thumbor / remotecv / 39881632534

94%

push

github

Quote SQS credentials in broker URL and bound Celery task time (#122)

CeleryTasks built the broker URL by interpolating the AWS key id and secret
verbatim, so a secret containing '/' (AWS secrets often do) produced a URL
that kombu could not parse, and when no credentials were given the URL
became "sqs://None:None@" instead of letting boto fall back to the
environment or the instance role. Tasks were also registered with
acks_late and no time limit, so a job stuck in the image fetch held its
worker slot indefinitely.

The URL now goes through kombu's safequote and is plain "sqs://" when neither
credential is given; setting only one of them raises instead of silently
running under whatever boto's credential chain finds. When --timeout is set it
is applied as the Celery task time limit in addition to the SQS visibility
timeout, so a hung task is killed around the time its message would become
visible again rather than running on next to a redelivery. A negative --timeout
is refused at startup, since it would become the time limit of every task.
Without --timeout behaviour is unchanged apart from the URL fixes.

10 of 10 new or added lines in 1 file covered. (100.0%)

627 of 668 relevant lines covered (93.86%)

4.69 hits per line