mirror of
https://github.com/getnora-io/nora.git
synced 2026-04-12 18:30:32 +00:00
DevITWay | Pavel Volkov
ac3a8a7c43
* fix: proxy dedup, multi-registry GC, TOCTOU and credential hygiene - Deduplicate proxy_fetch/proxy_fetch_text into generic proxy_fetch_core with response extractor closure (removes ~50 lines of copy-paste) - GC now scans all registry prefixes, not just docker/ - Add tracing::warn to fire-and-forget cache writes in docker proxy - Mark S3 credentials as skip_serializing to prevent accidental leaks - Remove TOCTOU race in LocalStorage get/delete (redundant exists check) * chore: clean up root directory structure - Move Dockerfile.astra and Dockerfile.redos to deploy/ (niche builds should not clutter the project root) - Harden .gitignore to exclude session files, working notes, and internal review scripts * refactor(metrics): replace 13 atomic fields with CounterMap Per-registry download/upload counters were 13 individual AtomicU64 fields, each duplicated across new(), with_persistence(), save(), record_download(), record_upload(), and get_registry_* (6 touch points per counter). Adding a new registry required changes in 6+ places. Now uses CounterMap (HashMap<String, AtomicU64>) for per-registry counters. Adding a new registry = one entry in REGISTRIES const. Added Go registry to REGISTRIES, gaining go metrics for free. * quality: add MSRV, tarpaulin config, proptest for parsers - Set rust-version = 1.75 in workspace Cargo.toml (MSRV policy) - Add tarpaulin.toml: llvm engine, fail-under=25, json+html output - Add coverage/ to .gitignore - Update CI to use tarpaulin.toml instead of inline flags - Add proptest dev-dependency and property tests: - validation.rs: 16 tests (never-panics + invariants for all 4 validators) - pypi.rs: 5 tests (extract_filename never-panics + format assertions) * test: add unit tests for 14 modules, coverage 21% → 30% Add 149 new tests across auth, backup, gc, metrics, mirror parsers, docker (manifest detection, session cleanup, metadata serde), docker_auth (token cache), maven, npm, pypi (normalize, rewrite, extract), raw (content-type guessing), request_id, and s3 (URI encoding). Update tarpaulin.toml: raise fail-under to 30, exclude UI/main from coverage reporting as they require integration tests. * bench: add criterion benchmarks for validation and manifest parsing Add parsing benchmark suite with 14 benchmarks covering: - Storage key, Docker name, digest, and reference validation - Docker manifest media type detection (v2, OCI index, minimal, invalid) Run with: cargo bench --package nora-registry --bench parsing * test: add 48 integration tests via tower oneshot Add integration tests for all HTTP handlers: - health (3), raw (7), cargo (4), maven (4), request_id (2) - pypi (5), npm (5), docker (12), auth (6) Create test_helpers.rs with TestContext pattern. Add tower and http-body-util dev-dependencies. Update tarpaulin fail-under 30 to 40. Coverage: 29.5% to 43.3% (2089/4825 lines) * fix: clean clippy warnings in tests, fix flaky audit test Add #[allow(clippy::unwrap_used)] to 18 test modules. Fix 3 additional clippy lints: writeln_empty_string, needless_update, unnecessary_get_then_check. Fix flaky audit test: replace single sleep(50ms) with retry loop (max 1s). Prefix unused token variable with underscore. cargo clippy --all-targets = 0 warnings (was 245 errors)
110 lines
3.6 KiB
Rust
110 lines
3.6 KiB
Rust
use criterion::{black_box, criterion_group, criterion_main, Criterion};
|
|
use nora_registry::validation::{
|
|
validate_digest, validate_docker_name, validate_docker_reference, validate_storage_key,
|
|
};
|
|
|
|
fn bench_validation(c: &mut Criterion) {
|
|
let mut group = c.benchmark_group("validation");
|
|
|
|
group.bench_function("storage_key_short", |b| {
|
|
b.iter(|| validate_storage_key(black_box("docker/alpine/blobs/sha256:abc123")))
|
|
});
|
|
|
|
group.bench_function("storage_key_long", |b| {
|
|
let key = "maven/com/example/deep/nested/path/artifact-1.0.0-SNAPSHOT.jar";
|
|
b.iter(|| validate_storage_key(black_box(key)))
|
|
});
|
|
|
|
group.bench_function("storage_key_reject", |b| {
|
|
b.iter(|| validate_storage_key(black_box("../etc/passwd")))
|
|
});
|
|
|
|
group.bench_function("docker_name_simple", |b| {
|
|
b.iter(|| validate_docker_name(black_box("library/alpine")))
|
|
});
|
|
|
|
group.bench_function("docker_name_nested", |b| {
|
|
b.iter(|| validate_docker_name(black_box("my-org/sub/repo-name")))
|
|
});
|
|
|
|
group.bench_function("docker_name_reject", |b| {
|
|
b.iter(|| validate_docker_name(black_box("INVALID/NAME")))
|
|
});
|
|
|
|
group.bench_function("digest_sha256", |b| {
|
|
b.iter(|| {
|
|
validate_digest(black_box(
|
|
"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
|
))
|
|
})
|
|
});
|
|
|
|
group.bench_function("digest_reject", |b| {
|
|
b.iter(|| validate_digest(black_box("md5:abc")))
|
|
});
|
|
|
|
group.bench_function("reference_tag", |b| {
|
|
b.iter(|| validate_docker_reference(black_box("v1.2.3-alpine")))
|
|
});
|
|
|
|
group.bench_function("reference_digest", |b| {
|
|
b.iter(|| {
|
|
validate_docker_reference(black_box(
|
|
"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
|
))
|
|
})
|
|
});
|
|
|
|
group.finish();
|
|
}
|
|
|
|
fn bench_manifest_detection(c: &mut Criterion) {
|
|
let mut group = c.benchmark_group("manifest_detection");
|
|
|
|
let docker_v2 = serde_json::json!({
|
|
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
|
|
"schemaVersion": 2,
|
|
"config": {"mediaType": "application/vnd.docker.container.image.v1+json", "digest": "sha256:abc"},
|
|
"layers": [{"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "digest": "sha256:def", "size": 1000}]
|
|
})
|
|
.to_string();
|
|
|
|
let oci_index = serde_json::json!({
|
|
"schemaVersion": 2,
|
|
"manifests": [
|
|
{"digest": "sha256:aaa", "platform": {"os": "linux", "architecture": "amd64"}},
|
|
{"digest": "sha256:bbb", "platform": {"os": "linux", "architecture": "arm64"}}
|
|
]
|
|
})
|
|
.to_string();
|
|
|
|
let minimal = serde_json::json!({"schemaVersion": 2}).to_string();
|
|
|
|
group.bench_function("docker_v2_explicit", |b| {
|
|
b.iter(|| {
|
|
nora_registry::docker_fuzz::detect_manifest_media_type(black_box(docker_v2.as_bytes()))
|
|
})
|
|
});
|
|
|
|
group.bench_function("oci_index", |b| {
|
|
b.iter(|| {
|
|
nora_registry::docker_fuzz::detect_manifest_media_type(black_box(oci_index.as_bytes()))
|
|
})
|
|
});
|
|
|
|
group.bench_function("minimal_json", |b| {
|
|
b.iter(|| {
|
|
nora_registry::docker_fuzz::detect_manifest_media_type(black_box(minimal.as_bytes()))
|
|
})
|
|
});
|
|
|
|
group.bench_function("invalid_json", |b| {
|
|
b.iter(|| nora_registry::docker_fuzz::detect_manifest_media_type(black_box(b"not json")))
|
|
});
|
|
|
|
group.finish();
|
|
}
|
|
|
|
criterion_group!(benches, bench_validation, bench_manifest_detection);
|
|
criterion_main!(benches);
|