Repository navigation
fix(flow): create the durable authority database owner-only before SQLite opens it - #1363
Merged
Merged
Conversation
…Lite opens it SQLite created a missing authority database with the process umask, and _connect tightened it to 0600 only after the schema was set up. A second durable run starting at the same moment (two --workers, or two processes on a fresh machine) saw a world-readable file and refused with "the external durable authority database permissions are too broad", which stopped the pool. The file is now created 0600 with O_EXCL (and O_NOFOLLOW) first. The permission check is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
Two durable runs that start at the same moment in a fresh environment (for example
--workers 2 --durableon a new machine, or two processes) race on first creation of the external durable authority database:sqlite3.connectcreates it with the process umask (0644), and_connecttightens it to 0600 only after setting up the schema.DurableAuthorityBusy: the external durable authority database permissions are too broad.In a worklist pool that error stops every worker. I found it while building the compatibility matrix for the API-step stack (#1355 and the PRs stacked on it): two workers, each item a Regulated durable run, failed on the first item.
Fix
When the database doesn't exist, create it owner-only (
O_CREAT | O_EXCL | O_NOFOLLOW, mode 0600) before SQLite opens it. A run that loses theO_EXCLrace just opens the file the other run created, which is already 0600. The permission check itself is unchanged.Tests
tests/test_durable_authority_create.py(new): one test checks that a fresh database is owner-only at the moment SQLite opens it; the other starts four durable runs together behind a barrier and checks that all four start. Both fail onmain; the concurrent one reproduces the "too broad" refusal.Locally: 99 passed across the durable authority and durable runtime suites.
ruffpasses.🤖 Generated with Claude Code