sbp opened a new issue, #1367:
URL: https://github.com/apache/tooling-trusted-releases/issues/1367
| Attribute | Details |
|---|---|
| **Severity** | High |
| **Verdict** | CONFIRMED |
| **Category** | data-integrity |
| **File** | `storage/writers/announce.py:249-334` |
| **Source** | chunk-51 |
**Description**
Inside release(), aioshutil.move(unfinished_dir, finished_dir) and
delete_immutable_directory(unfinished_revisions_path) execute and complete in
the first try block (lines 249-273). The DB promotion (__promote_in_database)
runs afterwards in a separate try block and performs a compare-and-swap that
raises RuntimeError('A newer revision appeared') when rowcount != 1. If that
CAS fails (or any later DB error occurs), the files have already been moved
into the finished hierarchy and all prior revision directories have already
been deleted, but the release is never promoted in the database and the
transaction is rolled back. The result is an unrecoverable inconsistency:
on-disk state says 'released', DB still says preview, and the source revisions
are gone. The code only surfaces this as a 500 'Manual cleanup needed' message.
**Evidence**
`await aioshutil.move(unfinished_dir, finished_dir); await
util.delete_immutable_directory(unfinished_revisions_path, ...) at lines
253/268 precede __promote_in_database (line 315) which raises RuntimeError on
rowcount != 1 (line 543-544).`
**Verification — CONFIRMED**
- **Trigger:** During an announce, a concurrent revision is added to the
preview release (or its phase changes) between the initial load at line 131 and
the CAS at line 539, so rowcount==0 and __promote_in_database raises
RuntimeError('A newer revision appeared') — but aioshutil.move (line 253) and
delete_immutable_directory of all prior revisions (line 268) have already
completed irreversibly. Equivalently, any DB error in the second try block
(e.g. __write_artifact_rows or commit failing) triggers the same split state.
- **Reasoning:** The filesystem move and irreversible prior-revision
deletion run in the first try block (249-273) and complete before the DB
CAS/promotion in the separate second try block (285-334); the developers' own
'A newer revision appeared' guard confirms the CAS can fail post-move, and the
rolled-back transaction then leaves disk='released'/DB='preview' with source
revision directories gone, surfaced only as a 500 'Manual cleanup needed'.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
