mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-22 18:24:21 +00:00
Evan JarrettandClaude Opus 5
a63f668de0
An audit of the scan pipeline and the hold side of scanning found several ways scanning stops without saying so. Each fix here was written test-first: a test expressing the wanted behaviour, confirmed failing for the right reason, then the change. A summary-less result crash-looped both processes. worker.go dereferenced result.Summary unconditionally, but processJob only sets it when Grype runs, and SendResult puts the nil on the wire before the scanner dies on it, so handleResult's unguarded log killed the hold too. A nil Summary now means "not scanned for vulnerabilities", deliberately distinct from "scanned, found zero" — inventing a zeroed summary would report every image as clean when Grype never ran. The hold writes a record rather than orphaning the uploaded SBOM, and the appview renders an "SBOM only" state instead of a green Clean badge. The Grype database could wedge with no way back short of a restart. All three throttles in loadVulnDatabase were guarded by vulnDB != nil, so a scanner holding no provider retried a full download on every scan under the exclusive lock. Two earlier attempts at this bug each added one more condition to the same chain; this replaces the chain with a single decision function over a state snapshot, consulted by both call sites so they cannot disagree. That disagreement was itself a bug: the 50-scan reload had never once executed. Two independent halts. An unparseable frame was dropped in silence, stranding a row that held the hold's only dispatch slot forever; it is now answered "skipped" on first delivery. The 10-minute sweep leaked the in-flight digest and wrote no record, permanently retiring one image per timeout. A digest went unvalidated into filepath.Join and os.Create, so a layer digest of sha256:../../../x wrote outside the scan directory, and nothing verified that downloaded bytes hashed to the digest naming them. Digests come from records in a user's own PDS. Both are fixed together: verification is what makes an escaping write self-defeating. Concurrency did not work on either axis. The proactive capacity gate was depth-one hold-wide, so neither extra workers nor extra scanner processes received work. Depth is now the sum of the worker counts scanners advertise on connect, the gate is scoped to proactive work, and dispatch prefers the least-loaded scanner. Disconnects no longer hand a running scan to someone else: a scanner keeps a stable per-process identity and reclaims its own rows within a grace window, while a process that truly restarted returns with a new identity and has its work reclaimed, which is correct because the restart did lose it. The hold's scanning deadline measured queueing rather than scanning, because the scanner acks on receipt and handleAck never refreshed assigned_at. A new "started" message, sent by the worker that dequeues the job, separates the two budgets. An older scanner never sends it and falls under the queueing budget, which is more forgiving than the deadline it gets today. Adds an in-process mock hold and an e2e harness that runs the real client, queue and worker pool, seeded with 84 real manifest records fetched from a live PDS. Real image layouts and the Grype database are fetched by scripts and gitignored; suites needing them skip cleanly, so the default run stays offline and fast. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U1Km3N3uUmeGaj7VbaM8PF
64 lines
2.5 KiB
Go
64 lines
2.5 KiB
Go
package scanner
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// Digest is a content digest that has been validated, and is therefore safe to
|
|
// use both as a blob name on the wire and as a single path element on disk.
|
|
//
|
|
// The validation is deliberately narrow. A digest reaches the scanner from an
|
|
// io.atcr.manifest record in a user's own PDS, which the user can write
|
|
// directly, and the hold's dispatch guards check the hold DID, the layer count,
|
|
// the subject and the config but never the digest format. Downstream the string
|
|
// is joined onto the blobs directory and handed to os.Create, so anything that
|
|
// is not exactly an algorithm and a hex string is a filesystem primitive
|
|
// wearing a digest's clothes.
|
|
//
|
|
// Only sha256 is accepted. It is the only algorithm the OCI layout the scanner
|
|
// builds uses (blobs/sha256/<hex>) and the only one stereoscope can read, so
|
|
// anything else is unscannable however well formed it is; refusing it here
|
|
// turns a late, retried failure into an early, permanent one.
|
|
type Digest struct {
|
|
Algorithm string // always "sha256" today
|
|
Hex string // lowercase hex, exactly HexLen characters
|
|
}
|
|
|
|
// SHA256 is the only digest algorithm the scanner accepts.
|
|
const SHA256 = "sha256"
|
|
|
|
// HexLen is the number of hex characters in a sha256 digest.
|
|
const HexLen = 64
|
|
|
|
// String renders the digest back into its "algorithm:hex" form.
|
|
func (d Digest) String() string { return d.Algorithm + ":" + d.Hex }
|
|
|
|
// ParseDigest validates a digest string and returns its parts.
|
|
//
|
|
// It accepts exactly "sha256:" followed by 64 lowercase hex characters, and
|
|
// nothing else: no other algorithm, no uppercase, no other length, no leading
|
|
// or trailing anything. Because the result is constrained to [0-9a-f], the Hex
|
|
// field cannot contain a separator, a dot, or a NUL, and so cannot escape the
|
|
// directory it is joined onto.
|
|
func ParseDigest(digest string) (Digest, error) {
|
|
algorithm, hex, ok := strings.Cut(digest, ":")
|
|
if !ok {
|
|
return Digest{}, fmt.Errorf("digest %q has no algorithm prefix", digest)
|
|
}
|
|
if algorithm != SHA256 {
|
|
return Digest{}, fmt.Errorf("digest %q uses unsupported algorithm %q, want %s", digest, algorithm, SHA256)
|
|
}
|
|
if len(hex) != HexLen {
|
|
return Digest{}, fmt.Errorf("digest %q has %d hex characters, want %d", digest, len(hex), HexLen)
|
|
}
|
|
for i := 0; i < len(hex); i++ {
|
|
c := hex[i]
|
|
if (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') {
|
|
continue
|
|
}
|
|
return Digest{}, fmt.Errorf("digest %q is not lowercase hex", digest)
|
|
}
|
|
return Digest{Algorithm: algorithm, Hex: hex}, nil
|
|
}
|