59fd053dac
75f64e50c6test: exercise node abort on UTXO deserialization failure (furszy)4652cd0d82txdb: detect UTXO deserialization errors via CDBWrapper::TryRead() (furszy)5dfbb91b6cdbwrapper: add TryRead() to distinguish errors from valid outcomes (furszy)f78834fac9test: add missing coverage for CDBWrapper::Read() errors (furszy) Pull request description: Early note: the majority of this PR consists of test coverage. The changes per se are small. If a UTXO entry on disk can't be deserialized, the node currently treats it as if the coin wouldn't exist instead of aborting with an error. A non-existing coin has a very specific meaning for consensus: any block that spends it would be permanently rejected as invalid (`BLOCK_FAILED_VALID`), silently forking the node from the rest of the network. This can't currently be triggered in practice (details below), but it's still the wrong behavior. The root cause is that `CDBWrapper::Read()` returns `false` for both missing entries and deserialization failures, so `CCoinsViewDB::GetCoin()` has no way to tell them apart. `CCoinsViewErrorCatcher` was built to catch database read errors and abort, but it never fires during deserialization errors because `CDBWrapper::Read()` swallows the exception before it can propagate. This [comment](8a8edc8d88/src/coins.cpp (L398-L411)) in `ExecuteBackedWrapper()` spells out the code intent very clearly. As mentioned initially, this can't happen in practice today. It would require either a bug in the coin serialization path, or a memory corruption before the data reaches LevelDB (at which point we have bigger problems). Random disk-level bit flips are caught earlier by LevelDB's verification (`verify_checksums=true`, enabled by default), which already propagates correctly as `DB_INTERNAL_ERROR`. Regardless, a db read issue should never be silently misinterpreted as a consensus violation. This PR adds `CDBWrapper::TryRead()`, which returns a `ReadStatus` that lets callers discriminate between all possible outcomes. `CCoinsViewDB::GetCoin()` switches on the result and throws on any error, letting `ExecuteBackedWrapper()` do what it was designed to do. `CDBWrapper::Read()` becomes a thin wrapper over `TryRead()`, preserving backward compatibility for all other callers (so we don't have to change non-consensus code here). `PeekCoin()` is also covered, as it delegates to `CCoinsViewDB::GetCoin()` at the database level. The idea of the PR is to go slowly over the code changes, first commit locks-in the current `CDBWrapper::Read()` behavior . The second adds `TryRead()` with tests for all four status codes. The third is the `CCoinsViewDB::GetCoin()` fix. The fourth is a functional that ensures the node aborts correctly instead of silently diverging. Testing Notes: Cherry-picking the functional test commit on master demonstrates the consensus split when the coin entry fails to deserialize. Extra Note: `CDBIterator::GetValue()` has the same silent-swallow pattern. Not consensus-critical. Should be addressed in a follow-up. ACKs for top commit: ajtowns: reACK75f64e50c6sedited: ACK75f64e50c6mzumsande: Code Review ACK [75f64e5](75f64e50c6) Tree-SHA512: 51b0114ea443544a2f1fbb8e63be6e1dff94d6f287221d566dbc98d666784a2b4c486acfb87eea5392bc1d092fb6d6dc0ff6782bcdccdcf15939281c895e384d
CI Scripts
This directory contains scripts for each build step in each build stage.
Running a Stage Locally
Be aware that the tests will be built and run in-place, so please run at your own risk. If the repository is not a fresh git clone, you might have to clean files from previous builds or test runs first.
The ci needs to perform various sysadmin tasks such as installing packages or writing to the user's home directory. While it should be fine to run the ci system locally on your development box, the ci scripts can generally be assumed to have received less review and testing compared to other parts of the codebase. If you want to keep the work tree clean, you might want to run the ci system in a virtual machine with a Linux operating system of your choice.
To allow for a wide range of tested environments, but also ensure reproducibility to some extent, the test stage
requires bash, docker, and python3 to be installed. To run on different architectures than the host qemu is also required. To install all requirements on Ubuntu, run
sudo apt install bash docker.io python3 qemu-user-static
For some sanitizer builds, the kernel's address-space layout randomization (ASLR) entropy can cause sanitizer shadow memory mappings to fail. When running the CI locally you may need to reduce that entropy by running:
sudo sysctl -w vm.mmap_rnd_bits=28
To run a test that requires emulating a CPU architecture different from the
host, we may rely on the container environment recognizing foreign executables
and automatically running them using qemu. The following sets us up to do so
(also works for podman):
docker run --rm --privileged docker.io/multiarch/qemu-user-static --reset -p yes
It is recommended to run the CI system in a clean environment. The env -i
command below ensures that only specified environment variables are propagated
into the local CI.
To run the test stage with a specific configuration:
env -i HOME="$HOME" PATH="$PATH" USER="$USER" FILE_ENV="./ci/test/00_setup_env_arm.sh" ./ci/test_run_all.sh
Configurations
The test files (FILE_ENV) are constructed to test a wide range of
configurations, rather than a single pass/fail. This helps to catch build
failures and logic errors that present on platforms other than the ones the
author has tested.
Some builders use the dependency-generator in ./depends, rather than using
the system package manager to install build dependencies. This guarantees that
the tester is using the same versions as the release builds, which also use
./depends.
It is also possible to force a specific configuration without modifying the file. For example,
env -i HOME="$HOME" PATH="$PATH" USER="$USER" MAKEJOBS="-j1" FILE_ENV="./ci/test/00_setup_env_arm.sh" ./ci/test_run_all.sh
The files starting with 0n (n greater than 0) are the scripts that are run
in order.
Cache
In order to avoid rebuilding all dependencies for each build, the binaries are cached and reused when possible. Changes in the dependency-generator will trigger cache-invalidation and rebuilds as necessary.
Configuring a repository for CI
Primary repository
To configure the primary repository, follow these steps:
- Register with WarpBuild and purchase runners.
- Install the WarpBuild GitHub app against the GitHub organization.
- Enable organisation-level runners to be used in public repositories:
Org settings -> Actions -> Runner Groups -> Default -> Allow public repos
- Permit the following actions to run:
- actions/cache/restore@*
- actions/cache/save@*
- actions/github-script@*
- docker/setup-buildx-action@*
- warpbuilds/cache/restore@*
- warpbuilds/cache/save@*
Forked repositories
When used in a fork the CI will run on GitHub's free hosted runners by default. In this case, GitHub's cache size limitations may cause caches to be frequently evicted and missed, but the workflows will run (slowly).
It is also possible to use your own WarpBuild Runners in your own fork by replacing the references to bitcoin/bitcoin in ../.github/workflows/ci.yml with the name of your fork (e.g. your-org/bitcoin).
NB that WarpBuild Runners only work at an organisation level, therefore in order to use your own WarpBuild Runners, the fork must be within your own organisation.