golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(#1462): fail closed without data loss on a corrupt capability ledger; atomic ledger write (#1469)

Browse Source
This commit is contained in:
Tom Boucher
2026-06-19 19:55:10 -04:00
committed by GitHub
parent 7195c2a90b
commit c866ac1b24
9 changed files with 6039 additions and 240 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/fix-1462-ledger-corruption.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Fixed
pr: 1469
---
**Capability ledger: fail closed on corruption, with durable atomic writes and a race-safe install lock.** A corrupt or unreadable `.gsd-capabilities.json` is now left in place and surfaced (not silently overwritten) — `install`/`update`/`remove`/`list`/`reconcile` fail closed and report it, so a corrupt ledger can no longer wipe prior capabilities' tracked files and shared-config fragments (which previously left unremovable orphans in `settings.json`/`hooks.json`). Ledger writes are atomic and crash-durable (exclusive temp file + `fsync` of file and directory + rename, with temp cleanup on failure). The per-capability lock is race-safe: a holder is identified by `(pid, process start-time, hostname)`, so a reused PID cannot deadlock recovery and a verifiably-live holder is never stolen, with a hard deadman timeout for unverifiable or cross-host holders. Untrusted ledger and lock reads are bounded (regular-file + size caps; FIFOs/devices rejected) and validated through a single shared entry validator (prototype-safe ids, DoS length caps). (#1462, ADR-1244.)