rero / rero-mef / 34333900795
87%

DEFAULT BRANCH: staging
Ran
Jobs 1
Files 201
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 87.302%. Remained the same
34333900795

push

github

rerowep 
fix(certificates): generate instead of versioning

One private key was versioned in this public repository, exposed
since the initial commit: the TLS key of the development server, and
its copy in the HAProxy bundle. Both certificates had expired in
2019, which left the HTTPS development server unusable by any modern
browser. The key stays in the history and has to be considered
compromised; it only ever protected a local development server.

* `scripts/gen-certs` produces the development pair in `.certs/`,
  using mkcert when available so that browsers accept it without
  warning, and falling back to openssl elsewhere. The bootstrap calls
  it, never regenerates an existing pair unless `--force-certs` is
  given, and skips the step on deploy.
* The nginx and HAProxy images generate their own at build time.
  HAProxy needs a separate stage, its base image ships no openssl;
  that stage borrows the nginx image the stack already pulls.
* `scripts/server` verifies the pair, and registers its cleanup trap,
  before starting anything. Both used to come after the celery worker,
  so a missing pair left an orphaned worker behind. The check is
  skipped with `--non_secure`, which needs no certificate.
* That cleanup now accounts for the whole process tree. `invenio run`
  forks the reloader child that holds the port and celery forks its
  pool workers, and those were orphaned on every exit. The tree is
  collected before the first signal, since killing a parent orphans
  its children, but SIGTERM still goes to the two parents alone so
  that celery shuts its pool down in order and releases its
  semaphores; whatever they leave behind is killed after a five second
  grace, because a warm shutdown waits for a running task. Job control
  would signal a tree in one call, but it moves the script out of the
  terminal's foreground process group and Ctrl-C then never reaches
  it.
* The development server listens on 5002. The default was 5000, which
  is rero-ils', ... (continued)

5466 of 6261 relevant lines covered (87.3%)

0.87 hits per line

Jobs
ID Job ID Ran Files Coverage
1 34333900795.1 201
87.3
 GitHub Action Run
Source Files on build 34333900795