88 lines
5.8 KiB
Markdown
88 lines
5.8 KiB
Markdown
# Forgejo PostgreSQL source verification and tracing context correction
|
|
|
|
This packet verifies the actual composed Forgejo 11.0.3 source on a disposable
|
|
PostgreSQL 16.14 instance. It retains the source correction, failed setup and
|
|
test attempts, controlled counterexamples, exact sandbox/command receipts and
|
|
complete rebuilt release evidence. Apps commit `308e83fc` integrates the new
|
|
40-path source patch and build lock. Independent owner review and operational
|
|
admission remain open.
|
|
|
|
The actual production engine initialization and registered model schemas run
|
|
under default, explicit-public and named schemas. OAuth configuration values use
|
|
the actual application type. All 37 PostgreSQL test/subtest results pass:
|
|
create/reconcile/inverse, exact raw restoration, unchanged source retention,
|
|
private drift refusal, local/external account-link refusal, unexpected trigger
|
|
rollback, raw SQL writer exclusion on all four protected tables, concurrent
|
|
preparation and private driver-error diagnostics. A PostgreSQL trigger places
|
|
private synthetic configuration in its driver error; the application's actual
|
|
slow/error/trace hooks and returned operation error suppress that configuration.
|
|
An unmarked query provides a positive diagnostic control.
|
|
|
|
The diagnostics test exposed a real hook-composition crash. XORM 1.3.9 passes
|
|
the same ContextHook to each BeforeProcess hook without feeding the previous
|
|
returned context into it. A hook after tracing could therefore discard the task
|
|
context and make tracing's AfterProcess panic. The correction publishes the
|
|
new task context into ContextHook as well as returning it. This preserves the
|
|
incoming private-query marker and ordinary context values. Actual SQLite query
|
|
success/failure and private/ordinary trace cases cover the corrected composition.
|
|
The six focused DB checks and all 94 selected composed package results pass
|
|
without skips. The test-only PostgreSQL tag adds no runtime route or authority.
|
|
|
|
Separate client processes prepare an intent, die immediately after the actual
|
|
source INSERT, reconcile the rolled-back prepared state, and confirm an apply.
|
|
The actual PostgreSQL server then restarts with the same synthetic volume.
|
|
Further fresh processes reconcile the committed apply, perform the inverse and
|
|
verify the reverted journal and source absence. This is transaction/recovery
|
|
mechanics evidence, not a real initiating principal, current inverse authority,
|
|
signed evidence/outbox or a deployed-database acceptance receipt.
|
|
|
|
Controlled source copies independently remove the PostgreSQL table lock and
|
|
the private-query marker. Both fail their intended tests in all three schema
|
|
profiles. Those expected counterexamples are separate from successful normal
|
|
runs; the canonical runtime source is not weakened. See
|
|
`controlled-counterexamples.json` and `source-equivalence.json`.
|
|
|
|
The first two container setup attempts failed because the image's initialization
|
|
script explicitly clears PGHOST and requires its default socket. The first
|
|
suite also exposed an incomplete user fixture; its replacement uses the actual
|
|
user model. The initial tracing regression had an incorrect AddHook API call.
|
|
The first combined run reused an already-consumed file-replacement fixture;
|
|
the final run provisions fresh read-only and writable-alias fixtures. All
|
|
original failures remain retained. None is counted as a source success.
|
|
|
|
The database has no TCP listener, published port or network. Only its exact
|
|
synthetic Unix socket is exposed to the network/PID-isolated test process.
|
|
The image is immutable and recorded; the workload is limited to one CPU and
|
|
512 MiB. Local trust authentication is solely a disposable fixture, not a
|
|
credential-custody proof. Exact labeled containers and volumes from all three
|
|
setup attempts were removed; cleanup receipts are retained.
|
|
|
|
For reproduction, use a new prepared workspace from the companion release
|
|
recipe, explicit public module/build caches, and unused attempt/workspace names.
|
|
`database_runtime.py start --attempt N` creates the owned database fixture.
|
|
`run_postgres.py build --source-workspace ... --module-cache ... --go-cache ...`
|
|
compiles the real test binary, and `suite` / `combined-regressions` execute the
|
|
normal checks. Supply the same `--runtime-attempt N` and test `--workspace`.
|
|
The recovery actions are `prepare`, `crash` (expected process exit 73),
|
|
`recover-prepared`, server `restart`, `recover-applied`, and `recover-inverse`.
|
|
The optional build controls are `omit-postgres-lock` and `omit-private-context`;
|
|
their suite failures must match the recorded target tests. Finish with exact
|
|
owned `database_runtime.py cleanup --attempt N`. Existing receipts and trial
|
|
directories refuse overwrite. The early fixed-path receipt replay is retained;
|
|
the final combined run exercises the explicit-workspace interface.
|
|
|
|
The new patch independently replays all 40 postimages from the pinned official
|
|
archive. The complete frontend/static release builds; all 2,234 embedded assets
|
|
are exact and all 48 actual CLI/SQLite subprocess checks pass on its binary.
|
|
Two fresh no-cache local OCI exports reproduce identical archive, manifest,
|
|
config and index. Base layers and rootless runtime settings remain exact.
|
|
This is one source build and two exports. No image is loaded, pushed or deployed.
|
|
Published asset digests have explicit `sha256:` types; their derivation restores
|
|
the runtime's original manifest byte for byte. Scanner rules are unchanged.
|
|
|
|
Existing T08/T34/T42 still require current authenticated operation/inverse
|
|
sessions, exclusion of every application/Helm/release writer, private journal
|
|
reader/backup custody, retention and native deployed-database acceptance. T07's
|
|
chart/private-mount admission and T09/T43's ongoing HTTP/API/Git/SSH authorization
|
|
remain open. All sixteen target gates and the full SEC-DSM ledger remain in
|
|
scope; no native gate is closed by these source checks.
|