mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-02 11:29:17 +00:00
houseme
8218248000
* fix(hotpath): pin mimalloc allocator backend * test(hotpath): verify mimalloc allocator backend Co-Authored-By: heihutu <heihutu@gmail.com> * chore(hotpath): document unsafe allocator tests Co-Authored-By: heihutu <heihutu@gmail.com> * feat(kms): record real cache hit, miss and eviction metrics (#5531) * feat(kms): record real cache hit, miss and eviction metrics The metadata cache reported (entry_count, 0) because moka exposes no hit or miss counts, so the miss half of every cache report was a constant. Track lookups and removals in the cache itself: hit/miss counters on the lookup path, a moka eviction listener classifying removals by cause, and an entry gauge refreshed whenever the entry set changes. The counters are exported through the metrics facade under the rustfs_kms_ prefix with static label values only, matching the operation-policy metrics, and are also returned as a KmsCacheStats snapshot in place of the old tuple. Cache semantics are unchanged: capacity, TTL and invalidation points are the same, and remove now flushes pending maintenance so the gauge and the removal notification describe the cache the caller sees. Refs rustfs/backlog#1584 * fix(kms): report real cache counters through the admin status API KmsStatusResponse.cache_stats mapped the old (entry_count, 0) tuple onto hit_count and miss_count, so operators polling KMS status read the entry count as a hit count and a miss count that was always zero. Map the fields to the counters they claim to be, and add entry_count and eviction_count as additive, defaulted fields so the entry number that hit_count used to carry is still available. Refs rustfs/backlog#1584 * fix(kms): refresh the cache entry gauge on lookup misses The entry gauge was published only from the write paths, so an entry dropped by TTL expiry left `rustfs_kms_metadata_cache_entries` reporting a population that no longer existed until the next put, remove or clear. A cache that goes quiet — entries ageing out with no further writes — kept over-reporting indefinitely. Republish the gauge from the lookup path when the lookup misses. A miss is where expiry surfaces, and moka reaps expired entries in the maintenance it runs during that same lookup, so the count read afterwards reflects the reaping. Hits stay free of the extra work. * docs(kms): correct the entry gauge convergence claim on the miss path The comment on the miss-path gauge refresh said moka reaps expired entries in the maintenance it runs on that same lookup. It does not: `should_apply_reads` is gated on a full read log or an elapsed housekeeping interval, so the removal that decrements `entry_count` and reaches the eviction listener may land on a later lookup. The behaviour and the test are unchanged — the gauge still converges, and the test drives `run_pending_tasks` explicitly rather than riding on that interval. Only the stated guarantee was wrong, so say interval instead of same-lookup and record why forcing maintenance on the read path was not the trade taken. * chore(deps): refresh cargo dependencies Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: Zhengchao An <anzhengchao@gmail.com>
104 lines
3.9 KiB
TOML
104 lines
3.9 KiB
TOML
# cargo-deny configuration
|
|
#
|
|
# Run with `cargo deny check` (advisories, sources, bans, licenses).
|
|
# Schema: https://embarkstudios.github.io/cargo-deny/checks/cfg.html
|
|
#
|
|
# This file codifies what was previously implicit policy:
|
|
# - which RustSec advisories we knowingly accept and why,
|
|
# - which non-crates.io sources we trust,
|
|
# - which duplicate crate versions we tolerate vs. flag.
|
|
#
|
|
# When adding an exception, include an `# owner: <github-handle> review: <yyyy-mm>`
|
|
# comment so future audits know who signed off and when to revisit.
|
|
|
|
[graph]
|
|
all-features = true
|
|
no-default-features = false
|
|
|
|
[advisories]
|
|
version = 2
|
|
yanked = "deny"
|
|
ignore = [
|
|
# `paste 1.0.15` — unmaintained. No direct dependency.
|
|
# owner: rustfs-maintainers review: 2026-07
|
|
{ id = "RUSTSEC-2024-0436", reason = "paste unmaintained; transitive only; tracked for upgrade" },
|
|
# `rsa` Marvin timing sidechannel (RUSTSEC-2023-0071). Pulled in via
|
|
# `openidconnect` (transitive) and historically used directly. No upstream
|
|
# fix is available yet. Tracked separately for follow-up; remove this
|
|
# entry once a patched `rsa` lands in the dependency graph and any
|
|
# in-process RSA decryption oracles are removed.
|
|
# owner: rustfs-maintainers review: 2026-07
|
|
{ id = "RUSTSEC-2023-0071", reason = "rsa Marvin timing sidechannel; no fixed upstream version; tracked separately" },
|
|
]
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
allow-git = [
|
|
# Official s3s repository. Temporarily pinned to the merged generic REST
|
|
# SigV4 payload-checksum fix until it is available in a crates.io release.
|
|
# owner: marshawcoco review: 2026-10
|
|
"https://github.com/s3s-project/s3s.git",
|
|
# Presigned expiry and constant-time authentication fixes pending upstream merge.
|
|
# owner: cxymds review: 2026-10
|
|
"https://github.com/cxymds/s3s.git",
|
|
# MiMalloc fork pinned for hotpath allocation counting support.
|
|
# owner: houseme review: 2026-10
|
|
"https://github.com/xonatius/mimalloc_rust.git",
|
|
"https://github.com/apache/datafusion.git",
|
|
]
|
|
|
|
[bans]
|
|
# Multiple-versions of the same crate are permitted with a warning so the
|
|
# graph remains buildable while we work the chains down. Crypto- and
|
|
# transport-sensitive crates are tracked separately below.
|
|
multiple-versions = "warn"
|
|
wildcards = "warn"
|
|
highlight = "all"
|
|
|
|
# Any future crate we want to forbid outright belongs here.
|
|
deny = []
|
|
|
|
# Crates whose duplicate versions are most worth eliminating, because they
|
|
# touch crypto, parsing, or networking trust boundaries. Not currently a
|
|
# build error — the graph still has duplicates — but tracking the list keeps
|
|
# them visible.
|
|
[[bans.skip-tree]]
|
|
# `windows-sys` notoriously has many old versions in dependency closures;
|
|
# don't flood the report with it.
|
|
name = "windows-sys"
|
|
|
|
[licenses]
|
|
version = 2
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"BSL-1.0", # boost; tracing-related crates
|
|
"CC0-1.0",
|
|
"CDLA-Permissive-2.0", # webpki / linux-raw-sys metadata
|
|
"ISC",
|
|
"MIT",
|
|
"MIT-0",
|
|
"MPL-2.0",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
]
|
|
confidence-threshold = 0.93
|
|
exceptions = [
|
|
# `ring` ships a custom license combining ISC, MIT, and an OpenSSL-style
|
|
# notice that does not parse cleanly as SPDX OpenSSL.
|
|
{ allow = ["ISC", "MIT"], crate = "ring" },
|
|
# `inferno` is CDDL-1.0 (copyleft). Used only by profiling tooling
|
|
# (pyroscope / jemalloc_pprof) which is opt-in and never linked into the
|
|
# default S3 path. Tracked as an exception rather than a blanket allow.
|
|
# owner: rustfs-maintainers review: 2026-07
|
|
{ allow = ["CDDL-1.0"], crate = "inferno" },
|
|
# `libbz2-rs-sys` carries the upstream bzip2-1.0.6 license. It's used
|
|
# transitively via `bzip2`. Not on a hot path.
|
|
# owner: rustfs-maintainers review: 2026-07
|
|
{ allow = ["bzip2-1.0.6"], crate = "libbz2-rs-sys" },
|
|
]
|