From 69a67876c269eb02870d186a461820bd7bd1962c Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 21 Oct 2026 12:55:08 +0200 Subject: [PATCH 1/3] Take mesh-sdk at 6f63275, which counts an item's text as a placement of a config value (issue 1658) --- go.mod | 2 +- go.sum | 4 ++-- testdata/beside/CAPTURED | 2 +- .../novox/mesh-sdk/go/catalogue/files.go | 16 ++++++++++++++++ .../novox/mesh-sdk/go/catalogue/setting_into.go | 6 +++++- vendor/modules.txt | 2 +- 6 files changed, 26 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 2c0bb303..4f6f5f6d 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/novox/mesh-controller go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021130958-85b5a2687e6a + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021150202-6f6327587d19 github.com/jackc/pgx/v5 v5.10.0 github.com/nats-io/nats-server/v2 v2.11.17 github.com/nats-io/nats.go v1.54.0 diff --git a/go.sum b/go.sum index 6b818e32..1642fb96 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4= git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE= -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021130958-85b5a2687e6a h1:CVTQBD4vxbGQ+TW9MWAut/ABQN6nvAZ1VTqojNpvGUE= -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021130958-85b5a2687e6a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021150202-6f6327587d19 h1:OZ5igcMOiwx+uhsOHXF58pdF3LGt/HWhMhAEARO8LaM= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021150202-6f6327587d19/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= diff --git a/testdata/beside/CAPTURED b/testdata/beside/CAPTURED index 7d76163f..cbb0879c 100644 --- a/testdata/beside/CAPTURED +++ b/testdata/beside/CAPTURED @@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself. mesh-catalog e0bc919d4945bb5f13f971f74643a0b714cf45da modules/*/module.json, modules/nats/Dockerfile mesh-host 9d9e3a46c4f5943cfffb413d962ce48b75e2fd39 examples/foundation-first-node.lock -mesh-sdk 85b5a2687e6a8d0854dd8e53ed68f98e0e9d3c1b conformance/events/module-event.json +mesh-sdk 6f6327587d193bdca17ffab9008e2a7a6e9155f2 conformance/events/module-event.json To move them, from this repository's root, with the two repositories checked out beside it: diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/files.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/files.go index f1356ed1..a1231a34 100644 --- a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/files.go +++ b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/files.go @@ -74,6 +74,22 @@ func filesVerbs() []Verb { map[string]string{"path": "an absolute path", "owner": "an account's name or number", "group": "a group's name or number (optional)", "recursive": "\"true\": also everything under a directory"}, []string{"path", "owner"}, []string{"group", "recursive"}, "chown", "chgrp"), + Verb{Name: "upload", Description: "Send one file of this node into a bucket of the object store, over a short signed link " + + "and never over the bus; answers the key (the file's SHA-256 when none is given), the size and the SHA-256. " + + "At most 100 MiB. A place a secret is kept, a known credential file, or a link to one is refused by name, " + + "before anything is sent. Read " + filesAsAccount + ".", + Input: schema(map[string]string{"path": "an absolute path to a file", "bucket": "the bucket the file goes into", + "key": "the object's key (optional; the file's SHA-256 when not given)"}, []string{"path", "bucket"})}, + // download is a plain Verb, not through write(): write() types its optional arguments as true/false + // switches, which a hash and a reason are not (issue 1719). + Verb{Name: "download", Description: "Write one object of a bucket to a file of this node, over a short signed link and " + + "never over the bus; the old file goes to the node's trash. At most 100 MiB. The bytes must hash to sha256, or to " + + "the key when the key is a SHA-256; otherwise no file is written. Refuses a path a module owns " + + "unless override names a reason; done as the node's operator account, through sudo -n where its rights do not reach.", + Input: schema(map[string]string{"bucket": "the bucket", "key": "the object's key", "path": "an absolute path", + "sha256": "the SHA-256 the bytes must have (optional; the key when that is a SHA-256)", + "reason": "why the file is changed, for the audit trail", + "override": overrideWord}, []string{"bucket", "key", "path", "reason"})}, Verb{Name: "trash", Description: "What the node's trash holds: each deleted or replaced item with its id, " + "original path and when it went.", Input: schema(map[string]string{}, nil), Replaces: []string{"ls ~/.local/share/Trash"}}, diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go index 73bd2b08..e16e28d4 100644 --- a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go +++ b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go @@ -327,7 +327,7 @@ func settingKeysUsedBy(m Manifest) map[string]bool { return used } -// settingKeysAskedOutsideOwners is every key a module's files, units, contributions and served facts +// settingKeysAskedOutsideOwners is every key a module's files, units, items, contributions and served facts // ask for: what a directory's owner may follow (OwnerSettingProblems). func settingKeysAskedOutsideOwners(m Manifest) map[string]bool { used := map[string]bool{} @@ -354,6 +354,10 @@ func settingKeysAskedOutsideOwners(m Manifest) map[string]bool { } } } + // An item's text, filled from its template (WithTemplatesFrom), places a key as a file's does (issue 1658). + for _, it := range m.Items { + note(it.Content) + } inValues := func(values map[string]any) { for _, v := range values { if s, ok := v.(string); ok { diff --git a/vendor/modules.txt b/vendor/modules.txt index 127b9a13..89e0e229 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1,4 +1,4 @@ -# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021130958-85b5a2687e6a +# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021150202-6f6327587d19 ## explicit; go 1.26.0 git.novox.be/novox/mesh-sdk/go/asks git.novox.be/novox/mesh-sdk/go/catalogue From 373aefd14eb502adcc77945c2cb0a1f6eff74e87 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 21 Oct 2026 19:43:32 +0200 Subject: [PATCH 2/3] Take mesh-sdk at 07a6592, which counts an item's text as a placement of a config value (issue 1658) --- go.mod | 2 +- go.sum | 4 ++-- testdata/beside/CAPTURED | 2 +- .../novox/mesh-sdk/go/catalogue/setting_into.go | 6 +++++- vendor/modules.txt | 2 +- 5 files changed, 10 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index dcb6ff56..8ff82d6e 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/novox/mesh-controller go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021153908-725590e06e75 + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021173436-07a65927c362 github.com/jackc/pgx/v5 v5.10.0 github.com/nats-io/nats-server/v2 v2.11.17 github.com/nats-io/nats.go v1.54.0 diff --git a/go.sum b/go.sum index f06c6de7..61194a3d 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5 h1:E5stfIeCN6uYgA9TCv+4K8JgaURg3zQppvUgJLaDMP4= git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5/go.mod h1:4wyoCr6IIIIarEUuROThWDj7DAvJvIidqMjWcpSnOwE= -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021153908-725590e06e75 h1:AcYfyJpYaUufhI93VG76+b001msXY4XX7kuRjnf33HY= -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021153908-725590e06e75/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021173436-07a65927c362 h1:Ud/YHmhlm0qdB45LyDvxq7l4x6Bg2Ye0siHK5JFE+kk= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021173436-07a65927c362/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= diff --git a/testdata/beside/CAPTURED b/testdata/beside/CAPTURED index 7f81fd0d..515d20d5 100644 --- a/testdata/beside/CAPTURED +++ b/testdata/beside/CAPTURED @@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself. mesh-catalog e0bc919d4945bb5f13f971f74643a0b714cf45da modules/*/module.json, modules/nats/Dockerfile mesh-host 9d9e3a46c4f5943cfffb413d962ce48b75e2fd39 examples/foundation-first-node.lock -mesh-sdk 725590e06e75c67b96ce58d015b3056c2d261249 conformance/events/module-event.json +mesh-sdk 07a65927c3620390e191cb6ccc97d3770f284526 conformance/events/module-event.json To move them, from this repository's root, with the two repositories checked out beside it: diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go index 73bd2b08..e16e28d4 100644 --- a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go +++ b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go @@ -327,7 +327,7 @@ func settingKeysUsedBy(m Manifest) map[string]bool { return used } -// settingKeysAskedOutsideOwners is every key a module's files, units, contributions and served facts +// settingKeysAskedOutsideOwners is every key a module's files, units, items, contributions and served facts // ask for: what a directory's owner may follow (OwnerSettingProblems). func settingKeysAskedOutsideOwners(m Manifest) map[string]bool { used := map[string]bool{} @@ -354,6 +354,10 @@ func settingKeysAskedOutsideOwners(m Manifest) map[string]bool { } } } + // An item's text, filled from its template (WithTemplatesFrom), places a key as a file's does (issue 1658). + for _, it := range m.Items { + note(it.Content) + } inValues := func(values map[string]any) { for _, v := range values { if s, ok := v.(string); ok { diff --git a/vendor/modules.txt b/vendor/modules.txt index 49cf5d54..7973b78c 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1,4 +1,4 @@ -# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021153908-725590e06e75 +# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021173436-07a65927c362 ## explicit; go 1.26.0 git.novox.be/novox/mesh-sdk/go/asks git.novox.be/novox/mesh-sdk/go/catalogue From 99610e9569fe39aaeecbc32d55e7021b63180a92 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 21 Oct 2026 19:59:58 +0200 Subject: [PATCH 3/3] Cut the controller's slowest unit tests (a source scan that regexed every file, resolver stand-in timeouts, a wait bound) so mesh-controller's unit level fits its bound (issue 1763) --- cmd/mesh-controller/forge_wait_test.go | 2 +- cmd/mesh-controller/plan_moved_every_writer_test.go | 3 ++- cmd/mesh-controller/sayable_test.go | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/cmd/mesh-controller/forge_wait_test.go b/cmd/mesh-controller/forge_wait_test.go index 8216e91c..8a580cf0 100644 --- a/cmd/mesh-controller/forge_wait_test.go +++ b/cmd/mesh-controller/forge_wait_test.go @@ -68,7 +68,7 @@ func TestTheForgeNotAnsweringInTimeIsNotAskedAgain(t *testing.T) { // An ask that hangs past the bound is cut off at the bound, not at its own wait, and the failure still says it // waited: the receive loop is held no longer than the bound (novox/hq issue 486). func TestAnAskHangingPastTheBoundIsCutOffAtIt(t *testing.T) { - w := waitOut{bound: 200 * time.Millisecond, first: 10 * time.Millisecond, most: 50 * time.Millisecond, + w := waitOut{bound: 100 * time.Millisecond, first: 10 * time.Millisecond, most: 50 * time.Millisecond, now: time.Now, sleep: sleepOrDone} asked := 0 began := time.Now() diff --git a/cmd/mesh-controller/plan_moved_every_writer_test.go b/cmd/mesh-controller/plan_moved_every_writer_test.go index be7f712b..1b68d3da 100644 --- a/cmd/mesh-controller/plan_moved_every_writer_test.go +++ b/cmd/mesh-controller/plan_moved_every_writer_test.go @@ -31,7 +31,8 @@ func TestNoPlanIsWrittenButThroughSavePlansMoving(t *testing.T) { return err } text := string(raw) - if write.MatchString(text) { + // The regular expression is the costly part of reading every source: only a file that names the table can match. + if strings.Contains(strings.ToLower(text), "release_plan") && write.MatchString(text) { found = append(found, path+" writes the plan table") } // A plan record is written by the bucket's raw create and update, which only the plans' own file calls. diff --git a/cmd/mesh-controller/sayable_test.go b/cmd/mesh-controller/sayable_test.go index 1d51afa6..60481280 100644 --- a/cmd/mesh-controller/sayable_test.go +++ b/cmd/mesh-controller/sayable_test.go @@ -152,7 +152,7 @@ func answersRightly(q dnsmessage.Question) *dnsmessage.Message { func quickResolvers(t *testing.T, port string) { t.Helper() before, within, pause := resolverPort, resolverWithin, resolverPause - resolverPort, resolverWithin, resolverPause = port, 150*time.Millisecond, 10*time.Millisecond + resolverPort, resolverWithin, resolverPause = port, 60*time.Millisecond, 5*time.Millisecond t.Cleanup(func() { resolverPort, resolverWithin, resolverPause = before, within, pause }) }