funman300
c9ae914910
Second consumer of openfut-tls, and the reason it was extracted first.
This host contains no roster content and no cipher choice: the adapter
owns the 67 bytes and the observed TLS profile, openfut-tls owns the
acceptor, and this crate owns accept/read/drain/write/close.
Lifecycle was MEASURED, not inherited. The obvious mistake here would
have been copying the redirector's 300ms dwell because the other host has
one. A probe against the oracle says otherwise:
dwell after responding 0 ms (redirector: 300 ms)
request body drained POST answered only once it arrives
close clean FIN, never RST
keep-alive none one request per connection
The probe ran against a REPLICA of roster_server.py loaded from its own
source, not against :8081 -- http.server.HTTPServer is single-threaded
and FIFA was mid-session, so holding a connection open to measure the
close would have stalled the game's poll and could have surfaced as the
squad-update error. The replica was then confirmed byte-identical to the
live oracle under masking, the 1-byte delta being the container's Python
version in the Server header.
Differential against the live oracle, every field identical, with the
Server header compared UNMASKED:
GET 230B HEAD 163B POST 163B
drained=True reset=False answered_before_body=False
keepalive: second request accepted by the socket, never answered
Testing follows the redirector's hard-won rule: where a property is
visible both to the client and inside the host, it is asserted inside the
host via ConnOutcome. A client-side check cannot tell "drained" from "not
drained" -- it reads the buffered response either way -- and that exact
mistake let a mutation survive once already.
9 parity tests, 6 unit tests, 5/5 mutations killed, including "answer
before draining", "hold the connection open like the redirector" and
"inherit the redirector's 300ms default".
drain_body is duplicated from the redirector deliberately. Unifying it
means editing the redirector, and the roster A/B must change exactly one
thing. Extraction is scheduled for after the roster gate closes.
Not deployed and not switched: Python still serves :8081.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
40 lines
1.5 KiB
Rust
40 lines
1.5 KiB
Rust
//! Stamp the commit this binary was built from.
|
|
//!
|
|
//! Deliberately records ONLY the commit — no dirty-tree flag. Cargo will not
|
|
//! re-run a build script because another crate's source changed, so a
|
|
//! compiled-in "clean" claim can be stale and is therefore not a safeguard.
|
|
//! (Verified on the Blaze host: editing the adapter and rebuilding left its
|
|
//! flag reading clean.)
|
|
//!
|
|
//! The authoritative checks run at launch, in `scripts/verify-build-identity.sh`,
|
|
//! which compares this stamp against the checkout's real HEAD and inspects the
|
|
//! working tree as it is at that moment.
|
|
|
|
use std::process::Command;
|
|
|
|
fn git(args: &[&str]) -> Option<String> {
|
|
let out = Command::new("git").args(args).output().ok()?;
|
|
out.status
|
|
.success()
|
|
.then(|| String::from_utf8_lossy(&out.stdout).trim().to_string())
|
|
}
|
|
|
|
fn main() {
|
|
let commit = git(&["rev-parse", "--short=7", "HEAD"]).unwrap_or_else(|| "unknown".into());
|
|
println!("cargo:rustc-env=OPENFUT_BUILD_COMMIT={commit}");
|
|
|
|
// Committing updates refs/heads/<branch>, not the HEAD file, so watching
|
|
// HEAD alone leaves the stamp a commit behind.
|
|
for p in ["../.git/HEAD", "../.git/index"] {
|
|
if std::path::Path::new(p).exists() {
|
|
println!("cargo:rerun-if-changed={p}");
|
|
}
|
|
}
|
|
if let Some(rf) = git(&["symbolic-ref", "-q", "HEAD"]) {
|
|
let path = format!("../.git/{rf}");
|
|
if std::path::Path::new(&path).exists() {
|
|
println!("cargo:rerun-if-changed={path}");
|
|
}
|
|
}
|
|
}
|