v0.24.7
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
5e23e9af02
commit
3883a21bc4
56 files changed
+1640
-403
No files matched your search
+31
-14
@@ -16,7 +16,7 @@ def read_cache_source() -> str:
|
||||
|
||||
preflight(root)
|
||||
manifest = tomllib.loads((root / "Cargo.toml").read_text())
|
||||
assert manifest["package"]["version"] == "0.24.5"
|
||||
assert manifest["package"]["version"] == "0.24.7"
|
||||
assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
|
||||
h3dep = manifest["dependencies"]["h3"]
|
||||
assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
|
||||
@@ -24,14 +24,14 @@ assert "h3-quinn" not in manifest["dependencies"]
|
||||
lock_path = root / "Cargo.lock"
|
||||
if lock_path.exists():
|
||||
lock = lock_path.read_text()
|
||||
assert 'name = "rust-proxy"\nversion = "0.24.5"' in lock
|
||||
assert 'name = "rust-proxy"\nversion = "0.24.7"' in lock
|
||||
assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
|
||||
for release_doc, marker in {
|
||||
"README.md": "# RustProxy 0.24.5",
|
||||
"CHANGELOG.md": "## 0.24.5",
|
||||
"ROADMAP.md": "## 0.24.5",
|
||||
"AGENTS.md": "Current source version: 0.24.5.",
|
||||
"docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.5",
|
||||
"README.md": "# RustProxy 0.24.7",
|
||||
"CHANGELOG.md": "## 0.24.7",
|
||||
"ROADMAP.md": "## 0.24.7",
|
||||
"AGENTS.md": "Current source version: 0.24.7.",
|
||||
"docs/TEST_REPORT.md": "# Verification report - RustProxy 0.24.7",
|
||||
}.items():
|
||||
assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
|
||||
assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
|
||||
@@ -53,7 +53,7 @@ for marker in [
|
||||
assert marker in update_check_source, marker
|
||||
assert 'update version document is too large or incomplete: {error}' in update_check_source
|
||||
assert '.context("update version document is too large or incomplete")' not in update_check_source
|
||||
for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
|
||||
for name in ["README.md", "ROADMAP.md", "AGENTS.md", "CHANGELOG.md", "UPDATE_CHECK.toml", "Dockerfile", ".dockerignore", "docs/TEST_REPORT.md", "docs/V0.24.7_AUDIT.md", "docs/V0.24.6_AUDIT.md", "docs/V0.24.5_AUDIT.md", "docs/V0.24.1_AUDIT.md", "docs/V0.24.0_AUDIT.md", "docs/V0.23.2_AUDIT.md", "docs/V0.23.1_AUDIT.md", "docs/V0.22.3_AUDIT.md", "docs/LIVE_LOGS.md", "docs/README.md", "docs/API.md", "docs/ARCHITECTURE.md", "docs/VHOSTS.md", "docs/STREAMS.md", "docs/REDIRECTS.md", "docs/CONTAINER.md", "docs/NPM_MIGRATION.md", "docs/DOCKER_DISCOVERY.md", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/docker-agent.env.example", "docker-agent/install.sh", "src/docker.rs", "src/admin/web/docker.js", "scripts/migrate_npm.py", "docs/CUSTOM_LOCATIONS.md", "nagios/README.md", "nagios/check_rustproxy.py", "nagios/check_rustproxy_api", "nagios/check_rustproxy_backends", "nagios/check_rustproxy_latency", "nagios/check_rustproxy_queues", "src/admin/web/error_401.html", "src/admin/web/error_404.html", "src/admin/web/streams.js", "src/admin/web/redirects.js", "src/admin/web/host404.js", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "debian/build-package.sh", "debian/build-repository.sh", "grafana/rustproxy-overview.json", "grafana/README.md"]:
|
||||
assert (root / name).is_file(), name
|
||||
for path in (root / "examples").glob("*.json"):
|
||||
data = json.loads(path.read_text())
|
||||
@@ -120,7 +120,7 @@ assert '/assets/docker.js' in html and 'cache-live-toggle' in html
|
||||
assert 'expose-revision' not in html and 'hideRevision' not in js and 'diagRevision' not in js
|
||||
for path in ['src/settings.rs', 'src/admin/mod.rs', 'src/cache/mod.rs', 'src/headers.rs', 'src/tinyauth.rs', 'src/admin/web/vhosts.js']:
|
||||
assert 'x-rust-proxy-revision' not in (root / path).read_text().lower(), f'legacy revision-header logic remains in {path}'
|
||||
assert './dev.sh admin reset-password' not in html and 'rust-proxy admin reset-password locally' in html
|
||||
assert './dev.sh admin reset-password' not in html and re.search(r'rust-proxy\s+admin reset-password locally', html)
|
||||
assert 'data-panel="redirects"' in html and 'id="panel-redirects"' in html
|
||||
assert 'data-panel="configuration"' not in html and 'id="panel-configuration"' not in html
|
||||
assert 'id="settings-tab-manual-config"' in html and 'id="settings-page-manual-config"' in html
|
||||
@@ -200,7 +200,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
|
||||
assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
|
||||
assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
|
||||
assert '"StreamMetrics"' in openapi and '"streams"' in openapi
|
||||
for marker in ['"version": "0.24.5"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
|
||||
for marker in ['"version": "0.24.7"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
|
||||
assert marker in openapi, marker
|
||||
for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
|
||||
assert marker in openapi, marker
|
||||
@@ -225,6 +225,10 @@ assert 'impl Cache {\n include!(' not in cache_mod, "include! cannot be used
|
||||
for fragment in ["lifecycle.rs", "cold.rs", "dashboard.rs", "tickets.rs", "lookup.rs"]:
|
||||
assert (root / "src/cache" / fragment).read_text().lstrip().startswith("impl Cache {"), fragment
|
||||
assert 'disabled_cache_strips_diagnostics_without_exposing_bypass_headers' in cache_source
|
||||
for marker in ['pub enum MemoryPreset', 'pub enum ColdPreset', 'BACKGROUND_REVALIDATION_LIMIT', 'cleanup_slots']:
|
||||
assert marker in cache_source, marker
|
||||
for marker in ['selectedCacheMemoryPreset', 'selectedCacheColdPreset', 'applyRecommendedColdCachePreset', 'data-cache-cold-preset="recommended"']:
|
||||
assert marker in js or marker in html, marker
|
||||
assert 'if !self.enabled' in cache_source
|
||||
proxy_source = (root / "src/proxy/mod.rs").read_text()
|
||||
assert 'response.extensions().get::<LocalHostResponse>().is_none()' in proxy_source
|
||||
@@ -283,6 +287,11 @@ for marker in [
|
||||
"fn decode<'a>",
|
||||
'Cow::Borrowed(body)',
|
||||
'trim_allocator_after_large_transform',
|
||||
'pub memory_budget_bytes: usize',
|
||||
'pub max_inflight: usize',
|
||||
'Preset::Uber',
|
||||
'try_reserve_transform_memory(required_memory, settings.memory_budget_bytes)',
|
||||
'try_reserve_transform_slot(settings.max_inflight)',
|
||||
'drop(decoded);',
|
||||
'drop(raw);',
|
||||
'rustproxy-',
|
||||
@@ -295,12 +304,14 @@ for name in ['js.rs', 'css.rs']:
|
||||
assert 'Vec<char>' not in minifier_source and '.chars().collect' not in minifier_source, name
|
||||
assert 'into_bytes()' in minifier_source, name
|
||||
assert 'pub mod transform;' in (root / 'src/lib.rs').read_text()
|
||||
for marker in ['cache-cold-gc-interval', 'cache-cold-gc-max-delete', 'settings-tab-transform', 'transform-form', 'cache-cleanup-dialog']:
|
||||
for marker in ['cache-cold-gc-interval', 'cache-cold-gc-max-delete', 'settings-tab-transform', 'transform-form', 'transform-memory-budget', 'transform-max-inflight', 'data-transform-preset="uber"', 'cache-cleanup-dialog']:
|
||||
assert marker in html, marker
|
||||
for marker in ['cache-transient-memory', 'cache-cold-queue-bytes', 'cache-eviction-limit', 'data-cache-memory-preset="recommended"', 'cache-memory-warning']:
|
||||
assert marker in html, marker
|
||||
for marker in ['effectiveCacheMemory', 'cacheMemoryHeadroom', 'cachePresetValues', 'applyCacheMemoryPreset', 'cacheMemoryPresetTooSmall', 'cacheObjectOverTransientWarning', 'cgroup_memory_max_bytes', 'transient_max_bytes', 'cold_queue_max_bytes', 'hot_eviction_max_objects']:
|
||||
assert marker in js, marker
|
||||
for marker in ['selectedTransformPreset', 'transformPresetValues', 'applyTransformPreset', 'updateTransformResourceSizing', 'memory_budget_bytes', 'max_inflight']:
|
||||
assert marker in js, marker
|
||||
assert 'envelope?.config.cache?.enabled === true && cacheToggle.value !== "off"' in vhosts_js
|
||||
for marker in ['transform: { enabled: false }', 'vhTransform', 'collectTransform']:
|
||||
assert marker in vhosts_js, marker
|
||||
@@ -569,7 +580,7 @@ assert 'if docker_targets.contains_key(id)' in prometheus_source
|
||||
assert 'rust_proxy_docker_vhost_exchange_duration_seconds' in prometheus_source
|
||||
settings_source = (root / 'src/admin/web/settings.js').read_text()
|
||||
assert 'prom-trusted-no-token' in settings_source and 'include_docker_vhosts' in settings_source and 'include_streams' in settings_source and 'include_logging' in settings_source
|
||||
for marker in ['cache-memory-breakdown', 'cache-transient-breakdown', 'process-rss-total', 'process-rss-anon', 'process-rss-file', 'process-data-swap', 'memoryAccountingHint']:
|
||||
for marker in ['cache-memory-breakdown', 'cache-transient-breakdown', 'cache-cold-storage', 'process-rss-total', 'memory-cache-hot', 'memory-cache-transient', 'memory-transform', 'memory-transform-inflight', 'memory-non-cache-rss', 'process-rss-anon', 'process-rss-file', 'process-data-swap', 'memoryAccountingHint']:
|
||||
assert marker in html, marker
|
||||
for marker in ['validate_h3', 'H3Tunnel', 'h3_client_to_backend', 'backend_to_h3', 'rfc9220_bootstrap_uses_extended_connect_without_h1_proof_headers']:
|
||||
assert marker in ws_source, marker
|
||||
@@ -682,7 +693,13 @@ assert '.docker-passive-health-editor .docker-health-grid {' in style_source
|
||||
assert '.docker-health-grid input:not([type="checkbox"])' in style_source and '.docker-passive-health-editor .docker-checkbox-field input[type="checkbox"]' in style_source
|
||||
assert 'id="sparkline-transform"' in html and 'id="rate-transform"' in html and 'liveTransformed' in html
|
||||
assert 'payload["transform_metrics"] = json!(state.transform_metrics.total())' in admin_source
|
||||
for marker in ['payload["transform_resources"]', 'payload["memory_accounting"]', 'non_cache_rss_includes_transform']:
|
||||
assert marker in admin_source, marker
|
||||
assert 'const transformed = s.transform_metrics || {}' in app_js and 'transformSamples.push(rates.transform)' in app_js
|
||||
for marker in ['status.memory_accounting || {}', 'memory.cache_hot_bytes', 'memory.transform_reserved_bytes', 'cache-cold-storage']:
|
||||
assert marker in app_js, marker
|
||||
for marker in ['data?.resources || {}', 'tp-memory', 'tp-inflight']:
|
||||
assert marker in transform_panel_js, marker
|
||||
assert 'function uptime(value)' in app_js and 'setOptionalMetric("process-uptime", status.uptime_seconds != null' in app_js
|
||||
assert 'connection-uptime-footer' not in html and 'id="process-uptime"' in html
|
||||
assert 'id="panel-transform"' in html and 'data-panel="transform"' in html and '/assets/transform-panel.js' in html
|
||||
@@ -1056,7 +1073,7 @@ assert 'id="process-platform"' in html and 'd.platform' in app_js
|
||||
assert 'id="panel-logging"' not in html
|
||||
assert 'id="settings-tab-logging"' in html and 'id="settings-page-logging"' in html and 'id="logging-form"' in html
|
||||
assert 'location.pathname === "/logging"' in settings_js_0241
|
||||
assert '"RuntimeInformation"' in openapi and '"version": "0.24.5"' in openapi
|
||||
assert '"RuntimeInformation"' in openapi and '"version": "0.24.7"' in openapi
|
||||
|
||||
# 0.24.1 compiler and hostname-cardinality regressions.
|
||||
tls_0241 = (root / "src/tls.rs").read_text()
|
||||
@@ -1101,5 +1118,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
|
||||
node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
|
||||
assert "maxItems" not in node, schema_name
|
||||
|
||||
print("PASS: 0.24.5 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v6 migrations.")
|
||||
print("PASS: 0.24.7 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v6 migrations.")
|
||||
print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")
|
||||
+1
-1
@@ -97,7 +97,7 @@ def digest(path: Path) -> str:
|
||||
def fetch_https(url: str, max_bytes: int) -> bytes:
|
||||
if urllib.parse.urlparse(url).scheme != 'https':
|
||||
raise ValueError('GeoIP downloads require HTTPS.')
|
||||
request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.5'})
|
||||
request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.24.7'})
|
||||
with urllib.request.urlopen(request, timeout=30) as response:
|
||||
if urllib.parse.urlparse(response.geturl()).scheme != 'https':
|
||||
raise ValueError('GeoIP download redirected away from HTTPS.')
|
||||
|
||||
Executable
+142
@@ -0,0 +1,142 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Static regression checks for bounded-memory/background-worker contracts.
|
||||
|
||||
This is intentionally Rust-toolchain independent. It does not replace runtime RSS/
|
||||
heap profiling; it prevents the source-level bounds audited for this release from
|
||||
silently disappearing before compiler-enabled acceptance runs.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
|
||||
|
||||
def read(path: str) -> str:
|
||||
return (ROOT / path).read_text(encoding="utf-8")
|
||||
|
||||
|
||||
def require(path: str, *markers: str) -> None:
|
||||
text = read(path)
|
||||
for marker in markers:
|
||||
assert marker in text, f"{path}: missing memory contract: {marker}"
|
||||
|
||||
|
||||
def forbid(path: str, *markers: str) -> None:
|
||||
text = read(path)
|
||||
for marker in markers:
|
||||
assert marker not in text, f"{path}: forbidden memory pattern returned: {marker}"
|
||||
|
||||
|
||||
# Transform path: hard aggregate/decode/concurrency budgets and no JSON DOM tree.
|
||||
require(
|
||||
"src/transform/mod.rs",
|
||||
"DEFAULT_MEMORY_BUDGET_BYTES: usize = 128 * 1024 * 1024",
|
||||
"pub memory_budget_bytes: usize",
|
||||
"pub max_inflight: usize",
|
||||
"try_reserve_transform_memory(required_memory, settings.memory_budget_bytes)",
|
||||
"try_reserve_transform_slot(settings.max_inflight)",
|
||||
"TRANSFORM_MEMORY_IN_USE_BYTES: AtomicUsize",
|
||||
"TRANSFORM_INFLIGHT: AtomicUsize",
|
||||
"pub struct ResourceUsage",
|
||||
"pub fn resource_usage(settings: &Settings)",
|
||||
"memory_reserved_bytes: TRANSFORM_MEMORY_IN_USE_BYTES.load",
|
||||
"Limited::new(body, settings.max_body_bytes)",
|
||||
".try_reserve_exact(read)",
|
||||
'"memory_pressure"',
|
||||
'"concurrency_pressure"',
|
||||
"aggregation_is_bounded_even_when_content_length_is_false",
|
||||
"transform_memory_reservation_obeys_runtime_budget",
|
||||
"transform_inflight_reservation_obeys_runtime_limit",
|
||||
)
|
||||
require("src/transform/json.rs", "IgnoredAny::deserialize", "Vec::with_capacity(body.len())")
|
||||
forbid("src/transform/json.rs", "use serde_json::Value", "from_slice::<Value>")
|
||||
require("src/transform/css.rs", "let mut last_char: Option<char> = None")
|
||||
require("src/transform/html.rs", "enum RawElement", "fn raw_tag(tag: &str)")
|
||||
|
||||
# Cache background work: all previously high-retention paths have hard bounds.
|
||||
require(
|
||||
"src/cache/model.rs",
|
||||
"COLD_DELETE_FALLBACKS: usize = 2",
|
||||
"COLD_CLEANUP_SLOTS: usize = 1",
|
||||
"BACKGROUND_REVALIDATION_LIMIT: usize = 8",
|
||||
"pub cold_limit_bytes: u64",
|
||||
"pub cold_limit_entries: usize",
|
||||
)
|
||||
require(
|
||||
"src/admin/mod.rs",
|
||||
'payload["transform_resources"]',
|
||||
'payload["memory_accounting"]',
|
||||
'"non_cache_rss_includes_transform": true',
|
||||
)
|
||||
require(
|
||||
"src/cache/cold.rs",
|
||||
"BinaryHeap::with_capacity(requested_limit.saturating_add(1))",
|
||||
"self.cold_delete_fallbacks.clone().try_acquire_owned()",
|
||||
"self.cleanup_slots.clone().try_acquire_owned()",
|
||||
"std::mem::take(&mut delete)",
|
||||
)
|
||||
require(
|
||||
"src/cache/tickets.rs",
|
||||
"active.len() >= BACKGROUND_REVALIDATION_LIMIT",
|
||||
)
|
||||
require(
|
||||
"src/cache/collapse.rs",
|
||||
".saturating_mul(64)",
|
||||
".clamp(64, 256)",
|
||||
"settings.proactive_refresh_max_inflight as u64",
|
||||
)
|
||||
require(
|
||||
"src/cache/lifecycle.rs",
|
||||
"mpsc::channel(COLD_QUEUE)",
|
||||
"cold_delete_fallbacks: Arc::new(Semaphore::new(COLD_DELETE_FALLBACKS))",
|
||||
"cleanup_slots: Arc::new(Semaphore::new(COLD_CLEANUP_SLOTS))",
|
||||
)
|
||||
|
||||
# Other long-lived/background facilities: queue/task/worker cardinality is bounded
|
||||
# or owned by a cancellation-aware supervisor/TaskTracker.
|
||||
require(
|
||||
"src/logging.rs",
|
||||
"HISTORY_CAPACITY: usize = 4096",
|
||||
"LIVE_STREAM_CAPACITY: usize = 4096",
|
||||
"mpsc::channel(SINK_QUEUE)",
|
||||
"self.sink.try_send(entry)",
|
||||
)
|
||||
require(
|
||||
"src/diagnostics.rs",
|
||||
"tokio::task::spawn_blocking(move || system_stats::sample(previous)).await",
|
||||
"stop.cancelled()",
|
||||
)
|
||||
require(
|
||||
"src/upstream.rs",
|
||||
"Semaphore::new(16)",
|
||||
".try_acquire_owned()",
|
||||
"tokio::time::timeout(DNS_TIMEOUT, lookup)",
|
||||
)
|
||||
require(
|
||||
"src/balance.rs",
|
||||
"if checks.len() >= 16 { break; }",
|
||||
"checks.abort_all()",
|
||||
)
|
||||
require(
|
||||
"src/stream.rs",
|
||||
"Semaphore::new(host.max_connections)",
|
||||
"mpsc::channel(64)",
|
||||
"JoinSet::new()",
|
||||
)
|
||||
require(
|
||||
"src/server.rs",
|
||||
"Semaphore::new(max_connections)",
|
||||
"let mut tasks = JoinSet::new()",
|
||||
)
|
||||
require(
|
||||
"src/runtime.rs",
|
||||
"tokio_util::task::TaskTracker::new()",
|
||||
"update_slots: Arc::new(Semaphore::new(8))",
|
||||
"inflight: Arc::new(Semaphore::new(max_inflight))",
|
||||
)
|
||||
require("src/acme.rs", "slot: Arc::new(Semaphore::new(1))", ".try_acquire_owned()")
|
||||
require("src/docker.rs", "shutdown.cancelled()", "Duration::from_secs(5)")
|
||||
require("src/update_check.rs", "shutdown.cancelled()", "tokio::time::sleep(interval)")
|
||||
|
||||
print("PASS: bounded-memory transform/cache contracts and background-worker limits are present.")
|
||||
@@ -33,10 +33,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
|
||||
raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
|
||||
for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/upstream.rs", "src/tls.rs", "src/proxy/websocket.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/management.js", "src/pages.rs", "scripts/mock_server.py", "scripts/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "scripts/acme_provider.py", "src/basic_auth.rs", "scripts/deploy.py", "scripts/migrate_npm.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "debian/control", "debian/rules", "debian/rustproxy.service", "debian/rustproxy.logrotate", "grafana/rustproxy-overview.json"]:
|
||||
if not (root / path).is_file():
|
||||
raise ValueError(f"Incomplete RustProxy 0.24.5 source tree: missing {path}")
|
||||
raise ValueError(f"Incomplete RustProxy 0.24.7 source tree: missing {path}")
|
||||
text = (root / "src/lib.rs").read_text(encoding="utf-8")
|
||||
if '#[path = "auth/mod.rs"]' not in text:
|
||||
raise ValueError("src/lib.rs is not the 0.24.5 entry point; extract the complete package, not individual files.")
|
||||
raise ValueError("src/lib.rs is not the 0.24.7 entry point; extract the complete package, not individual files.")
|
||||
return messages
|
||||
|
||||
|
||||
|
||||
@@ -113,13 +113,13 @@ def upgrade_smoke(tmp: Path) -> None:
|
||||
assert backup.is_dir()
|
||||
assert (backup / "src/obsolete.rs").is_file()
|
||||
assert not (target / "src/obsolete.rs").exists()
|
||||
assert 'version = "0.24.5"' in (target / "Cargo.toml").read_text(encoding="utf-8")
|
||||
assert 'version = "0.24.7"' in (target / "Cargo.toml").read_text(encoding="utf-8")
|
||||
assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
|
||||
assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
|
||||
assert (target / "langs/site.json").is_file()
|
||||
assert (target / "docker-agent/main.go").is_file()
|
||||
manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
|
||||
assert manifest["to_version"] == "0.24.5"
|
||||
assert manifest["to_version"] == "0.24.7"
|
||||
assert manifest["removed_obsolete_runtime_state"] is True
|
||||
assert not legacy.exists()
|
||||
assert not (backup / "legacy-data").exists()
|
||||
@@ -307,7 +307,7 @@ def ui_contract_smoke() -> None:
|
||||
assert 'data-panel="configuration"' not in html and 'id="panel-configuration"' not in html
|
||||
assert html.index('data-panel="vhosts"') < html.index('data-panel="redirects"') < html.index('data-panel="notfound"') < html.index('data-panel="streams"') < html.index('data-panel="acl-profiles"')
|
||||
assert "matching_resident_bytes" in cache and "matching_body_bytes" in cache
|
||||
for marker in ["cache-memory-breakdown", "cache-transient-breakdown", "process-rss-total", "process-rss-anon", "process-rss-file", "process-data-swap", "memoryAccountingHint"]:
|
||||
for marker in ["cache-memory-breakdown", "cache-transient-breakdown", "cache-cold-storage", "process-rss-total", "memory-cache-hot", "memory-cache-transient", "memory-transform", "memory-transform-inflight", "memory-non-cache-rss", "process-rss-anon", "process-rss-file", "process-data-swap", "memoryAccountingHint"]:
|
||||
assert marker in html, marker
|
||||
for marker in ["transient_bytes", "fill_bytes_active", "cold_queue_bytes", "cold_write_bytes_active", "cold_read_bytes_active", "process_rss_anon_bytes", "process_rss_file_bytes"]:
|
||||
assert marker in app or marker in cache, marker
|
||||
@@ -495,7 +495,7 @@ def source_contract_smoke() -> None:
|
||||
assert marker in admin, marker
|
||||
anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
|
||||
assert '"/api/status"' not in anonymous_block
|
||||
assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.5"' in openapi_0241
|
||||
assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.24.7"' in openapi_0241
|
||||
assert 'id="panel-logging"' not in html
|
||||
for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"']:
|
||||
assert marker in html, marker
|
||||
@@ -612,6 +612,10 @@ def source_contract_smoke() -> None:
|
||||
assert 'id="sparkline-transform"' in html and 'id="rate-transform"' in html
|
||||
assert 'id="panel-transform"' in html and 'data-panel="transform"' in html and '/assets/transform-panel.js' in html
|
||||
assert '/api/transform' in transform_panel and 'tp-cache-hits' in transform_panel
|
||||
for marker in ['transform-memory-budget', 'transform-max-inflight', 'data-transform-preset="conservative"', 'data-transform-preset="recommended"', 'data-transform-preset="performance"', 'data-transform-preset="uber"']:
|
||||
assert marker in html, marker
|
||||
for marker in ['selectedTransformPreset', 'transformPresetValues', 'applyTransformPreset', 'updateTransformResourceSizing', 'memory_budget_bytes', 'max_inflight']:
|
||||
assert marker in app_js, marker
|
||||
assert '<details class="card function-live-chart" id="cache-live-chart">' in html
|
||||
assert '<details class="card function-live-chart" id="transform-live-chart">' in html
|
||||
for marker in ['cache-live-hit-line', 'cache-live-miss-line', 'cache-live-bypass-line']:
|
||||
@@ -645,14 +649,20 @@ def source_contract_smoke() -> None:
|
||||
for fragment in ['lifecycle.rs', 'cold.rs', 'dashboard.rs', 'tickets.rs', 'lookup.rs']:
|
||||
assert (ROOT / 'src/cache' / fragment).read_text(encoding='utf-8').lstrip().startswith('impl Cache {')
|
||||
assert 'payload["transform_metrics"] = json!(state.transform_metrics.total())' in admin_rs
|
||||
for marker in ['payload["transform_resources"]', 'payload["memory_accounting"]', 'non_cache_rss_includes_transform', 'cold_limit_bytes', 'cold_limit_entries']:
|
||||
assert marker in admin_rs or marker in cache, marker
|
||||
assert 'const transformed = s.transform_metrics || {}' in app_js and 'transformSamples.push(rates.transform)' in app_js
|
||||
for marker in ['status.memory_accounting || {}', 'memory.cache_hot_bytes', 'memory.transform_reserved_bytes', 'cache-cold-storage']:
|
||||
assert marker in app_js, marker
|
||||
for marker in ['data?.resources || {}', 'tp-memory', 'tp-inflight']:
|
||||
assert marker in transform_panel, marker
|
||||
assert 'function uptime(value)' in app_js and 'setOptionalMetric("process-uptime", status.uptime_seconds != null' in app_js
|
||||
assert 'connection-uptime-footer' not in html and 'id="process-uptime"' in html
|
||||
assert 'function rateBytes(value)' in app_js and 'if (value === 0) return "0.0 KiB";' in app_js and 'return "<0.1 KiB";' in app_js
|
||||
assert 'function backendTrafficRate(' in vhosts_js and 'member.bytes_in' in vhosts_js and 'member.bytes_out' in vhosts_js and 'rateBytes(memberTraffic)' in vhosts_js and 'rateBytes(d.traffic)' in vhosts_js
|
||||
assert 'id="cache-domain-filter"' in html and 'cacheDomainFilterEnabled' in html and 'cacheDomainFilterDisabled' in html
|
||||
assert 'const visibleDomains = (data, groups) =>' in cache_panel_js and 'scoped?.settings?.enabled ?? data.settings?.enabled ?? false' in cache_panel_js
|
||||
for marker in ['effectiveCacheMemory', 'cacheMemoryHeadroom', 'cachePresetValues', 'applyCacheMemoryPreset', 'cacheMemoryPresetTooSmall', 'cacheObjectOverTransientWarning', 'cgroup_memory_max_bytes', 'transient_max_bytes', 'cold_queue_max_bytes', 'hot_eviction_max_objects']:
|
||||
for marker in ['effectiveCacheMemory', 'cacheMemoryHeadroom', 'cachePresetValues', 'applyCacheMemoryPreset', 'selectedCacheMemoryPreset', 'selectedCacheColdPreset', 'applyRecommendedColdCachePreset', 'cacheMemoryPresetTooSmall', 'cacheObjectOverTransientWarning', 'cgroup_memory_max_bytes', 'transient_max_bytes', 'cold_queue_max_bytes', 'hot_eviction_max_objects']:
|
||||
assert marker in app_js, marker
|
||||
assert 'envelope?.config.cache?.enabled === true && cacheToggle.value !== "off"' in vhosts_js
|
||||
assert 'groups = d.domains || [], shownGroups = visibleDomains(data, groups)' in cache_panel_js and 'replaceChildren(...shownGroups.map(row =>' in cache_panel_js
|
||||
@@ -750,7 +760,11 @@ def source_contract_smoke() -> None:
|
||||
"pub struct Settings", "pub struct Overrides",
|
||||
"resolved.enabled = global.enabled && self.enabled",
|
||||
"pub fn no_transform", "OriginValidators", "fn decode<'a>",
|
||||
"Cow::Borrowed(body)", "trim_allocator_after_large_transform", "drop(decoded);", "drop(raw);",
|
||||
"Cow::Borrowed(body)", "trim_allocator_after_large_transform",
|
||||
"pub memory_budget_bytes: usize", "pub max_inflight: usize", "Preset::Uber",
|
||||
"try_reserve_transform_memory(required_memory, settings.memory_budget_bytes)",
|
||||
"try_reserve_transform_slot(settings.max_inflight)",
|
||||
"drop(decoded);", "drop(raw);",
|
||||
"rustproxy-",
|
||||
"unchanged_compressed_body_is_canonicalized_to_identity",
|
||||
"origin_no_transform_blocks_body_changes_and_keeps_validator",
|
||||
@@ -912,7 +926,7 @@ def source_contract_smoke() -> None:
|
||||
assert "removed_obsolete_runtime_state" in upgrade_source and "legacy-data" not in upgrade_source and "certs_dir.is_symlink()" in upgrade_source
|
||||
assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
|
||||
openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
|
||||
for marker in ['"version": "0.24.5"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
|
||||
for marker in ['"version": "0.24.7"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
|
||||
assert marker in openapi, marker
|
||||
assert '"software_update"' in openapi and '"update_available"' in openapi
|
||||
for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
|
||||
@@ -1060,7 +1074,7 @@ def main() -> None:
|
||||
source_contract_smoke()
|
||||
container_contract_smoke()
|
||||
debian_grafana_contract_smoke()
|
||||
print("PASS: 0.24.5 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
|
||||
print("PASS: 0.24.7 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, Debian packaging, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
@@ -76,10 +76,10 @@ ENV_FILE=scripts/routeros-oci-build/.env \
|
||||
bash scripts/routeros-oci-build/build-routeros-oci.sh push
|
||||
```
|
||||
|
||||
With RustProxy version `0.24.5` and the defaults this publishes:
|
||||
With RustProxy version `0.24.7` and the defaults this publishes:
|
||||
|
||||
```text
|
||||
zot.example.net/network/rustproxy:0.24.5
|
||||
zot.example.net/network/rustproxy:0.24.7
|
||||
zot.example.net/network/rustproxy:latest
|
||||
zot.example.net/network/rustproxy:routeros
|
||||
```
|
||||
|
||||
@@ -85,7 +85,7 @@ def download(destination: Path) -> None:
|
||||
"""TLS verification uses Python's default trust store; never executes a shell."""
|
||||
started = time.monotonic()
|
||||
opener = build_opener(HttpsRedirects())
|
||||
request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.5"})
|
||||
request = Request(DOWNLOAD_URL, headers={"User-Agent": "RustProxy-build/0.24.7"})
|
||||
with opener.open(request, timeout=30) as response, destination.open("wb") as output:
|
||||
length = response.headers.get("Content-Length")
|
||||
if length and int(length) > MAX_ARCHIVE:
|
||||
|
||||
+3
-3
@@ -46,7 +46,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
|
||||
for name in MANAGED:
|
||||
if (target / name).is_symlink():
|
||||
raise ValueError(f"Managed target {name} is a symlink; refusing to replace it.")
|
||||
backup = target / ".upgrade-backup" / ("before-0.24.5-" + uuid.uuid4().hex[:12])
|
||||
backup = target / ".upgrade-backup" / ("before-0.24.7-" + uuid.uuid4().hex[:12])
|
||||
backup.mkdir(parents=True, mode=0o700)
|
||||
installed: list[str] = []
|
||||
moved: list[str] = []
|
||||
@@ -84,7 +84,7 @@ def upgrade(source: Path, target: Path, *, stopped: bool, data_dir: Path | None
|
||||
remove_legacy = legacy.exists()
|
||||
if remove_legacy and (legacy.is_symlink() or not legacy.is_file()):
|
||||
raise ValueError("Obsolete renewal observation sidecar must be a regular file.")
|
||||
(backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.5", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
|
||||
(backup / "upgrade.json").write_text(json.dumps({"from_directory":str(target), "to_version":"0.24.7", "managed_paths":MANAGED, "removed_obsolete_runtime_state": remove_legacy}, indent=2)+"\n", encoding="utf-8")
|
||||
if remove_legacy:
|
||||
legacy.unlink()
|
||||
except BaseException:
|
||||
@@ -115,7 +115,7 @@ def main() -> None:
|
||||
backup = upgrade(Path(__file__).resolve().parents[1], args.target, stopped=args.stopped, data_dir=data_dir)
|
||||
except (OSError, ValueError) as error:
|
||||
parser.exit(2, f"Upgrade refused or rolled back: {error}\n")
|
||||
print(f"Installed RustProxy 0.24.5. Previous managed source files: {backup}")
|
||||
print(f"Installed RustProxy 0.24.7. Previous managed source files: {backup}")
|
||||
print("Preserved data, .env, .git, target and other unmanaged files. No database migration was run.")
|
||||
print(f"Next: cd {args.target}; ./dev.sh test; ./dev.sh")
|
||||
|
||||
|
||||
Reference in new issue
Block a user