OXYGENHUB

Releases 1

OxygenFlow 0.4.0 v0.4.0 · ✔ signed by Andy McCall · andymccall ·

Trust and audit
  • A Windows runner reports its Windows version (issue #83): as its kernel fact (Windows 10.0.26100, from RtlGetVersion), shown on the hub's runner page and in flow runner bench. Built and linted for Windows; not yet run there.
  • flow runner drain (issue #83): asks the home's running runner to drain, as SIGTERM does on Linux, through a drain.request file its loop reads: the way to stop a Windows runner without losing its job. A starting runner clears a stale request.
  • A Windows runner updates itself (issue #83, issue #85): flow runner update on Windows checks a PE build, renames flow.exe to flow.prev.exe and flow.new.exe into its place with MoveFileExW (retrying while a virus scanner holds a new file; a running program cannot rename its own file, so a copy of it, flow __rename, does), tells the running runner through an update.request file in its home (no SIGUSR1 there), and the runner leaves and exits 75 so a Task Scheduler task set to restart on failure starts the new build, which proves itself by reaching the hub. Tried in the Windows VM: install, leave, exit 75, restart, proven. A rollback runs the restored build and ends with it. Spec §11.5.3.
  • flow builds for Windows (issue #83, step 2 begun): cargo build --target x86_64-pc-windows-gnu gives a flow.exe that offers the WASM tier: the syscall tier, the guest helpers and the egress proxy are Linux's only (a Windows build says the syscall tier "runs only on Linux"), cache pruning by reads stays on Linux, and file modes, links and sizes go through a small portable module (modes are not kept on Windows). Its claims report free disk (GetDiskFreeSpaceExW); load and kernel are not measured there yet, and a Windows runner does not update itself. dist builds flow-windows-x86_64.exe too. Nothing changes on Linux or Android. Tried in the Windows VM on Earth: flow.exe tiers offers wasm, a local flow run of a 120-step WASM job passes, and registered as runner windows-1 (label windows) it ran andymccall/windows-runner-demo's job from the hub (run issue #1). Helpers start from the running binary's path on Windows (/proc/self/exe on Linux and Android).
  • The syscall tier's loopback reaches TCP (issue #73): with network "loopback", a job may open IPv4 and IPv6 sockets, which in its own network namespace reach only its lo, so a server it starts on 127.0.0.1 answers it (a conformance suite over an emulator's HTTP control port, which skipped every test on narvi-1). With network "isolated" sockets other than AF_UNIX are still refused.
  • Runner builds in releases (oxygenhub#322): a dist job (scripts/dist.sh, on a change to Cargo.toml or the script) builds flow stripped for Linux x86_64, aarch64 and riscv64 (glibc 2.28 and later) as flow-linux-ARCH, named by the architecture a runner reports, with SHA256SUMS: the files a release carries for runners that update themselves.
  • Runners ask the hub for their update (oxygenhub#322): once the hub has answered a claim, and every 15 minutes, a runner asks GET /api/v1/flow/runner/update; when the hub offers a build, it downloads it (kept in the home's updates/), refuses it unless its size and BLAKE3 are those the hub attests, and installs it as flow runner update does, leaving within 600 s, or for a dry run checks it and says what would happen. What it did goes back to the hub once per outcome, and a proof or a rollback is told at the next start. [runner.update] allow = false refuses and says so; a hub without runner updates (404) is simply asked again later.
  • The runner update protocol's types (oxygenhub#322): UpdateAnswer, UpdatePolicy, UpdateOffer and UpdateReport in flow-core, for GET/POST /api/v1/flow/runner/update: the policy that applies to a runner once every level is applied, and the release asset it should run.
  • flow runner update --from FILE (issue #85): the runner's side of self-updating runners (docs/jetstream.md §8.2). It checks a new build (this machine's target, --version, a tier it can run here), keeps the installed one as flow.prev, swaps the new one in with a single rename, and tells the running runner (SIGUSR1, its pid in runner.pid) to leave within --notice seconds (600 by default): jobs that fit finish, the rest are handed back with their checkpoints, and the unit starts the new build. The new build proves itself by getting an answer from the hub; four starts or ten minutes without one put flow.prev back. --dry-run changes nothing; [runner.update] allow = false in flow.toml refuses every update; updates.log in the home records each install, proof and rollback. Spec §11.5.3.
  • A local flow run of a WASM or syscall job copies the workspace whole: it copied into a directory it never made, so a file at the top of the workspace (a README) failed with No such file or directory.
  • Checkpoints: a handed-back job resumes (issue #77): checkpoint "/src/…" on a job names directories that hold its progress; a runner handing the job back packs and keeps them (POST …/checkpoint), and the next attempt's runner restores them before running the same exec, so it carries on rather than starting again. The receipt lists the checkpoint among its inputs. WASM and syscall tiers for now. Spec §11.5.2.
  • A leaving runner finishes what fits its notice (issue #76): a claim carries expected_ms (the median of the job's recent passing runs, from OxygenHub 0.9.4); runner::leave_within(reason, notice) finishes and reports a job whose expected rest fits the notice and hands back the others, and any still running when it is up. runner::leave is the same with no notice. Spec §11.5.2.
  • OxygenFlow's own CI writes a test report and coverage (issue #82): its test job runs under cargo-nextest and cargo-llvm-cov (both in the Rust image, issue #81), keeping a JUnit report (whether or not the tests pass) and LCOV coverage for the hub's Tests and Coverage tabs; .config/nextest.toml has the ci profile.
  • A runner that leaves hands its jobs back (issue #76): runner::leave(reason) (the runner as a library, as the Android app runs it) stops claiming, stops the jobs it holds, sends what they logged and hands them back with POST /api/v1/flow/jobs/{id}/release; the hub (OxygenHub #312) queues them again ahead of new work for another runner, and hands back the jobs of a runner silent for 3 minutes the same way. Spec §11.5.2.
  • A runner reads its load and kernel without /proc: sysinfo and uname, the same numbers; an Android app may not read /proc/loadavg or /proc/sys/kernel/osrelease, so the phone runner was refused, and logged, at every claim (oxygenhub-android#8).
  • Built on oxygen's main with #140 and #141: the runner's store puts objects in place where hard links are refused (Android, so the phone runner can clone), and the deps/oxygen pin conflict two replacements in one change left on main is settled with oxy resolve deps/oxygen.
  • The WASM tier (issue #75): runtime "wasm" runs WASI preview 1 modules with wasmtime 49 on any runner (flow tiers offers wasm everywhere): no rootfs, no network, the job's files at /src, its mounts at their targets, the memory limit enforced by wasmtime. exec names a module or a glob of them (target/wasm32-wasip1/debug/deps/*.wasm runs each test binary in turn); the receipt names wasmtime's version and every module's hash. The tier phones and browsers will run (docs/handover.md). Secrets and identities are not offered in it yet.
  • The runner as a library, for the phone (oxygenhub-android#8): flow is now a library and the command built on it, and the whole runner builds for Android (aarch64-linux-android); runner::serve_embedded and runner::stop run it inside an app and drain it. There the WASM tier runs modules in a thread rather than a child process (also with FLOW_WASM_IN_PROCESS), streaming their output from pipes, stopping them at the time limit or when the run is cancelled through wasmtime's epoch, and reporting the most memory they asked for. Two portability fixes on the way (the seccomp filter's BPF opcodes, for arm64 and x86_64, and an ioctl request type).
  • cargo-nextest in the Rust image (issue #81): for JUnit test reports beside cargo llvm-cov's coverage.

Assets