mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-06 05:17:42 +00:00
fix(storage): resolve erasure parity per pool (#4977)
* fix(filemeta): add state-aware file info validation
* fix(filemeta): validate shard arithmetic and delete paths
* fix(ecstore): add fallible erasure construction
* fix(ecstore): resolve storage parity per pool
* fix(storage): report heterogeneous erasure layouts
* fix(admin): publish prepared storage config atomically
* fix(storage): harden per-pool parity boundaries
* fix(storage): address pre-PR validation findings
* test(ci): fix strict-topology validation fixtures
* fix(heal): preserve delete markers during repair
* refactor(filemeta): drop unused ValidatedFileInfo witness
ValidatedFileInfo wrapped an unread `_file_info` reference alongside an `Option<ValidatedErasureLayout>`, but only the layout was ever consumed. Return the layout directly from `FileInfo::validate` so the sole production consumer (`LocalDisk::check_parts`) and the two unit tests read it without the extra witness type and lifetime.
No behavior change.
* fix(filemeta): keep compressed and MinIO-migrated tiered objects readable
The new decode-path validation rejected several legitimate on-disk shapes that older RustFS and MinIO-migrated data carry, turning readable objects into FileCorrupt:
- Compressed objects written with an unknown upload size persist a negative per-part actual_size (the documented "unknown size" sentinel that ObjectInfo::get_actual_size already tolerates). validate_collection_contents rejected it via usize::try_from; now a negative actual_size skips shard validation and only real, non-negative sizes are checked.
- MinIO-migrated objects transitioned to a versioned remote tier store the tier version id as a UUID string, not 16 raw bytes. MetaObject::into_fileinfo returned FileCorrupt (main tolerated it as None), making all versions of the object unreadable; MetaDeleteMarker free-version records took a Some(nil) sentinel path with the same effect, which also breaks free-version expiry (remote-tier leak). Both now decode through a shared transitioned_version_id_from_meta_sys helper: 16 raw bytes or a UUID string are accepted, anything else is tolerated as None instead of failing the read.
Regression tests updated to assert the readable/compat behavior, with new tests covering MinIO string-form recovery.
* fix(scanner): build the delete-marker test fixture without erasure geometry
get_size_counts_delete_markers_separately_from_versions built its delete marker with `FileInfo::new(object, 1, 1)`, which attaches erasure geometry (data=1/parity=1/distribution). This PR classifies versions by shape via `is_storage_delete_marker()` (no geometry) rather than the raw `deleted` flag, so a geometry-bearing "delete marker" is correctly serialized as a purge-pending payload Object and counted as a version — CI saw summary.versions=3, expected 2.
Real delete markers carry no erasure geometry (delete paths build them as `FileInfo { deleted: true, ..Default::default() }`), so construct the fixture the same way. It then classifies as a storage delete marker and the counts (versions=2, delete_markers=1) hold. This keeps the PR's more-correct classification, which prevents a purge-pending object's geometry from being dropped when serialized as a bare delete marker.
* docs(changelog): note per-pool parity fix and storage-class startup upgrade caveat
Records the #4801 per-pool erasure parity fix under Fixed, and documents the upgrade behavior where a persisted storage class that a small or heterogeneous pool cannot satisfy now fails startup — with the RUSTFS_STORAGE_CLASS_STANDARD recovery steps. Docs-only; covers R4 from the on-disk compatibility audit.
* fix(heal): report parity from erasure geometry, not is_valid()
heal_object set HealResultItem.parity_blocks via `if lfi.is_valid()`, which was missed by the migration of the other quorum/metadata predicates. With the new `is_valid()` semantics (full payload validation; delete markers now return false), a delete marker or a geometry-bearing version with a benign collection quirk would misreport parity as the pool default instead of its own. Use `has_valid_erasure_geometry()` — the narrow "does this carry erasure geometry" predicate the rest of the migration uses — so reporting matches the object's actual layout. Reporting-only; no data-path change.
* fix(filemeta): do not silently serialize a non-canonical deleted FileInfo as an Object
`From<FileInfo> for FileMetaVersion` classifies by `is_storage_delete_marker()` (shape), which correctly routes canonical delete markers to Delete and purge-pending payloads (deleted=true with real erasure geometry) to Object. But a `deleted` FileInfo that is neither a canonical marker nor a valid erasure payload would silently serialize as a zero-geometry MetaObject that later fails `validate_for_metadata_read`. Write paths validate first (`validate_for_erasure_write` / `validate_for_metadata_read`), so this is a caller bug; `From` is infallible, so surface it with a structured `warn!` on the malformed branch instead of writing corrupt metadata silently. Legitimate purge-pending objects (valid geometry) are unaffected — the guard only fires for `deleted && !has_valid_erasure_geometry()`.
* test(filemeta): assert real historical xl.meta versions pass metadata-read validation
Empirical companion to the code-reasoned decode-tolerance invariants (docs/architecture/erasure-coding.md §11) and the rolling-upgrade / MinIO-migration compatibility concern: the tightened `validate_for_metadata_read` runs on every local disk read and peer-RPC-decoded FileInfo, so it must accept every version of real historically-written xl.meta, never reject it as FileCorrupt.
Loads five real fixtures — MinIO small-inline, MinIO versioned (two object versions + a delete marker), MinIO large multipart, a legacy V1 (xl.json-derived) object, and a legacy meta_ver 2 object — decodes every version with parts materialized, and asserts validate_for_metadata_read() is Ok for each. Reverting the tolerant handling (delete-marker shape, legacy per-part checksums, string/short transitioned-versionID, negative actual_size) turns this red.
* fix(ci): remove duplicate storage test re-exports
---------
Co-authored-by: overtrue <anzhengchao@gmail.com>
This commit is contained in:
cxymds
@@ -141,6 +141,10 @@ ECSTORE_STORAGE_API_ROOT_CONSUMER_HITS_FILE="${TMP_DIR}/ecstore_storage_api_root
|
||||
ECSTORE_TEST_DIRECT_API_HITS_FILE="${TMP_DIR}/ecstore_test_direct_api_hits.txt"
|
||||
ECSTORE_BENCH_DIRECT_API_HITS_FILE="${TMP_DIR}/ecstore_bench_direct_api_hits.txt"
|
||||
ERASURE_PANICKING_CONSTRUCTOR_HITS_FILE="${TMP_DIR}/erasure_panicking_constructor_hits.txt"
|
||||
ERASURE_PANICKING_CONSTRUCTOR_ALL_HITS_FILE="${TMP_DIR}/erasure_panicking_constructor_all_hits.txt"
|
||||
ERASURE_GUARD_FIXTURE_HITS_FILE="${TMP_DIR}/erasure_guard_fixture_hits.txt"
|
||||
ERASURE_GUARD_FIXTURE_EXPECTED_FILE="${TMP_DIR}/erasure_guard_fixture_expected.txt"
|
||||
ERASURE_GUARD_FIXTURE="scripts/fixtures/architecture_migration_rules/cfg_test_field.rs"
|
||||
LOCAL_STORAGE_API_RAW_CONTRACT_PATH_HITS_FILE="${TMP_DIR}/local_storage_api_raw_contract_path_hits.txt"
|
||||
STORE_API_DELETE_DTO_REEXPORTS_FILE="${TMP_DIR}/store_api_delete_dto_reexports.txt"
|
||||
STORE_API_DELETE_DTO_INTERNAL_HITS_FILE="${TMP_DIR}/store_api_delete_dto_internal_hits.txt"
|
||||
@@ -1154,9 +1158,12 @@ fi
|
||||
|
||||
(
|
||||
cd "$ROOT_DIR"
|
||||
find rustfs/src crates -type f -name '*.rs' -print0 |
|
||||
{
|
||||
find rustfs/src crates -type f -name '*.rs' -print0
|
||||
printf '%s\0' "$ERASURE_GUARD_FIXTURE"
|
||||
} |
|
||||
xargs -0 perl -ne '
|
||||
next unless $ARGV =~ m{^(?:rustfs/src/|crates/[^/]+/src/)};
|
||||
next unless $ARGV =~ m{^(?:rustfs/src/|crates/[^/]+/src/|scripts/fixtures/architecture_migration_rules/cfg_test_field\.rs$)};
|
||||
if (!defined $current_file || $ARGV ne $current_file) {
|
||||
$current_file = $ARGV;
|
||||
$line = 0;
|
||||
@@ -1174,9 +1181,9 @@ fi
|
||||
my $item = $2;
|
||||
if ($item =~ /^\s*(?:\/\/.*)?$/) {
|
||||
$pending_test_item = 1;
|
||||
} elsif ($item !~ /;\s*(?:\/\/.*)?$/ && $item =~ /\{/ && $item !~ /}\s*(?:\/\/.*)?$/) {
|
||||
} elsif ($item !~ /[,;]\s*(?:\/\/.*)?$/ && $item =~ /\{/ && $item !~ /}\s*(?:\/\/.*)?$/) {
|
||||
$in_test_item = 1;
|
||||
} elsif ($item !~ /;\s*(?:\/\/.*)?$/ && $item !~ /\{/) {
|
||||
} elsif ($item !~ /[,;]\s*(?:\/\/.*)?$/ && $item !~ /\{/) {
|
||||
$pending_test_item = 1;
|
||||
}
|
||||
next;
|
||||
@@ -1184,6 +1191,8 @@ fi
|
||||
if ($pending_test_item) {
|
||||
if (/;\s*(?:\/\/.*)?$/) {
|
||||
$pending_test_item = 0;
|
||||
} elsif (/^(\s*).*,\s*(?:\/\/.*)?$/ && $1 eq $test_indent) {
|
||||
$pending_test_item = 0;
|
||||
} elsif (/\{/) {
|
||||
$pending_test_item = 0;
|
||||
$in_test_item = 1 unless /}\s*(?:\/\/.*)?$/;
|
||||
@@ -1193,8 +1202,22 @@ fi
|
||||
if (/^\s*(?!\/\/).*\bErasure::new(?:_with_options)?\s*\(/) {
|
||||
print "$ARGV:$line:$_";
|
||||
}
|
||||
' || true
|
||||
) >"$ERASURE_PANICKING_CONSTRUCTOR_HITS_FILE"
|
||||
' || true
|
||||
) >"$ERASURE_PANICKING_CONSTRUCTOR_ALL_HITS_FILE"
|
||||
|
||||
grep -Fv "$ERASURE_GUARD_FIXTURE:" "$ERASURE_PANICKING_CONSTRUCTOR_ALL_HITS_FILE" \
|
||||
>"$ERASURE_PANICKING_CONSTRUCTOR_HITS_FILE" || true
|
||||
|
||||
grep -F "$ERASURE_GUARD_FIXTURE:" "$ERASURE_PANICKING_CONSTRUCTOR_ALL_HITS_FILE" \
|
||||
>"$ERASURE_GUARD_FIXTURE_HITS_FILE" || true
|
||||
printf '%s\n' \
|
||||
"$ERASURE_GUARD_FIXTURE:19: let _ = Erasure::new(2, 1, 64);" \
|
||||
"$ERASURE_GUARD_FIXTURE:23: let _ = Erasure::new_with_options(2, 1, 64, false);" \
|
||||
>"$ERASURE_GUARD_FIXTURE_EXPECTED_FILE"
|
||||
|
||||
if ! cmp -s "$ERASURE_GUARD_FIXTURE_EXPECTED_FILE" "$ERASURE_GUARD_FIXTURE_HITS_FILE"; then
|
||||
report_failure "Erasure constructor guard must resume production scanning after a cfg(test) field"
|
||||
fi
|
||||
|
||||
if [[ -s "$ERASURE_PANICKING_CONSTRUCTOR_HITS_FILE" ]]; then
|
||||
report_failure "production code must use fallible Erasure constructors: $(paste -sd '; ' "$ERASURE_PANICKING_CONSTRUCTOR_HITS_FILE")"
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
struct GuardFixture {
|
||||
#[cfg(test)]
|
||||
test_only: (),
|
||||
#[cfg(test)]
|
||||
test_generic: Option<
|
||||
usize,
|
||||
>,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
fn test_only_constructor(
|
||||
data_shards: usize,
|
||||
parity_shards: usize,
|
||||
) {
|
||||
let _ = Erasure::new_with_options(data_shards, parity_shards, 64, false);
|
||||
}
|
||||
|
||||
fn production_after_test_fields() {
|
||||
let _ = Erasure::new(2, 1, 64);
|
||||
}
|
||||
|
||||
fn second_production_path() {
|
||||
let _ = Erasure::new_with_options(2, 1, 64, false);
|
||||
}
|
||||
Reference in New Issue
Block a user