ecluse
Safe HaskellNone
LanguageGHC2021

Ecluse.Proxy.CveSync

Description

The advisory-sync plan: one ecosystem's sync wiring (CveSyncHandle), the config-driven plan that builds it (planCveSync), and the projections the composition root reads off the plan (the per-ecosystem rule capabilities, the first-sync readiness gate, and the sync schedule). Ecluse.Proxy's runProxy builds the plan at boot and runs one supervised sync task per handle.

Synopsis

Documentation

data CveSyncHandle Source #

One configured ecosystem's advisory-sync wiring.

Constructors

CveSyncHandle 

Fields

  • csSlot :: CveSlot

    The slot this ecosystem's mount rules borrow through.

  • csReady :: TVar Bool

    The one-way first-sync readiness flag.

  • csEnv :: SyncEnv

    The sync task's environment.

planCveSync :: LogEnv -> AmbientAws -> AppConfig -> IO (Map Ecosystem CveSyncHandle) Source #

Build the advisory-sync plan from config: nothing without a configured vulnerability-database bucket; otherwise one CveSyncHandle per configured mount ecosystem, each against its own stable per-ecosystem object key and canonical on-disk path under the OSV data dir. Prepares the data dir (created if missing; stray .tmp downloads from an interrupted run swept) so the sync tasks start clean. Note the readiness consequence: an operator who mounts an ecosystem Pilot does not compile has declared an artifact that never arrives, and the pod honestly never reports ready.

sweepStaleTemps :: LogEnv -> FilePath -> IO () Source #

Sweep stray in-progress downloads an interrupted run left beside the canonical artifacts (relevant to in-pod container restarts, where an emptyDir survives). Best-effort: a filesystem fault (a read-only or mispermissioned data dir) is logged at WarningS against the affected path and the boot proceeds on a fresh-start assumption, since a truly unusable dir surfaces again when the sync task downloads.

sweepStep :: LogEnv -> FilePath -> IO () -> IO () Source #

Run one best-effort step of the stale-temp sweep: an IOError (a read-only or mispermissioned data dir) is logged at WarningS against the affected path and swallowed so the boot proceeds, while any non-IO exception propagates rather than being hidden.

cveRuleDepsFor :: Map Ecosystem CveSyncHandle -> BreakerReporter -> FaultReporter -> Ecosystem -> RuleDeps Source #

The rules' boot-bound capabilities for one mount ecosystem: the CVE lookup borrows through that ecosystem's own slot when the sync plan carries one, and abstains otherwise, so a mount's rules can never read a neighbouring ecosystem's advisory database.

katipFaultReporter :: LogEnv -> FaultReporter Source #

A FaultReporter that logs an exhausted effectful-rule evaluation's fault detail to a katip WarningS line (the rule and fault fields), so a live advisory-database query fault is diagnosable rather than collapsing to a bare Unavailable. The rendered detail is bounded (the driver's SQLError text or a timeout); it carries no secret (a Secret redacts under show) and never reaches the client response.

cveSyncReady :: Map Ecosystem CveSyncHandle -> IO Bool Source #

The readiness gate over the sync plan: ready once every configured ecosystem's advisory database has first-synced. The flags flip one way, so readiness never flaps on this; an empty plan (no bucket) is vacuously ready.

cveSyncScheduleFor :: AppConfig -> SyncSchedule Source #

The sync tasks' timing: the shipped boot burst over the configured poll interval. The microsecond conversion cannot wrap: the config decoder bounds the interval to [1, maxBound div 1_000_000] seconds.