mirror of
https://github.com/hanzoai/gocache.git
synced 2026-10-30 18:36:04 +00:00
zeekayandHanzo Dev
cb2a64ea86
The local tier had no ceiling. The go command trims its own cache, and a program that replaces it inherits that job, so entries now record their time of last use and a scan removes what has gone unused for five days, on the go command's own intervals and margins. Both files of a hit are marked, from times Get already reads, so a scan cannot take the bytes out from under a live record. Abandoned temporaries are swept the same way. The local tier is also refused if it is the go command's own cache directory. Two layouts and two retention policies in one directory is a way to damage the build cache a machine is already using, and a build cache that can do that is worse than none. Shared objects now carry a MAC over the format version, the action ID, the output ID, the size and the body. The digest check alone was never an integrity boundary: whoever writes an object chooses both the body and the digest, so a self-consistent forgery was trivial, and an authentic object could be copied onto another action's key and would verify. The S3 gateway this runs against has one identity with Admin on every bucket, held by most of the platform, so bucket write access is much weaker than "is a build machine". The format version is gocache2 and the seal key is a third secret from the same KMS path, required with the other two. Nothing is written to the build's stderr unless GOCACHE_VERBOSE is set. The reason the shared tier is off is reported with the statistics rather than on every build for a week. DiskPath is now absolute, as the protocol requires. Tests cover forgery, substitution, corruption, truncation and malformed headers; marking, scanning and the cache-directory refusal; and a hung shared tier bounded in wall time, in CPU and in the number of times it is consulted. The harness gives every build its own GOCACHE and a real file for output: a pipe reaches EOF only when every writer closes it, so a buffer would have made each test wait for the uploads and timed them as part of the build. Co-authored-by: Hanzo Dev <[email protected]>
109 lines
2.9 KiB
Go
109 lines
2.9 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// Credentials for the shared tier come from Hanzo KMS. Two endpoints, the same
|
|
// pair a CI job uses: exchange a machine identity for a bearer token, then read
|
|
// the secret. Nothing is written to disk and nothing is cached between runs.
|
|
//
|
|
// POST {kms}/v1/kms/auth/login {"clientId","clientSecret"} -> {"accessToken"}
|
|
// GET {kms}/v1/kms/orgs/{org}/secrets/{path}/{key}?env={env} -> {"secret":{"value"}}
|
|
|
|
type kms struct {
|
|
addr string
|
|
org string
|
|
env string
|
|
id string
|
|
secret string
|
|
http *http.Client
|
|
}
|
|
|
|
func (k kms) token(ctx context.Context) (string, error) {
|
|
body, _ := json.Marshal(map[string]string{"clientId": k.id, "clientSecret": k.secret})
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, k.addr+"/v1/kms/auth/login", bytes.NewReader(body))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
res, err := k.http.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer res.Body.Close()
|
|
if res.StatusCode != http.StatusOK {
|
|
return "", fmt.Errorf("kms login: %s", res.Status)
|
|
}
|
|
var out struct {
|
|
AccessToken string `json:"accessToken"`
|
|
}
|
|
if err := json.NewDecoder(io.LimitReader(res.Body, 1<<20)).Decode(&out); err != nil {
|
|
return "", err
|
|
}
|
|
if out.AccessToken == "" {
|
|
return "", fmt.Errorf("kms login: no token")
|
|
}
|
|
return out.AccessToken, nil
|
|
}
|
|
|
|
func (k kms) get(ctx context.Context, token, path, key string) (string, error) {
|
|
url := fmt.Sprintf("%s/v1/kms/orgs/%s/secrets/%s/%s?env=%s",
|
|
k.addr, k.org, strings.Trim(path, "/"), key, k.env)
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
|
|
res, err := k.http.Do(req)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer res.Body.Close()
|
|
if res.StatusCode != http.StatusOK {
|
|
return "", fmt.Errorf("kms get %s/%s: %s", path, key, res.Status)
|
|
}
|
|
var out struct {
|
|
Secret struct {
|
|
Value string `json:"value"`
|
|
} `json:"secret"`
|
|
Value string `json:"value"`
|
|
}
|
|
if err := json.NewDecoder(io.LimitReader(res.Body, 1<<20)).Decode(&out); err != nil {
|
|
return "", err
|
|
}
|
|
if out.Secret.Value != "" {
|
|
return out.Secret.Value, nil
|
|
}
|
|
if out.Value == "" {
|
|
return "", fmt.Errorf("kms get %s/%s: empty", path, key)
|
|
}
|
|
return out.Value, nil
|
|
}
|
|
|
|
// read fetches several keys from one secret path in a single authenticated
|
|
// session, in order. All of them or none: the shared tier needs every one of
|
|
// its secrets, so a path missing any of them is a path that leaves the cache
|
|
// off rather than half configured.
|
|
func (k kms) read(ctx context.Context, path string, keys ...string) ([]string, error) {
|
|
tok, err := k.token(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out := make([]string, len(keys))
|
|
for i, key := range keys {
|
|
if out[i], err = k.get(ctx, tok, path, key); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|