newParallelReader acquired a pooled stash buffer from globalBytePoolCap
and sliced it into per-shard views (bufs), but returned the struct with
`buf: make([][]byte, len(readers))` — discarding bufs. The pooled buffer
was reserved and recycled but never read into, while Read heap-allocated
each shard buffer lazily, adding ~1 MiB of fresh allocations per in-flight
GET decode on top of the reserved-but-unused 2 MiB pool buffer.
Wire the seeded bufs into buf so reads land in the pooled buffer. Entries
stay nil for the no-stash / oversized-legacy-block path, where Read's lazy
make remains the fallback. Correctness is unchanged; this removes the
allocation churn the byte pool was meant to avoid.
Fixes#11
Binaries exceed GitHub's 100MB git push limit so they cannot be stored
in the gh-pages branch. Two changes to fix this:
- release.yml: stop copying binaries/minisig to gh-pages; write
buckit.sha256sum files with the release tag embedded in the filename
field (e.g. 'buckit.RELEASE.xxx') so the Go code can construct the
versioned GitHub Releases URL.
- update.go / admin-handlers.go: getBinaryURL now constructs a
github.com/releases/download URL when the checksum source is github.io
and the sha256sum filename contains a release tag. Fixes two dead-code
bugs in both admin handlers where 'if updateURL == ""' was always
false after updateURL had already been set.
fix(api): Don't send responses twice.
In some cases multiple responses are being sent for one request, causing
the API server to incorrectly drop connections.
This change introduces a ResponseWriter which tracks whether a
response has already been sent. This is used to prevent a response being
sent if something already has (e.g. by a preconditions check function).
Fixes#21633.
Co-authored-by: Menno Finlay-Smits <hello@menno.io>
This fixes a security issue where sub-policy attached to a service
account or STS account is not properly validated under certain "own"
account operations (like creating new service accounts). This allowed a
service account to create new service accounts for the same user
bypassing the inline policy restriction.
abuckit