Class: Kettle::Family::Secrets::Broker

Inherits:
Object
  • Object
show all
Defined in:
lib/kettle/family/secrets_broker.rb

Overview

Serves release secret requests from member kettle-release processes. The family owns the configured provider and serializes all requests so one release session is shared across sequential and parallel waves.

Constant Summary collapse

OPERATIONS = 
%w[gem_signing_passphrase rubygems_otp].freeze
UNIX_SOCKET_PATH_MAX = 
108

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(provider:, root:) ⇒ Broker

Returns a new instance of Broker.



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/kettle/family/secrets_broker.rb', line 20

def initialize(provider:, root:)
  @provider = provider
  directory = File.join(root, "tmp", "kettle-family")
  basename = "secrets-#{SecureRandom.hex(8)}.sock"
  @path = File.join(directory, basename)

  if @path.bytesize > UNIX_SOCKET_PATH_MAX
    directory = File.join(root, "tmp", "kf")
    @path = File.join(directory, "s-#{SecureRandom.hex(8)}")
  end

  if @path.bytesize > UNIX_SOCKET_PATH_MAX
    raise Error,
      "release secrets broker socket path is too long (#{@path.bytesize} bytes; Unix sockets allow #{UNIX_SOCKET_PATH_MAX})"
  end

  FileUtils.mkdir_p(directory, mode: 0o700)
  @mutex = Mutex.new
  @closed = false
end

Instance Attribute Details

#path ⇒ Object (readonly)

Returns the value of attribute path.



18
19
20
 
# File 'lib/kettle/family/secrets_broker.rb', line 18

def path
  @path
end

Instance Method Details

#close ⇒ Object 



51
52
53
54
55
56
57
58
 
# File 'lib/kettle/family/secrets_broker.rb', line 51

def close
  @closed = true
  @server&.close
  @thread&.join(1)
ensure
  @thread&.kill if @thread&.alive?
  FileUtils.rm_f(@path)
end

#start ⇒ Object 



41
42
43
44
45
46
47
48
49
 
# File 'lib/kettle/family/secrets_broker.rb', line 41

def start
  @server = UNIXServer.new(@path)
  File.chmod(0o600, @path)
  @thread = Thread.new { serve } # rubocop:disable ThreadSafety/NewThread -- Broker owns one listener for the family release session.
  self
rescue
  close
  raise
end