mirror of
https://github.com/Twigpine/node.git
synced 2026-11-09 18:08:02 -10:00
beardthelion
ba44a018ec
The previous commit stopped the CLI carrying request signatures to a host the node redirected it to, and left the other signing client alone. That one is the git remote helper, which is what actually runs on clone, fetch and push, and it had no redirect policy at all. A push signs from its first request, so a node answering 302 handed out a working credential, and on a 307 or 308 the pack body went with it. The rule now lives in core and both clients use it, so the two cannot drift apart again. Three guards were not holding what they claimed. Bounding the retry wait by the remaining deadline could be deleted with every test still green, which the timing shows was four real seconds of overshoot past the bound the docs advertise; the assertion was loose enough to pass either way and is now tight enough to fail. The refusing-gateway warning was asserted through a test-only mirror rather than the write the user sees, so deleting the write kept the test green. And both no-hint exceptions, the definitive not-found and the wrapped scan, were only ever reached without a token in hand, which is the one state where they do nothing. A response whose body failed partway through the read still replayed the held token for every remaining attempt, spending the whole ladder on one position and then reporting that the object might lie further on. A body cut by the read cap was already terminal for that reason; a body cut by a broken connection is the same unreadable state and is terminal now too. A successful fetch no longer buffers the whole object before writing a byte of it, so a node cannot make the client hold an arbitrary amount of memory inside a time limit that was never a memory limit. The remaining silent skips in the recovery loops now say what went wrong, including the manifest fetch and the body reads, so a failure there is reported rather than looking like an absent blob. Also: the redirect chain bound is off by one against reqwest's own, has a test, and its comment no longer claims to prevent something the request timeout already prevents.
65 lines
1.9 KiB
TOML
65 lines
1.9 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/gitlawb-core",
|
|
"crates/gitlawb-node",
|
|
"crates/gl",
|
|
"crates/git-remote-gitlawb",
|
|
"crates/gitlawb-attest",
|
|
"crates/icaptcha-client",
|
|
]
|
|
|
|
[workspace.package]
|
|
# Per-crate versions live in each crate's [package] so release-please can manage
|
|
# them (it cannot rewrite an inherited `version.workspace = true`). They are kept
|
|
# in lockstep by release-please's generic updater: each crate's `version` line
|
|
# carries an `# x-release-please-version` annotation and is listed under
|
|
# `extra-files` in release-please-config.json. The release type is `simple`
|
|
# (not `rust`) because the rust strategy unconditionally tries to rewrite this
|
|
# virtual workspace root as a package manifest and errors out.
|
|
edition = "2021"
|
|
rust-version = "1.91"
|
|
license = "MIT OR Apache-2.0"
|
|
authors = ["gitlawb contributors"]
|
|
repository = "https://github.com/gitlawb/node"
|
|
|
|
[workspace.dependencies]
|
|
# async
|
|
tokio = { version = "1", features = ["full"] }
|
|
# serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_jcs = "0.2"
|
|
# errors
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
# crypto
|
|
ed25519-dalek = { version = "2", features = ["rand_core", "pkcs8", "pem"] }
|
|
rand = "0.8.6"
|
|
sha2 = "0.10"
|
|
# encoding
|
|
hex = "0.4.3"
|
|
base64 = "0.22"
|
|
multibase = "0.9"
|
|
multihash = { version = "0.19", features = ["std"] }
|
|
multihash-codetable = { version = "0.1", features = ["sha2"] }
|
|
cid = "0.11"
|
|
# logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
# time
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
# uuid
|
|
uuid = { version = "1", features = ["v4"] }
|
|
# http client
|
|
reqwest = { version = "0.12", features = ["blocking", "json", "multipart", "rustls-tls"], default-features = false }
|
|
# URL parsing (what reqwest::Url re-exports, so the shared redirect predicate can
|
|
# take a parsed URL without pulling reqwest into gitlawb-core)
|
|
url = "2"
|
|
# HMAC
|
|
hmac = "0.12"
|
|
|
|
[profile.release]
|
|
lto = "thin"
|
|
strip = "symbols"
|