The unreferenced prune deletes a blob committed but not yet linked
Defect 18 / Tier 4 / blocking
services/proxy/src/sweep.rs:114-120Expected review
exempt blobs younger than `cache_min_age` from the unreferenced prune too, or re-read the index entry immediately before unlinking.
Discovery difficulty
the reasoning in the comment is sound for every blob that is not being written right now, and unreachable-so-remove is the correct rule for a content-addressed store. Seeing the hole means opening `cache.rs`, noticing that commit and link are separated by a network call, and recognising that the existing error string is a description of this bug.
Trigger
a sweep landing in that window, which is a whole registry round trip wide. It is wider than that, and this is the part that makes it a mark-and-sweep bug rather than a plain race: `sweep` builds the index map at line 92 *before* listing the blobs at line 95, so a blob whose `link` completed after the snapshot but before the listing is still treated as unreferenced and deleted. `fetch` then fails at the `open_blob` on line 90 with the error already sitting there for this case: "a blob committed by this request is already missing from the store". That message was written for an operator deleting by hand; this change makes the proxy do it to itself.
Severity
blocking