+ jHjޚa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI t ]P!] 4tRHtRRRRRR]P 23t]!0RIm4t]!0RJm4t]!0RKm4t^t!RR ]4tR tR R R R/tR]R&RR /RRlltRRltRLRRlltRRltRRlt RRlt!RRlt"Rt#R R!lt$R"R#lt%R$R%lt&R&R /R'R(llt'R&R /R)R*llt(R+R,lt)^t*R-R.lt+]!R/04t,R0t-R1R2lt.R3R4lt/R5R6lt0R7R8lt1R9t2^Wt3R:]2 R;]3 R<2t4R=R>lt5R?R@lt6RAt7]PpR&RBRCR/RDREll4t9RFRGlt:R#)Mu Checkout custody for the updater's children (R2): the ONE spawn policy for every git (and the Node build) an update starts. The checkout kernel lock (``update_lock``) must stay held while any process of the update tree can still write the checkout, and must NOT leak into processes that outlive the update: * Every updater git call carries ``-c gc.autoDetach=false -c maintenance.auto=false``: git never forks a detached gc/maintenance child that would inherit (POSIX) or outlive (Windows) the lock. * POSIX: the lock fd is inherited ONLY by git commands that mutate the worktree, index or refs locally (:data:`LOCAL_MUTATORS`, run with ``core.fsmonitor=false`` so no fsmonitor daemon starts under them, with no credential helper and no repository hooks). Network/credential commands (fetch, ls-remote, credential) and readers run without it: a ``git credential-cache--daemon`` they start never holds the checkout. A partial clone's mutator would lazily fetch the objects a move needs as a child holding the fd (and start the daemon under it), so before a move the objects are fetched without the fd and with the user's helpers (:func:`_prefetch_for_move`); a lazy fetch the prefetch missed still runs, just without a helper. A killed fetch that leaves ``*.lock`` ref files is recovered by the stale-lock rules (``gitlock.clear_stale_git_locks``). * Windows has no fd inheritance: while this process holds (or joined) the checkout lock, every child started here is created SUSPENDED, assigned to the update's kill-on-close job and only then resumed, so it and everything it spawns die with the lock owner. The Node build goes through ``pm.progress.run_contained`` (whose Popen it never sees): :func:`contained_command` wraps it in a stdlib launcher that joins the job before it starts node and, once node exits, terminates and waits out everything node left running (C3): a normal release never frees the checkout under a build descendant. * Windows fails CLOSED (D2): a child the job refuses is never run. The msvcrt byte lock belongs to the process that took it — an inherited handle does not keep it, the kernel unlocks it when the owner exits — so nothing else could fence a writer outside the job: after the owner's death the lock would be free while it still wrote. A refused bind kills the still-suspended child; a refused launcher join exits before it starts node; either raises :class:`CustodyRefused`, a clear refusal of that step instead of an unfenced writer. Every updater git runner (``update_cmd._git_run``, ``update_cmd_git._git_run``, ``update_cmd_stash``, ``update_cmd_check``, ``gitlock``, ``update_cmd_commit``, ``_early_recovery``'s restore) calls :func:`run_git`. Not covered, on purpose: the read-only release/check readers (``source_releases``, ``source_check``: ``ls-remote``, ``cherry``, ``rev-parse``) run their own probes; they never get the lock fd and write nothing, so they cannot leak or outlive custody of the checkout. ) annotationsN)Sequence-czcore.fsmonitor=falsezcredential.helper=zcore.hooksPath=c2a]tRt^TtRtRV3RlltRtV;t#)CustodyRefusedzWindows would not put an update child in the update's kill-on-close job, so the child was never run (D2): outside the job it could outlive a killed update and write the checkout after the checkout lock is free.c$V^8dQhRRRRRR/#)argv Sequence[str]causeobjectreturnNone)formats">/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_custody.py __annotate__CustodyRefused.__annotate__Ys&RR]R6RdRc <^RIpV'd,VPP\V^,44MRpRV RV R2Vn\ SV`VP R\PRR7 24R#) NchildzWindows would not put `z ` in this update's process job (z), so it was not run: a checkout writer outside the job could outlive a killed update and write the checkout after its lock is released. z the commandcommand) ospathbasenamestrreasonsuper__init___RETRYr)selfr r rname __class__s&&& rr!CustodyRefused.__init__Ysp15rwwDG -7%dV+KE7S3 3  DKK=&-- -*N)OPQr)r)__name__ __module__ __qualname____firstlineno____doc__r!__static_attributes__ __classcell__)r%s@rrrTs"RRrrzoRun {command} again from a regular terminal, outside any sandbox or tool that confines the processes it starts.ranFrefuseddict_RUN receiptedc(V^8dQhRRRRRRRR/#) rr r r r r2boolr rr)rs"rrros(-d~rc&\V\\34'd \V4MV.p\W4pVP RRP RVR,44 2pV'gR\ PRV4\P!\4;_uu_4^RI H pV!RRV4R R R 4\R ,f3T\R ,'*;'d\4'*3\R &V# +'giLS;i) zThe :class:`CustodyRefused` for ``argv``: logged, noted in the receipt (unless the caller already did) and kept as this run's first refusal.: rc38"TFp\V4xK R#5iNr.0args& r _refuse..ts&D8Cs3xx8NrNzRefused update child: %s record_stepupdate_custodyFNr/r.) isinstancelisttuplerrjoinloggerwarning contextlibsuppress Exceptionhermes_cli.update_receiptrBr1 _past_commit)r r r2excdetailrBs&&$ r_refuserQos$D4-884:tfD  %C |2chh&D48&DDE FF 16:   + + = (% 8, IDK F F 4FGY J , +s $D D cV^8dQhRR/#)rr r4r)rs"rrrs s sd src`^RIHpVP4pTRJ;'d{\;QJd?RTP PR4;'gR4F 'gK R# R#!RTP PR4;'gR44# \dR#i;i)zThe update reached its commit point: its receipt records the ``apply`` stage (the completion child resumes that receipt). No receipt is open before an update begins, nor in the parent after its completion child returned, which starts no update child.)_currentTNc3H"TFqPR4R8HxK R#5i)r$applyN)get)r;stages& rr=_past_commit..s&rQqyy'8G'CQqs "stagesFr)rMrTrWrLanydata)rTcurrents rrNrNs6,,. $  r r33&rQXQ]Q]QaQabjQkQqQqoqQq&r33r3r3&rQXQ]Q]QaQabjQkQqQqoqQq&r#rr sB B-,B-c V^8dQhRRRR/#)rrrr str | Noner)rs"rrrsllCljlrc \R,fR#\R,wrV'dRMRpRV RVP RV R\PRV R2R 7 2#) zWhat the command's failure path prints when this run refused an update child (m2), in place of whatever generic error the refusal turned into downstream; ``None`` otherwise.r/Nz0Nothing was changed: no update step had run yet.z'Update steps before it had already run.u✗ `z ` stopped: z `r)r1rr"r)rrO unchangedoutcomes& rrefusal_noticerdsf I)_NCENA8 7);szzl$witFMM\]^e]ffgZhMDiCj kkrc V^8dQhRRRR/#)rargsr r r_r)rs"rrrs:rc\V4pVF7pV\9d\VR4KVPR4'dK5Vu# R#)zZThe subcommand in ``args`` (everything after the git executable), skipping global options.N-)iter_GLOBAL_WITH_VALUEnext startswith)rfitr<s& rgit_subcommandrns@ dB $ $ TN$$J  rc V^8dQhRRRR/#)rrfr r r4r)rs"rrrs22=2T2rc&\V4\9#r8)rnLOCAL_MUTATORS)rfs&ris_local_mutatorrrs $ > 11rc$V^8dQhRRRRRR/#)rgit_cmdr rfr list[str]r)rs"rrrs!%%m%=%Y%rc\V4\V4r\\VR,V,4'd\MR,p.VOVOVO#)zJ``git_cmd + args`` with the custody config inserted before the subcommand.NNr)rE GIT_NO_DETACHrr_MUTATOR_CONFIG)rtrfextras&& rgit_argvr|sGM4:T 0@tAS0T0T_Z\ ]E $W $u $t $$rcV^8dQhRR/#)rr z dict | Noner)rs"rrrs{rcL^RIHpVP# \dR#i;i)r update_lockN) hermes_clirrL_HELDrs r_heldrs,*    s  ##caaa\PPR4'gR#^RIp^RIoVP RRR7P oSP!4oVVV3RlpV#)aLinux: a ``preexec_fn`` making the child die (SIGKILL) with the updater thread that waits on it. For the git children that do NOT hold the lock fd (fetch, ls-remote, readers): a killed owner must not leave a fetch rewriting refs under the next lock owner. The ruling's stale-lock rules recover a fetch killed mid-write. ``None`` elsewhere (Windows: the job; macOS has no parent-death signal: :func:`run_git` puts a fetch under :func:`_owner_watch`).linuxNT) use_errnoct<S!^^ ^^^4SP!4S8wdSP!^4R#R#)rxN)getppid_exit)rparentprctlsr_arm#_death_signal_preexec.._arms1 aAq! ::<6 ! HHSM "r)sysplatformrlctypesrCDLLrgetpid)rrrrrs @@@r_death_signal_preexecrsR << " "7 + + KKK - 3 3E YY[F Krc$V^8dQhRRRRRR/#)r inherit_lockr4kwargsr0r r)rs"rrrs!$rc \V4pV'd9\\P.VP RR4OVO544VR&V#V'g&\ 4eRV9d\ 4pVeW1R&V#)pass_fds preexec_fnr) _lock_fdsrFr0fromkeysrWrr)rrfdsarms&& r_custody_kwargsrsr L !C "4==1T6::j"3M1TPS1T#UVz M eg1l&6P#% ?#&< Mrc V^8dQhRRRR/#)rrr4r ztuple[int, ...]r)rs"rrrs==D=_=rcV'd\PR8XdR#^RIHp\ V!4P RR44#)win32)custody_spawn_kwargsrr)rrhermes_cli.update_lockrrFrW)rrs& rrrs4 3<<72 ; %'++J; <:G")0& CJ   IIK    s6F?E 1F? F<5'F F<)F<<F?? G c$V^8dQhRRRRRR/#)rr r labelrr rr)rs"rrr"s"MSGWrc \PR8Xd \4f+\P!\ V43/\ RV4B#^RIHpH pVPR^4\,VR&\P!\ V43/VBpV!V4pVeURV RV R2p\R V 2RR 7\P!\4;_uu_4^R IHpV!R R V4RRR4V!V4V# +'giL;i \$d#TP'4TP)4hi;i)a``subprocess.Popen`` for a checkout writer that runs after the update committed (the historical takeover's ``update_finish``). POSIX: the lock fd. Windows inside an update: created suspended and bound to the update's kill-on-close job before it runs. A refused bind must not fail a committed update, so the child still runs, never silently (printed and receipted) and never unfenced: it joins the checkout lock holding its own lease (R5b).rNT)bind_child_to_update_treerrz$the update's job would not take the  (z=), so it runs outside the job, holding its own checkout leaseu ⚠ )flushrArCF)rrrrrrErrrrrWrprintrJrKrLrMrBrrr) r rrrrrrefusalrPrBs &$, rpopen_post_commitr"s LLG #(;T LodF.KLLX$jj!U# F(BG\G^Gf!$// t 4' 4V 44rfetchzimport os, signal, sys if not os.read(0, 1): try: os.kill(int(sys.argv[1]), signal.SIGKILL) except OSError: pass cV^8dQhRR/#)rpidintr)rs"rrrcscrc aaa^RIoSP!4wpo\P!\P RRR\ \V4.V\P\PRR7oSP!T4RTTT3R llpT# \dFpSP!S4\PRY4Rp?SP!T4R#Rp?ii;i SP!T4i;i) zStart the parent-death stand-in for child ``pid``; returns the callable that dismisses it once the child is done, or ``None`` when it could not start (logged: the fetch still runs, as it did before; only the owner's death mid-fetch is then unfenced).N-I-SrT)rrrstart_new_sessionz9Could not watch update child %s for its owner's death: %scV^8dQhRR/#)rr rr)rs"rr"_owner_watch..__annotate__ts$$T$rc<\P!\4;_uu_4SP!SR4RRR4SP!S4\P!\ P 4;_uu_4SP^R7RRR4R# +'giLk;i +'giR#;i)xNr)rJrKrwritecloserrr)rwatcher write_endsrdismiss_owner_watch..dismisstsu   ) ) HHY %*   !:!: ; ; LLL #< ;* )< ; ;sB>B. B+ . B? ) rpiperrr executable _OWNER_WATCHrDEVNULLrrrHrI)rread_endrOrrrrs& @@@r _owner_watchrcs'')Hi""CNND$lTWX[T\#]em*4*<*)-)9)9.)9)Q& CJ ,, >9== =T[4;  >  IIK  " #! 0 / /sf%G9<E G9 G% G1#FG*G ?GG G G%G%%G((G66G99 H c$V^8dQhRRRRRR/#)rrtr rr0r r4r)rs"rrrs!M4Drc^RIHp^RIHpVP R4p\ P !V4F'wrVVR8XgKT!T;'gR4V, pK) T!T!T;'gR44pVRJ;'d,RVR, PR R R 7P49# \dR #i;i) zSThe repository has a promisor remote (``extensions.partialClone``), read from disk.)Path)_git_common_dircwd-C.N partialcloneconfig utf-8-sigreplace)encodingerrorsF) pathlibrrrrW itertoolspairwise read_textlowerr)rtrrrrflagvaluecommons&& r_partial_cloners6 **U C ))'2  4<szzc"U*C3T#**- .FT!ZZn h  ) );y ) Q W W Y'Z Z s8 B/+B// B>=B>c(V^8dQhRRRRRRRR/#)rrtrurfrr0r rr)rs"rrrs.#P#P #P#PD#PT#Prc aa \V4pV\9g\SV4'gR#RUu/uFqDV9gK WBV,bK upo RR/RV V3Rlllp.pWPV4^,RFBpVR8XdM:VP R4'dK%VP V!RRR V R 244KD \ PV4Uu.uFq'gK VNK ppV'gR#V!RRR R 4;'gV!R R RRRR7p VF`pV 'gK W8wgK\\SRRRRW.43R\PR\PR\P/S BKb R#uupiuupi \\\P3d"p \P!RY:4Rp ? R#Rp ? ii;i)uPartial clones: fetch what a move to another commit will read — the target's changed trees and blobs — WITHOUT the lock fd and with the user's credential helpers, so the mutator (which has neither helper nor reason to fetch) never starts a lazy fetch or a credential daemon under the fd (m3). ``git diff HEAD `` reads exactly the trees and blobs that differ from the checked-out tree; the rest is local. Best effort: a miss only leaves a helper-less lazy fetch.Nrc$V^8dQhRRRRRR/#)rqueryrrr_r r)rs"rr(_prefetch_for_move..__annotate__s&ZZZJZ*Zrc  <\\S\V443RRRRRRRRRV/Ve/MR \P/BSBpVP ^8Xd;VP P4'dVP P4#R#) rTtextrzutf-8rrrNr)rr|rErr returncoderstrip)rroutrrts$* rresolve#_prefetch_for_move..resolves(7DK0D[b"*/:?:KBRY[e[m[mQn&)^^q%8SZZ=M=M=O=Oszz!YUYYrz--rhz rev-parsez--verifyz-qz ^{commit}z HEAD^{commit}z hash-objectz-ttreez--stdin)rdiffz--binaryz --no-ext-diffz --no-textconvrrz-Could not prefetch the objects for git %s: %s)renv)rn_MOVESrindexrlappendr0rrr|rrr ValueErrorSubprocessErrorrHdebug) rtrfrsubkeyrtargetsr<targetbaserOrs f&& @rrrs  C &w ? ?*8 J.36Mc#;. JFZZZ P 3!+,-Cd{>>#&&w{J[FYZ[ . )- g(>I(>f&66(>I {JoFII}dFIRH FtHWvz?O]a&jkn$,,n5?5G5GnPZPbPbnfln+KJ Z!;!; <P DcOOPsYE> E>.As+ICHHr?r@rArCFr6c38"TFp\V4xK R#5ir8r9r:s& rr=r/Es@^U]cSU]r?)ropenreadrrrJrKunlinkrHrIrGrLrMrB)r,r rfhnoterBs&& r_report_refused_joinr62s. &; / /2779??$D0   ) ) IIf *  NN8T388+IR+I#IJ   Y ' '9$evR@^UYZ\U]@^8^7_-`a ( K0 / * )Z  ) ) IIf * ) ) ) ( ' KsuD/DD/$E3F* D, 'D/+E,D// D?<E>D??E E #F'8F F' F$ F'* F; cV^8dQhRR/#)rr rr)rs"rrrIssrc^RIp\\RR4pV'd$VPP V4'dV#\P #)acThe interpreter for the job-joining launcher: the real one, never a venv redirector. A venv's ``Scripts\python.exe`` is a redirector: it starts the base interpreter as its own child, inside a job of its own. That child cannot join the update's job once the job holds a process from another job hierarchy (the updater's git children): ``AssignProcessToJobObject`` fails with ERROR_ACCESS_DENIED (5). And the redirector, never joined, keeps its inherited copy of the job handle open, so the job would not close when the owner dies. The launcher is stdlib-only (``-I -S``), so the base interpreter runs it as is. N_base_executable)rgetattrrrisfiler)rr*s r_join_launcher_pythonr<Is: 3*D 1D t$$ >>ra import os, signal, subprocess, sys, time KILL = signal.SIGKILL # windows-footgun: ok - POSIX-only launcher fds = tuple(int(fd) for fd in sys.argv[1].split(',')) caller = os.getpgrp() if caller != os.getpid(): os.setpgid(0, 0) stand_in = os.getpid() custodian = os.fork() if custodian: def relay(signum, frame): try: os.kill(custodian, signum) except OSError: pass for name in ('SIGINT', 'SIGTERM', 'SIGHUP'): signal.signal(getattr(signal, name), relay) code = os.waitstatus_to_exitcode(os.waitpid(custodian, 0)[1]) sys.exit(code if code >= 0 else 128 - code) os.setpgid(0, 0) me = os.getpid() reaper = False if sys.platform.startswith('linux'): try: import ctypes reaper = ctypes.CDLL(None, use_errno=True).prctl(36, 1, 0, 0, 0) == 0 # PR_SET_CHILD_SUBREAPER except (OSError, AttributeError): reaper = False def children(): found = [] for entry in os.listdir('/proc'): if not entry.isdigit(): continue try: with open('/proc/%s/stat' % entry, 'rb') as fh: stat = fh.read() if int(stat[stat.rindex(b')') + 2:].split()[1]) == me: found.append(int(entry)) except (OSError, ValueError, IndexError): continue return found def table(): try: out = subprocess.run(['ps', '-A', '-o', 'pid=,ppid=,stat=,lstart='], stdin=subprocess.DEVNULL, capture_output=True, text=True, errors='replace', timeout=10).stdout except (OSError, subprocess.SubprocessError): return {} rows = {} for line in out.splitlines(): parts = line.split(None, 3) if len(parts) == 4 and parts[0].isdigit() and parts[1].isdigit() and not parts[2].startswith('Z'): rows[int(parts[0])] = (int(parts[1]), parts[3].strip()) return rows seen = {} def sample(root): rows = table() tree = {pid for pid, start in seen.items() if rows.get(pid, (0, None))[1] == start} if root is not None: tree.add(root) grew = True while grew: grew = False for pid, (ppid, start) in rows.items(): if ppid in tree and pid not in tree: tree.add(pid) seen[pid] = start grew = True return [pid for pid, start in seen.items() if rows.get(pid, (0, None))[1] == start] def kill(pids): for pid in pids: try: os.kill(pid, KILL) except OSError: pass p = subprocess.Popen(sys.argv[2:], pass_fds=fds, process_group=caller) got = [] def forward(signum, frame): got.append(signum) try: p.send_signal(signum) except OSError: pass for name in ('SIGINT', 'SIGTERM', 'SIGHUP'): signal.signal(getattr(signal, name), forward) deadline = None while True: try: code = p.wait(timeout=0.5) break except subprocess.TimeoutExpired: pass if not reaper: sample(p.pid) if got or os.getppid() != stand_in: deadline = deadline or time.monotonic() + 10 if time.monotonic() > deadline: p.kill() end = time.monotonic() + 10 while time.monotonic() < end: live = children() if reaper else sample(None) if not live: break kill(live) while reaper: try: if not os.waitpid(-1, os.WNOHANG)[0]: break except ChildProcessError: break time.sleep(0.02) sys.exit(code if code >= 0 else 128 - code) Trootc V^8dQhRRRR/#)rr r rr4r)rs"rrrs((M(D(rc #"\V4p\PR8Xd \4f^RIHpV'dVe\ V!V44M \V4pV'd:\PRRR\RP\\V44.VOpY'dRV/M/3xR#\4p^RIp^RIpTP%R R R 7wrTP&!T 4\(P*!4p R T./T n\/4RRR\0\T4T .TOR T /3x^RIp T P5R4P7T P9T44\;Y4p T 'd<T P=\> R24PAR4^,p\YRR7hR\BR&R# \dp\Y4ThRp?ii;i ^RIp T P5R4P7T P9T44\;Y4p T 'd<T P=\> R24PAR4^,p\YRR7hR\BR&i;i5i)a``(argv, kwargs)`` for a checkout writer started by a runner that hides its Popen (the Node build in ``pm.progress.run_contained``). POSIX: the lock fd (this process's, or one it inherited for checkout ``root``), under a launcher that keeps the command in the caller's process group and kills every descendant left when it exits (:data:`_REAP_TREE`). Windows inside an update: the command runs under a launcher that joins the update's kill-on-close job first and returns only once no process the command started is left (C3); when the job cannot be handed over or the join is refused, the command never runs and :class:`CustodyRefused` is raised (D2).rN)checkout_lock_fdsrrr,rzhermes-custody-z.txt)prefixsuffix handle_list startupinfokernel32r)T)r2r.)"rErrrrr@rFrr _REAP_TREErGmapr_inheritable_job_handlerrQrtempfilemkstemprr STARTUPINFOlpAttributeListr< _JOIN_JOBrWinDLL CloseHandlec_void_pr6 removeprefix_CUSTODY_UNAVAILABLE partitionr1)r rr=r@rhandlerOrrKfdr,inforr5r s&$$ rcontained_commandrYs :D LLG #(;<0<AQe%d+,W`amWn NND$j#((3sTW=BYa\`aD#j#&266*(*!!):6!JJBHHRL %%' -x8%'tT9c&kSYa\`at$& &  j!--foof.EF#F1 %%)=(>b&ABLLSQRSTE$6 6U ) *d c)*  j!--foof.EF#F1 %%)=(>b&ABLLSQRSTE$6 6U sP:I+'I+%A I+2 F=amgcmvrmaddtagrVcleanmergeresetstashbranchcommitrebaserevertswitchrestorecheckoutworktree read-tree update-ref cherry-pick pack-objects symbolic-ref update-indexcheckout-index>rrrsryr{r}> rr --git-dir --exec-path --list-cmds --namespace --work-tree --config-env --attr-source--super-prefix)z hermes update);__conditional_annotations__r+ __future__rrJloggingrrrcollections.abcrr getLoggerr'rHrydevnullrz frozensetrqr rjrrrr"r1__annotations__rQrNrdrnrrr|rrrrrrrrrrrrrrrrrT _REFUSED_EXITrOr6r<rHcontextmanagerrYrJ)rs@rrs%N#  $   8 $N /7KTUdegeoeodpSqr H I bc RW R  %UIt ,d,U" sl2%,=$ Qu QHUHD> 5 !'+  6H@$#Pf<  (()"?4#)H Z.Tw t (4(d((Vr