingsState).Put(key, f); err != nil {
|
|
logf("the finding %s could not be written: %v", key, err)
|
|
}
|
|
}
|
|
|
|
// closeBootstrap asks the program to discard the bootstrap's one-off credential once a publish is answered (design 51
|
|
// *On a fresh mesh*): the window bootstrap-push closed in the state windows, which the program follows and then removes
|
|
// the file. The tools bundle runs in the tool runner's account, which cannot remove a file in distribution's state
|
|
// directory. Once per process; the window's record says it to the next.
|
|
var closeBootstrap func()
|
|
|
|
func bootstrapCloser(windows kept[holder.Window]) func() {
|
|
return sync.OnceFunc(func() {
|
|
cur, _, err := windows.Get(holder.BootstrapWindow)
|
|
if err == nil && !cur.Closed.IsZero() {
|
|
return
|
|
}
|
|
w := holder.Window{Name: holder.BootstrapWindow, Closed: time.Now().UTC()}
|
|
if err := windows.Put(w); err != nil {
|
|
logf("the bootstrap's one-off credential could not be asked away: %v", err)
|
|
return
|
|
}
|
|
logf("the bootstrap's one-off credential is asked away: the holders serve publish")
|
|
})
|
|
}
|
|
|
|
func arg[T any](args map[string]any) (T, error) {
|
|
var v T
|
|
clean := map[string]any{}
|
|
for k, x := range args {
|
|
if k != "_meta" {
|
|
clean[k] = x
|
|
}
|
|
}
|
|
b, _ := json.Marshal(clean)
|
|
return v, json.Unmarshal(b, &v)
|
|
}
|
|
|
|
func str(args map[string]any, k string) string { s, _ := args[k].(string); return strings.TrimSpace(s) }
|
|
|
|
func tools(v *holder.Verbs, windows kept[holder.Window]) []stdio.Tool {
|
|
obj := func(props map[string]any, req ...string) map[string]any {
|
|
return map[string]any{"type": "object", "required": req, "properties": props}
|
|
}
|
|
s := func(d string) map[string]any { return map[string]any{"type": "string", "description": d} }
|
|
var out []stdio.Tool
|
|
for _, seat := range holder.Seats {
|
|
out = append(out,
|
|
stdio.Tool{Name: seat + "." + holder.VerbPublish, Description: "Open a transfer of a publish (ADR 0611): its name, version, kind, digest and parts; answers the parts the holder lacks.",
|
|
Input: obj(map[string]any{"transfer": s("the transfer's id"), "name": s("<module>/<artifact>"), "version": s("the builder's version"), "kind": s("image, bundle, archive or upstream"), "digest": s("sha256:…"), "parts": map[string]any{"type": "array"}}, "transfer", "name", "kind", "digest", "parts"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
r, err := arg[holder.PublishRequest](args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
_, _ = v.DropIdle()
|
|
a, err := v.Publish(seat, stdio.CallerOf(args), r)
|
|
if err == nil && closeBootstrap != nil {
|
|
closeBootstrap()
|
|
}
|
|
return a, err
|
|
}},
|
|
stdio.Tool{Name: seat + "." + holder.VerbPublishPart, Description: "Send one chunk (at most 1 MiB) of one part of an open transfer, from the caller that opened it.",
|
|
Input: obj(map[string]any{"transfer": s("its id"), "digest": s("the part's digest"), "sequence": map[string]any{"type": "integer"}, "last": map[string]any{"type": "boolean"}, "data": s("base64")}, "transfer", "digest", "data"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
r, err := arg[holder.PartRequest](args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return v.PublishPart(seat, stdio.CallerOf(args), r)
|
|
}},
|
|
stdio.Tool{Name: seat + "." + holder.VerbVersions, Description: "The versions the seat holds of a name.", Input: obj(map[string]any{"name": s("<module>/<artifact>")}, "name"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
return v.Versions(seat, stdio.CallerOf(args), str(args, "name"))
|
|
}},
|
|
stdio.Tool{Name: seat + "." + holder.VerbRemove, Description: "Remove a tagged version (the builder), or for retention an untagged one by its digest (the artifact sweep); says removed.",
|
|
Input: obj(map[string]any{"name": s("name"), "version": s("a tagged version"), "digest": s("for retention"), "kind": s("kind"), "reason": s("why")}, "name", "reason"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
r, err := arg[holder.RemoveRequest](args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return map[string]any{"removed": true}, v.Remove(seat, stdio.CallerOf(args), r)
|
|
}},
|
|
stdio.Tool{Name: seat + "." + holder.VerbHold, Description: "Keep one untagged bundle, archive or copied base from retention (the artifact sweep alone); says held.",
|
|
Input: obj(map[string]any{"name": s("name"), "kind": s("bundle, archive or upstream"), "digest": s("sha256:…"), "why": s("why")}, "name", "kind", "digest"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
r, err := arg[holder.HoldRequest](args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return map[string]any{"held": true}, v.HoldOne(seat, stdio.CallerOf(args), r)
|
|
}},
|
|
stdio.Tool{Name: seat + "." + holder.VerbRelease, Description: "Let a hold go (the artifact sweep, or the operator's session through registry_holds); says released.",
|
|
Input: obj(map[string]any{"name": s("name"), "digest": s("sha256:…"), "why": s("why")}, "name", "digest"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
r, err := arg[holder.HoldRequest](args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return map[string]any{"released": true}, v.Release(seat, stdio.CallerOf(args), r)
|
|
}},
|
|
)
|
|
}
|
|
out = append(out,
|
|
stdio.Tool{Name: holder.ImageSeat + "." + holder.VerbTags, Description: "The tags of an image.", Input: obj(map[string]any{"name": s("name")}, "name"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
return v.Tags(holder.ImageSeat, stdio.CallerOf(args), str(args, "name"))
|
|
}},
|
|
stdio.Tool{Name: holder.ImageSeat + "." + holder.VerbMirror, Description: "Copy an outside image, pinned by its digest, into the store as upstream/<host>/<path> (every platform, only the parts it lacks) and answer its reference; says published (mesh-build-image alone).",
|
|
Input: obj(map[string]any{"source": s("<host>/<path>"), "digest": s("sha256:…")}, "source", "digest"),
|
|
Run: func(args map[string]any) (any, error) {
|
|
r, err := arg[holder.MirrorRequest](args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
ref, err := v.Mirror(holder.ImageSeat, stdio.CallerOf(args), r)
|
|
return map[string]any{"reference": ref}, err
|
|
}},
|
|
stdio.Tool{Name: "registry_incoming", Description: "Open transfers of incoming and its fill; with drop, drops one by hand (a hand act, why required).",
|
|
Input: obj(map[string]any{"drop": s("a transfer id to drop"), "why": s("why it is dropped")}),
|
|
Run: func(args map[string]any) (any, error) {
|
|
idle, _ := v.DropIdle()
|
|
if id := str(args, "drop"); id != "" {
|
|
if str(args, "why") == "" {
|
|
return nil, errors.New("a drop is a hand act: say why")
|
|
}
|
|
t, err := v.Drop(id)
|
|
logf("transfer %s dropped by hand by %s: %s", id, stdio.CallerOf(args), str(args, "why"))
|
|
return map[string]any{"dropped": t.Transfer}, err
|
|
}
|
|
all, err := v.Transfers.List()
|
|
used, _ := v.Objects.Used()
|
|
return map[string]any{"transfers": all, "used": used, "cap": holder.IncomingCap, "dropped_idle": idle}, err
|
|
}},
|
|
stdio.Tool{Name: "registry_holds", Description: "What is held, since when and for whom; with release, lets one go through the seat's release as the operator's session (a hand act).",
|
|
Input: obj(map[string]any{"seat": s("the seat"), "release": s("the name to release"), "digest": s("its digest"), "why": s("why")}),
|
|
Run: func(args map[string]any) (any, error) {
|
|
if name := str(args, "release"); name != "" {
|
|
if str(args, "why") == "" {
|
|
return nil, errors.New("a release by hand is a hand act: say why")
|
|
}
|
|
// The caller proved on this call (the operator's session) is carried on; distribution's own never.
|
|
return map[string]any{"released": name}, v.Release(str(args, "seat"), stdio.CallerOf(args), holder.HoldRequest{Name: name, Digest: str(args, "digest"), Why: str(args, "why")})
|
|
}
|
|
return v.HeldNow()
|
|
}},
|
|
)
|
|
for _, w := range []string{holder.OldNameWindow, holder.DirectWritesWindow} {
|
|
name := "registry_old_name"
|
|
if w == holder.DirectWritesWindow {
|
|
name = "registry_direct_writes"
|
|
}
|
|
out = append(out, stdio.Tool{Name: name, Description: "Whether the " + w + " window is open and the nodes holding it, since when; with drop, drops a retired node from it by hand (a hand act, why required).",
|
|
Input: obj(map[string]any{"drop": s("a retired node"), "why": s("why")}),
|
|
Run: func(args map[string]any) (any, error) {
|
|
cur, _, err := windows.Get(w)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
cur.Name = w
|
|
if node := str(args, "drop"); node != "" {
|
|
if cur, err = cur.Drop(node, stdio.CallerOf(args), str(args, "why"), time.Now().UTC()); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := windows.Put(cur); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
b, _, err := windows.Get(holder.BootstrapWindow)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
// The program removes the file when this window closes and writes it closed again with its removal's time.
|
|
return map[string]any{"window": cur, "bootstrap_credential_discarded": !b.Closed.IsZero(), "bootstrap": b}, nil
|
|
}})
|
|
}
|
|
return out
|
|
}
|
|
|
|
func main() {
|
|
callers, err := holder.ParseCallers(os.Getenv("MESH_CONFIG_CALLERS"))
|
|
if err != nil {
|
|
logf("%v", err)
|
|
os.Exit(1)
|
|
}
|
|
base, _ := url.Parse("http://127.0.0.1:5001")
|
|
store := &holder.OCI{Base: base, Registry: os.Getenv("MESH_REGISTRY_REACH"), Upstream: &holder.Upstream{}}
|
|
h := &holder.Holder{Callers: callers, Objects: objects{}, Builder: builderVersions{}, Store: store, Say: say, Finding: finding,
|
|
Transfers: kept[holder.Transfer]{state: holder.TransfersState, key: func(t holder.Transfer) string { return t.Transfer }}}
|
|
v := &holder.Verbs{Holder: h, Catalog: store, Holds: kept[holder.Hold]{state: "holds", key: holder.Hold.Key}}
|
|
windows := kept[holder.Window]{state: "windows", key: func(w holder.Window) string { return w.Name }}
|
|
closeBootstrap = bootstrapCloser(windows)
|
|
if err := stdio.Serve("", tools(v, windows)); err != nil {
|
|
logf("%v", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|