From b2bf14ab0147d0437b03e190db59f24f5a63cd9a Mon Sep 17 00:00:00 2001 From: jochen Date: Sat, 24 Oct 2026 05:31:34 +0200 Subject: [PATCH] Read a build's fingerprint back by its id, so the controller writes the grants the assigner reads (issue 1938) chainBuildByID answered a trimmed build without SourceFingerprint since builds moved to the builds bucket (issue 1090), so currentFingerprints read every fingerprint empty and grantsFrom skipped every module: mesh-controller_grants has never held a key, and TestTheGrantOfAnIssuedCredentialIsOnTheBus failed on main. --- internal/inventory/chain_builds.go | 4 +++- internal/inventory/chain_store_test.go | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/internal/inventory/chain_builds.go b/internal/inventory/chain_builds.go index 0ae1b7a3..03517eac 100644 --- a/internal/inventory/chain_builds.go +++ b/internal/inventory/chain_builds.go @@ -658,9 +658,11 @@ func (i *Inventory) chainBuildByID(ctx context.Context, c *chain.Chain, id strin if err != nil || !ok { return Build{}, false, err } + // **The fingerprint read back with the rest** (novox/hq issue 1938): the controller's grants are keyed by it + // (grants.go currentFingerprints), and a build read without it wrote no grant at all from 2026-10-18 on. b := fromChainBuild(rec) return Build{ID: b.ID, Repository: b.Repository, Ref: b.Ref, Module: b.Module, Commit: b.Commit, On: b.On, - Failed: b.Failed, Made: b.Made, Path: b.Path, Asked: b.Asked, At: b.At}, true, nil + Failed: b.Failed, Made: b.Made, Path: b.Path, Asked: b.Asked, At: b.At, SourceFingerprint: b.SourceFingerprint}, true, nil } func (i *Inventory) chainBuiltAgainst(ctx context.Context, c *chain.Chain) (map[string][]string, error) { diff --git a/internal/inventory/chain_store_test.go b/internal/inventory/chain_store_test.go index 6661dfba..d05be0d2 100644 --- a/internal/inventory/chain_store_test.go +++ b/internal/inventory/chain_store_test.go @@ -26,6 +26,7 @@ func TestBuildsOnTheBusAreReadBackByEveryReader(t *testing.T) { first.ReuseKey = "rk-1" second := aBuild("build-2", "notes", "") second.Commit = "c2" + second.SourceFingerprint = "src2:" + strings.Repeat("2", 64) failed := aBuild("build-3", "notes", "compile error") other := aBuild("build-4", "wiki", "") for _, b := range []Build{first, second, failed, other, first} { @@ -48,6 +49,10 @@ func TestBuildsOnTheBusAreReadBackByEveryReader(t *testing.T) { if err != nil || !found || one.Commit != "c2" || one.Module != "notes" { t.Fatalf("build-2 reads as %+v %v %v", one, found, err) } + // 1938: the fingerprint is read back, which the controller's grants are keyed by. + if one.SourceFingerprint != second.SourceFingerprint { + t.Errorf("build-2 reads back the fingerprint %q; want %q", one.SourceFingerprint, second.SourceFingerprint) + } if _, found, _ := inv.BuildByID(ctx, "build-nope"); found { t.Fatal("a build nobody recorded was found") }