Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

ngclient: Be better with concurrent instances

Abierto
#2,836 7 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Estancado
Stack tecnológico
python
Área
backend

Línea de trabajo

Comienza leyendo el flujo de Updater de ngclient, especialmente refresh(), get_targetinfo() y download_target(), y rastrea dónde se leen o escriben los metadatos y los archivos target en la caché local. Define y documenta una política de concurrencia entre procesos para la creación de bloqueos, la espera, los bloqueos obsoletos y el alcance del bloqueo; el issue se considera terminado cuando haya un camino de implementación acordado para esas preguntas abiertas.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Users may run multiple updaters at the same time -- it's not useful but it can happen with longer dependency chains like https://github.com/sigstore/sigstore-python/issues/1403: model-signing uses sigstore-python which uses python-tuf...

Currently we don't handle the potential conflicts WRT reading and writing metadata and target files to local cache that result from concurrent updaters. This is especially an issue with windows where concurrent file access leads to issues more often but it can be problematic in linux too -- this is why currently we just document Updater as "should be a singleton".

Possible improvement: lockfile

I think it makes sense to not try to solve this for just a single process but multiple real processes running updaters (something I can easily imagine happening in real life). In that case I think a lock file per repository would be best we can do:

  • check for lock file before reading/writing
  • create lock file, read/write, remove lock file

The reason this hasn't been done is that lockfiles are a pain to do especially cross platform.

Some open questions:

  • what to do when a lock file exists -- log a warning and wait (for how long?)? I don't usually like when libraries wait for things but maybe this works? What if the lock file is stale (let's say hours old)?
  • manually handling lockfiles in a way that works on windows is painful... but we've also done a lot of work to avoid unnecessary dependencies in this project. Using a dependency for this is likely the smaller evil
  • when exactly do we lock?
    • locking for lifetime of Updater probably has annoying side effects and is not expected by users
    • locking for duration of refresh() and get_targetinfo() seems logical at least at first glance. Locking for duration of download_target() is probably less important but could be done
Possible improvement: global state

If we are not interested in multiple processes but just multiple threads with updaters, we could always add some global state tracking... It sounds quite unappealing but possible. I feel like I'd rather advice python-tuf users to use ngclient Updater as a "per-repository-singleton"?

CC @spencerschrock, let me know if you have thoughts

Lenguaje dominante
Python
Estrellas
1.7k
Forks
304
Merge medio
1 d 2 h
PR fusionados (30 d)
17

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de theupdateframework/python-tuf

Todos los issues de theupdateframework/python-tuf

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.