Inherit Forge queue response ownership

Inherit Forge queue response ownership

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified lib/openagents/forge/build_protocol.ex
modified lib/openagents/forge/build_worker.ex
modified test/openagents/forge/build_worker_test.exs

Diff

3 files changed, +17 -1

  @spec atomic_write(Path.t(), iodata(), keyword()) :: :ok | {:error, term()}
  def atomic_write(path, contents, opts \\ []) do
    mode = Keyword.get(opts, :mode, 0o600)
    inherit_parent_owner? = Keyword.get(opts, :inherit_parent_owner, false)
    tmp = path <> ".tmp-" <> Base.url_encode64(:crypto.strong_rand_bytes(12), padding: false)
    lock = path <> ".publish-lock"

    with :ok <- File.mkdir_p(Path.dirname(path)),
         :ok <- File.write(tmp, contents, [:binary]),
         :ok <- File.chmod(tmp, mode),
         :ok <- maybe_inherit_parent_owner(tmp, path, inherit_parent_owner?),
         {:ok, lock_io} <- File.open(lock, [:write, :exclusive]) do
      try do
        if File.exists?(path),

    |> tap(fn _result -> File.rm(tmp) end)
  end

  defp maybe_inherit_parent_owner(_tmp, _path, false), do: :ok

  defp maybe_inherit_parent_owner(tmp, path, true) do
    with {:ok, %{uid: uid, gid: gid}} <- File.stat(Path.dirname(path)) do
      with :ok <- File.chown(tmp, uid), do: File.chgrp(tmp, gid)
    end
  end

  @doc "Canonical JSON used by signed/digested protocol documents."
  @spec canonical_json(term()) :: binary()
  def canonical_json(term) do

      BuildProtocol.atomic_write(
        Path.join([queue, "responses", response["build_id"] <> ".json"]),
        encoded,
        mode: 0o640
        mode: 0o640,
        inherit_parent_owner: true
      )
    end
  end

    assert {:ok, response} = response_path |> File.read!() |> BuildProtocol.decode_response()
    assert response["status"] == "ok"
    assert response["build_id"] == build_id
    assert {:ok, response_stat} = File.stat(response_path)
    assert {:ok, response_dir_stat} = File.stat(Path.dirname(response_path))
    assert Bitwise.band(response_stat.mode, 0o777) == 0o640
    assert response_stat.uid == response_dir_stat.uid
    assert response_stat.gid == response_dir_stat.gid

    artifact_path = Path.join(artifacts, response["artifact_ref"])


149	149		`@spec atomic_write(Path.t(), iodata(), keyword()) :: :ok \| {:error, term()}`
150	150		`def atomic_write(path, contents, opts \\ []) do`
151	151		`mode = Keyword.get(opts, :mode, 0o600)`
	152	+	`inherit_parent_owner? = Keyword.get(opts, :inherit_parent_owner, false)`
152	153		`tmp = path <> ".tmp-" <> Base.url_encode64(:crypto.strong_rand_bytes(12), padding: false)`
153	154		`lock = path <> ".publish-lock"`
154	155
155	156		`with :ok <- File.mkdir_p(Path.dirname(path)),`
156	157		`:ok <- File.write(tmp, contents, [:binary]),`
157	158		`:ok <- File.chmod(tmp, mode),`
	159	+	`:ok <- maybe_inherit_parent_owner(tmp, path, inherit_parent_owner?),`
158	160		`{:ok, lock_io} <- File.open(lock, [:write, :exclusive]) do`
159	161		`try do`
160	162		`if File.exists?(path),`

172	174		`\|> tap(fn _result -> File.rm(tmp) end)`
173	175		`end`
174	176
	177	+	`defp maybe_inherit_parent_owner(_tmp, _path, false), do: :ok`
	178	+
	179	+	`defp maybe_inherit_parent_owner(tmp, path, true) do`
	180	+	`with {:ok, %{uid: uid, gid: gid}} <- File.stat(Path.dirname(path)) do`
	181	+	`with :ok <- File.chown(tmp, uid), do: File.chgrp(tmp, gid)`
	182	+	`end`
	183	+	`end`
	184	+
175	185		`@doc "Canonical JSON used by signed/digested protocol documents."`
176	186		`@spec canonical_json(term()) :: binary()`
177	187		`def canonical_json(term) do`

491	491		`BuildProtocol.atomic_write(`
492	492		`Path.join([queue, "responses", response["build_id"] <> ".json"]),`
493	493		`encoded,`
494		-	`mode: 0o640`
	494	+	`mode: 0o640,`
	495	+	`inherit_parent_owner: true`
495	496		`)`
496	497		`end`
497	498		`end`

48	48		`assert {:ok, response} = response_path \|> File.read!() \|> BuildProtocol.decode_response()`
49	49		`assert response["status"] == "ok"`
50	50		`assert response["build_id"] == build_id`
	51	+	`assert {:ok, response_stat} = File.stat(response_path)`
	52	+	`assert {:ok, response_dir_stat} = File.stat(Path.dirname(response_path))`
	53	+	`assert Bitwise.band(response_stat.mode, 0o777) == 0o640`
	54	+	`assert response_stat.uid == response_dir_stat.uid`
	55	+	`assert response_stat.gid == response_dir_stat.gid`
51	56
52	57		`artifact_path = Path.join(artifacts, response["artifact_ref"])`
53	58