fix(cli): repo announcement updates can emit timestamps outside the relay clock-skew window - #4067
Open
mdc2122 wants to merge 2 commits into
Open
fix(cli): repo announcement updates can emit timestamps outside the relay clock-skew window#4067mdc2122 wants to merge 2 commits into
mdc2122 wants to merge 2 commits into
Conversation
added 2 commits
August 1, 2026 01:07
…repo binding Channel binding (block#3626) is the git ACL: transport.rs::authorize_git_read resolves a repo's kind:30617, reads the first `buzz-channel` tag, and denies with a generic 404 unless the caller holds an active role in that channel. The existing tests cover the binding tag itself well. These three fill gaps in the surrounding invariants that a bind silently depends on. 1. bind_channel_leaves_exactly_one_d_tag The `d` tag is what makes 30617 parameterized-replaceable, and the read gate resolves by (community, owner, d). build_repo_announcement_with_tags retains-then-reinserts `d`, but every existing bind test starts from a single `d`, so the dedup is never exercised. Starting from a duplicated `d` (as a non-conforming client could publish) pins it. A surviving duplicate would either resolve ambiguously or supersede nothing — leaving the old unbound announcement live, which presents as "the bind did nothing" rather than as an error. 2. bind_channel_preserves_clone_and_relay_metadata `clone` and `relays` are how a client reaches the repo at all, and binding is exactly the operation that makes it reachable. The current bind tests assert carry-forward for name/buzz-protect/unknown tags but never these two. Dropping them mid-bind gives the worst failure shape available: the ACL opens while the announcement stops saying where to clone from, so the repo looks broken precisely when it starts working. Verified by mutation — the test fails if `clone` is added to the strip list. 3. create_accepts_every_uuid_form_the_relay_parses `repo_bound_channel_id` reads the tag with uuid::Uuid::parse_str, so any form that parses there is a valid binding. A stricter CLI-side check would reject bindings the relay would have honoured, surfacing far from the cause. Covers uppercase, braced, and simple forms — what a UUID pasted from another tool actually looks like. No production code changed. cargo fmt, clippy --all-targets, and cargo test -p buzz-cli repos (18 passed) are clean. Signed-off-by: Studio2 <studio2@Studio2s-Mac-Studio.local>
A stale announcement head made repos bind / protection updates emit
created_at = head+1, which the relay rejects as outside its clock-skew
window ("event timestamp too far from server time"). Stamp
max(head+1, now): still strictly supersedes the head, always lands
inside the skew window.
Signed-off-by: Studio2 <studio2@Studio2s-Mac-Studio.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
buzz repos bind/ protection updates stamp the superseding kind:30617 withcreated_at = observed head + 1. When the existing announcement is more than the relay's clock-skew window old (common for repos announced once and updated later), the relay rejects the update:so any bind/protection change on an older repo announcement fails unconditionally.
Fix
Stamp
max(head + 1, now): still strictly supersedes the observed head (preserving the leapfrog protection the +1 was there for), while always landing inside the relay's skew window.Also adds regression tests for repo-binding update semantics: exactly-one-
d-tag replaceability,clone/relaystag carry-forward, and UUID-form parity with the relay's reader.Testing
cargo test -p buzz-cli: 274 passed. fmt + clippy clean. Verified live against a self-hosted relay: bind of a 2-day-old announcement failed with the skew error before, succeeds after.🤖 Generated with Claude Code