vendor/git.autistici.org/ai3/go-common/clientutil/backend.go

@@ -2,6 +2,7 @@ package clientutil
 
 import (
 	"context"
+	"net/http"
 )
 
 // BackendConfig specifies the configuration of a service backend.
@@ -13,9 +14,16 @@ import (
 // 'shard' parameter on their APIs.
 type BackendConfig struct {
 	URL       string           `yaml:"url"`
-	TLSConfig *TLSClientConfig `yaml:"tls_config"`
+	TLSConfig *TLSClientConfig `yaml:"tls"`
 	Sharded   bool             `yaml:"sharded"`
 	Debug     bool             `yaml:"debug"`
+
+	// Connection timeout (if unset, use default value).
+	ConnectTimeout string `yaml:"connect_timeout"`
+
+	// Maximum timeout for each individual request to this backend
+	// (if unset, use the Context timeout).
+	RequestMaxTimeout string `yaml:"request_max_timeout"`
 }
 
 // Backend is a runtime class that provides http Clients for use with
@@ -32,6 +40,13 @@ type Backend interface {
 	// *without* a shard ID on a sharded service is an error.
 	Call(context.Context, string, string, interface{}, interface{}) error
 
+	// Make a simple HTTP GET request to the remote backend,
+	// without parsing the response as JSON.
+	//
+	// Useful for streaming large responses, where the JSON
+	// encoding overhead is undesirable.
+	Get(context.Context, string, string) (*http.Response, error)
+
 	// Close all resources associated with the backend.
 	Close()
 }

vendor/git.autistici.org/ai3/go-common/clientutil/balancer.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"log"
 	"math/rand"
+	"mime"
 	"net/http"
 	"net/url"
 	"os"
@@ -16,7 +17,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/cenkalti/backoff"
+	"github.com/cenkalti/backoff/v4"
 )
 
 // Our own narrow logger interface.
@@ -60,10 +61,11 @@ func newExponentialBackOff() *backoff.ExponentialBackOff {
 type balancedBackend struct {
 	*backendTracker
 	*transportCache
-	baseURI  *url.URL
-	sharded  bool
-	resolver resolver
-	log      logger
+	baseURI           *url.URL
+	sharded           bool
+	resolver          resolver
+	log               logger
+	requestMaxTimeout time.Duration
 }
 
 func newBalancedBackend(config *BackendConfig, resolver resolver) (*balancedBackend, error) {
@@ -80,17 +82,36 @@ func newBalancedBackend(config *BackendConfig, resolver resolver) (*balancedBack
 		}
 	}
 
+	var connectTimeout time.Duration
+	if config.ConnectTimeout != "" {
+		t, err := time.ParseDuration(config.ConnectTimeout)
+		if err != nil {
+			return nil, fmt.Errorf("error in connect_timeout: %v", err)
+		}
+		connectTimeout = t
+	}
+
+	var reqTimeout time.Duration
+	if config.RequestMaxTimeout != "" {
+		t, err := time.ParseDuration(config.RequestMaxTimeout)
+		if err != nil {
+			return nil, fmt.Errorf("error in request_max_timeout: %v", err)
+		}
+		reqTimeout = t
+	}
+
 	var logger logger = &nilLogger{}
 	if config.Debug {
 		logger = log.New(os.Stderr, fmt.Sprintf("backend %s: ", u.Host), 0)
 	}
 	return &balancedBackend{
-		backendTracker: newBackendTracker(u.Host, resolver, logger),
-		transportCache: newTransportCache(tlsConfig),
-		sharded:        config.Sharded,
-		baseURI:        u,
-		resolver:       resolver,
-		log:            logger,
+		backendTracker:    newBackendTracker(u.Host, resolver, logger),
+		transportCache:    newTransportCache(tlsConfig, connectTimeout),
+		requestMaxTimeout: reqTimeout,
+		sharded:           config.Sharded,
+		baseURI:           u,
+		resolver:          resolver,
+		log:               logger,
 	}, nil
 }
 
@@ -98,40 +119,110 @@ func newBalancedBackend(config *BackendConfig, resolver resolver) (*balancedBack
 // with a JSON-encoded request body. It will attempt to decode the
 // response body as JSON.
 func (b *balancedBackend) Call(ctx context.Context, shard, path string, req, resp interface{}) error {
+	// Serialize the request body.
 	data, err := json.Marshal(req)
 	if err != nil {
 		return err
 	}
 
-	var tg targetGenerator = b.backendTracker
-	if b.sharded && shard != "" {
-		tg = newShardedGenerator(shard, b.baseURI.Host, b.resolver)
+	// Create the target sequence for this call. If there are multiple
+	// targets, reduce the timeout on each individual call accordingly to
+	// accomodate eventual failover.
+	seq, err := b.makeSequence(shard)
+	if err != nil {
+		return err
+	}
+	innerTimeout := 1 * time.Hour
+	if deadline, ok := ctx.Deadline(); ok {
+		innerTimeout = time.Until(deadline) / time.Duration(seq.Len())
+	}
+	if b.requestMaxTimeout > 0 && innerTimeout > b.requestMaxTimeout {
+		innerTimeout = b.requestMaxTimeout
 	}
-	seq := newSequence(tg)
-	b.log.Printf("%016x: initialized", seq.ID())
 
-	var httpResp *http.Response
-	err = backoff.Retry(func() error {
+	// Call the backends in the sequence until one succeeds, with an
+	// exponential backoff policy controlled by the outer Context.
+	return backoff.Retry(func() error {
 		req, rerr := b.newJSONRequest(path, shard, data)
 		if rerr != nil {
 			return rerr
 		}
-		httpResp, rerr = b.do(ctx, seq, req)
-		return rerr
+		innerCtx, cancel := context.WithTimeout(ctx, innerTimeout)
+		defer cancel()
+
+		// When do() returns successfully, we already know that the
+		// response had an HTTP status of 200.
+		httpResp, rerr := b.do(innerCtx, seq, req)
+		if rerr != nil {
+			return rerr
+		}
+		defer httpResp.Body.Close() // nolint
+
+		// Decode the response, unless the 'resp' output is nil.
+		if ct, _, _ := mime.ParseMediaType(httpResp.Header.Get("Content-Type")); ct != "application/json" {
+			return errors.New("not a JSON response")
+		}
+		if resp == nil {
+			return nil
+		}
+		return json.NewDecoder(httpResp.Body).Decode(resp)
 	}, backoff.WithContext(newExponentialBackOff(), ctx))
+}
+
+// Makes a generic HTTP GET request to the backend uri.
+func (b *balancedBackend) Get(ctx context.Context, shard, path string) (*http.Response, error) {
+	// Create the target sequence for this call. If there are multiple
+	// targets, reduce the timeout on each individual call accordingly to
+	// accomodate eventual failover.
+	seq, err := b.makeSequence(shard)
 	if err != nil {
-		return err
+		return nil, err
 	}
-	defer httpResp.Body.Close() // nolint
+	innerTimeout := 1 * time.Hour
+	if deadline, ok := ctx.Deadline(); ok {
+		innerTimeout = time.Until(deadline) / time.Duration(seq.Len())
+	}
+	if b.requestMaxTimeout > 0 && innerTimeout > b.requestMaxTimeout {
+		innerTimeout = b.requestMaxTimeout
+	}
+
+	req, err := http.NewRequest("GET", b.getURIForRequest(shard, path), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// Call the backends in the sequence until one succeeds, with an
+	// exponential backoff policy controlled by the outer Context.
+	var resp *http.Response
+	err = backoff.Retry(func() error {
+		innerCtx, cancel := context.WithTimeout(ctx, innerTimeout)
+		defer cancel()
+
+		// When do() returns successfully, we already know that the
+		// response had an HTTP status of 200.
+		var rerr error
+		resp, rerr = b.do(innerCtx, seq, req)
+		return rerr
+	}, backoff.WithContext(newExponentialBackOff(), ctx))
+	return resp, err
+}
 
-	if httpResp.Header.Get("Content-Type") != "application/json" {
-		return errors.New("not a JSON response")
+// Initialize a new target sequence.
+func (b *balancedBackend) makeSequence(shard string) (*sequence, error) {
+	var tg targetGenerator = b.backendTracker
+	if b.sharded {
+		if shard == "" {
+			return nil, fmt.Errorf("call without shard to sharded service %s", b.baseURI.String())
+		}
+		tg = newShardedGenerator(shard, b.baseURI.Host, b.resolver)
 	}
 
-	if resp == nil {
-		return nil
+	seq := newSequence(tg)
+	if seq.Len() == 0 {
+		return nil, errNoTargets
 	}
-	return json.NewDecoder(httpResp.Body).Decode(resp)
+	b.log.Printf("%016x: initialized", seq.ID())
+	return seq, nil
 }
 
 // Return the URI to be used for the request. This is used both in the
@@ -169,7 +260,7 @@ func (b *balancedBackend) do(ctx context.Context, seq *sequence, req *http.Reque
 	client := &http.Client{
 		Transport: b.transportCache.getTransport(target),
 	}
-	resp, err = client.Do(req.WithContext(ctx))
+	resp, err = client.Do(propagateDeadline(ctx, req))
 	if err == nil && resp.StatusCode != 200 {
 		err = remoteErrorFromResponse(resp)
 		if !isStatusTemporary(resp.StatusCode) {
@@ -183,6 +274,19 @@ func (b *balancedBackend) do(ctx context.Context, seq *sequence, req *http.Reque
 	return
 }
 
+const deadlineHeader = "X-RPC-Deadline"
+
+// Propagate context deadline to the server using a HTTP header.
+func propagateDeadline(ctx context.Context, req *http.Request) *http.Request {
+	req = req.WithContext(ctx)
+	if deadline, ok := ctx.Deadline(); ok {
+		req.Header.Set(deadlineHeader, strconv.FormatInt(deadline.UTC().UnixNano(), 10))
+	} else {
+		req.Header.Del(deadlineHeader)
+	}
+	return req
+}
+
 var errNoTargets = errors.New("no available backends")
 
 type targetGenerator interface {
@@ -210,6 +314,8 @@ func newSequence(tg targetGenerator) *sequence {
 
 func (s *sequence) ID() uint64 { return s.id }
 
+func (s *sequence) Len() int { return len(s.targets) }
+
 func (s *sequence) reloadTargets() {
 	targets := s.tg.getTargets()
 	if len(targets) > 0 {

vendor/git.autistici.org/ai3/go-common/clientutil/dialer.go

+// +build go1.9
+
+package clientutil
+
+import (
+	"context"
+	"net"
+	"time"
+)
+
+func netDialContext(addr string, connectTimeout time.Duration) func(context.Context, string, string) (net.Conn, error) {
+	dialer := &net.Dialer{
+		Timeout:   connectTimeout,
+		KeepAlive: 30 * time.Second,
+		DualStack: true,
+	}
+	return func(ctx context.Context, net string, _ string) (net.Conn, error) {
+		return dialer.DialContext(ctx, net, addr)
+	}
+}

vendor/git.autistici.org/ai3/go-common/clientutil/dialer_legacy.go

+// +build !go1.9
+
+package clientutil
+
+import (
+	"context"
+	"net"
+	"time"
+)
+
+// Go < 1.9 does not have net.DialContext, reimplement it in terms of
+// net.DialTimeout.
+func netDialContext(addr string, connectTimeout time.Duration) func(context.Context, string, string) (net.Conn, error) {
+	return func(ctx context.Context, net string, _ string) (net.Conn, error) {
+		if deadline, ok := ctx.Deadline(); ok {
+			ctxTimeout := time.Until(deadline)
+			if ctxTimeout < connectTimeout {
+				connectTimeout = ctxTimeout
+			}
+		}
+		return net.DialTimeout(network, addr, connectTimeout)
+	}
+}

vendor/git.autistici.org/ai3/go-common/clientutil/dns.go

@@ -40,6 +40,8 @@ type cacheDatum struct {
 	deadline time.Time
 }
 
+var dnsCacheTTL = 1 * time.Minute
+
 type dnsCache struct {
 	resolver resolver
 	sf       singleflight.Group
@@ -72,7 +74,7 @@ func (c *dnsCache) update(host string) []string {
 		c.mx.Lock()
 		c.cache[host] = cacheDatum{
 			addrs:    addrs,
-			deadline: time.Now().Add(60 * time.Second),
+			deadline: time.Now().Add(dnsCacheTTL),
 		}
 		c.mx.Unlock()
 		return addrs, nil

vendor/git.autistici.org/ai3/go-common/clientutil/tls.go

@@ -2,6 +2,7 @@ package clientutil
 
 import (
 	"crypto/tls"
+	"errors"
 
 	common "git.autistici.org/ai3/go-common"
 )
@@ -16,6 +17,10 @@ type TLSClientConfig struct {
 
 // TLSConfig returns a tls.Config object with the current configuration.
 func (c *TLSClientConfig) TLSConfig() (*tls.Config, error) {
+	if c.Cert == "" || c.Key == "" || c.CA == "" {
+		return nil, errors.New("incomplete client tls specification")
+	}
+
 	cert, err := tls.LoadX509KeyPair(c.Cert, c.Key)
 	if err != nil {
 		return nil, err
@@ -24,13 +29,11 @@ func (c *TLSClientConfig) TLSConfig() (*tls.Config, error) {
 		Certificates: []tls.Certificate{cert},
 	}
 
-	if c.CA != "" {
-		cas, err := common.LoadCA(c.CA)
-		if err != nil {
-			return nil, err
-		}
-		tlsConf.RootCAs = cas
+	cas, err := common.LoadCA(c.CA)
+	if err != nil {
+		return nil, err
 	}
+	tlsConf.RootCAs = cas
 	tlsConf.BuildNameToCertificate()
 
 	return tlsConf, nil

vendor/git.autistici.org/ai3/go-common/clientutil/transport.go

 package clientutil
 
 import (
-	"context"
 	"crypto/tls"
-	"net"
 	"net/http"
 	"sync"
 	"time"
+
+	"git.autistici.org/ai3/go-common/tracing"
 )
 
+var defaultConnectTimeout = 30 * time.Second
+
 // The transportCache is just a cache of http transports, each
 // connecting to a specific address.
 //
 // We use this to control the HTTP Host header and the TLS ServerName
 // independently of the target address.
 type transportCache struct {
-	tlsConfig *tls.Config
+	tlsConfig      *tls.Config
+	connectTimeout time.Duration
 
 	mx         sync.RWMutex
 	transports map[string]http.RoundTripper
 }
 
-func newTransportCache(tlsConfig *tls.Config) *transportCache {
+func newTransportCache(tlsConfig *tls.Config, connectTimeout time.Duration) *transportCache {
+	if connectTimeout == 0 {
+		connectTimeout = defaultConnectTimeout
+	}
 	return &transportCache{
-		tlsConfig:  tlsConfig,
-		transports: make(map[string]http.RoundTripper),
+		tlsConfig:      tlsConfig,
+		connectTimeout: connectTimeout,
+		transports:     make(map[string]http.RoundTripper),
 	}
 }
 
 func (m *transportCache) newTransport(addr string) http.RoundTripper {
-	return &http.Transport{
+	return tracing.WrapTransport(&http.Transport{
 		TLSClientConfig: m.tlsConfig,
-		DialContext: func(ctx context.Context, network, _ string) (net.Conn, error) {
-			return netDialContext(ctx, network, addr)
-		},
-	}
+		DialContext:     netDialContext(addr, m.connectTimeout),
+
+		// Parameters match those of net/http.DefaultTransport.
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	})
 }
 
 func (m *transportCache) getTransport(addr string) http.RoundTripper {
@@ -53,13 +64,3 @@ func (m *transportCache) getTransport(addr string) http.RoundTripper {
 
 	return t
 }
-
-// Go < 1.9 does not have net.DialContext, reimplement it in terms of
-// net.DialTimeout.
-func netDialContext(ctx context.Context, network, addr string) (net.Conn, error) {
-	timeout := 60 * time.Second // some arbitrary max timeout
-	if deadline, ok := ctx.Deadline(); ok {
-		timeout = time.Until(deadline)
-	}
-	return net.DialTimeout(network, addr, timeout)
-}

vendor/git.autistici.org/ai3/go-common/clientutil/watcher.go

+package clientutil
+
+import (
+	"fmt"
+	"sync"
+	"time"
+)
+
+var dnsWatcherInterval = 1 * time.Minute
+
+// A DNSWatcher monitors a DNS name for changes, constantly attempting
+// to resolve it every minute and notifying a channel when the list of
+// returned IP addresses changes. All addresses must be in host:port
+// format.
+type DNSWatcher struct {
+	hostport string
+	resolver resolver
+	addrs    []string
+	updateCh chan []string
+	stopCh   chan struct{}
+}
+
+// NewDNSWatcher creates a new DNSWatcher.
+func NewDNSWatcher(hostport string) (*DNSWatcher, error) {
+	return newDNSWatcherWithResolver(hostport, defaultResolver)
+}
+
+func newDNSWatcherWithResolver(hostport string, resolver resolver) (*DNSWatcher, error) {
+	// Resolve names once before returning. Return a fatal error
+	// when there are no results, as it may indicate a syntax
+	// error in hostport.
+	addrs := resolver.ResolveIP(hostport)
+	if len(addrs) == 0 {
+		return nil, fmt.Errorf("can't resolve %s", hostport)
+	}
+	w := &DNSWatcher{
+		hostport: hostport,
+		resolver: resolver,
+		addrs:    addrs,
+		updateCh: make(chan []string, 10),
+		stopCh:   make(chan struct{}),
+	}
+	w.updateCh <- addrs
+	go w.loop()
+	return w, nil
+}
+
+// Stop the watcher.
+func (w *DNSWatcher) Stop() {
+	close(w.stopCh)
+}
+
+// Changes returns a channel where the resolved addresses are sent
+// whenever they change.
+func (w *DNSWatcher) Changes() <-chan []string {
+	return w.updateCh
+}
+
+func (w *DNSWatcher) check() {
+	addrs := w.resolver.ResolveIP(w.hostport)
+	if len(addrs) > 0 && !addrListEqual(addrs, w.addrs) {
+		w.addrs = addrs
+		w.updateCh <- addrs
+	}
+}
+
+func (w *DNSWatcher) loop() {
+	defer close(w.updateCh)
+
+	tick := time.NewTicker(dnsWatcherInterval)
+	defer tick.Stop()
+
+	for {
+		select {
+		case <-tick.C:
+			w.check()
+		case <-w.stopCh:
+			return
+		}
+	}
+}
+
+type multiDNSUpdate struct {
+	hostport string
+	addrs    []string
+}
+
+// A MultiDNSWatcher watches multiple addresses for DNS changes. The
+// results are merged and returned as a list of addresses.
+type MultiDNSWatcher struct {
+	watchers []*DNSWatcher
+	addrmap  map[string][]string
+	faninCh  chan multiDNSUpdate
+	updateCh chan []string
+}
+
+// NewMultiDNSWatcher creates a new MultiDNSWatcher.
+func NewMultiDNSWatcher(hostports []string) (*MultiDNSWatcher, error) {
+	return newMultiDNSWatcherWithResolver(hostports, defaultResolver)
+}
+
+func newMultiDNSWatcherWithResolver(hostports []string, resolver resolver) (*MultiDNSWatcher, error) {
+	mw := &MultiDNSWatcher{
+		addrmap:  make(map[string][]string),
+		faninCh:  make(chan multiDNSUpdate, 10),
+		updateCh: make(chan []string, 10),
+	}
+
+	// All the MultiDNSWatcher does is multiplex updates from the
+	// individual DNSWatchers onto faninCh, then merging those
+	// updates with all the others and sending the result to
+	// updateCh.
+	go func() {
+		defer close(mw.updateCh)
+		for up := range mw.faninCh {
+			mw.addrmap[up.hostport] = up.addrs
+			mw.updateCh <- mw.allAddrs()
+		}
+	}()
+
+	var wg sync.WaitGroup
+	for _, hostport := range hostports {
+		w, err := newDNSWatcherWithResolver(hostport, resolver)
+		if err != nil {
+			return nil, err
+		}
+		mw.watchers = append(mw.watchers, w)
+
+		wg.Add(1)
+		go func(hostport string) {
+			for addrs := range w.Changes() {
+				mw.faninCh <- multiDNSUpdate{
+					hostport: hostport,
+					addrs:    addrs,
+				}
+			}
+			wg.Done()
+		}(hostport)
+	}
+
+	go func() {
+		wg.Wait()
+		close(mw.faninCh)
+	}()
+
+	return mw, nil
+}
+
+func (mw *MultiDNSWatcher) allAddrs() []string {
+	var out []string
+	for _, addrs := range mw.addrmap {
+		out = append(out, addrs...)
+	}
+	return out
+}
+
+// Stop the watcher.
+func (mw *MultiDNSWatcher) Stop() {
+	for _, w := range mw.watchers {
+		w.Stop()
+	}
+}
+
+// Changes returns a channel where the aggregate resolved addresses
+// are sent whenever they change.
+func (mw *MultiDNSWatcher) Changes() <-chan []string {
+	return mw.updateCh
+}
+
+func addrListEqual(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	tmp := make(map[string]struct{})
+	for _, aa := range a {
+		tmp[aa] = struct{}{}
+	}
+	for _, bb := range b {
+		if _, ok := tmp[bb]; !ok {
+			return false
+		}
+		delete(tmp, bb)
+	}
+	return len(tmp) == 0
+}

vendor/git.autistici.org/ai3/go-common/misc.go

@@ -2,6 +2,7 @@ package common
 
 import (
 	"crypto/x509"
+	"fmt"
 	"io/ioutil"
 )
 
@@ -12,6 +13,8 @@ func LoadCA(path string) (*x509.CertPool, error) {
 		return nil, err
 	}
 	cas := x509.NewCertPool()
-	cas.AppendCertsFromPEM(data)
+	if !cas.AppendCertsFromPEM(data) {
+		return nil, fmt.Errorf("no certificates could be parsed in %s", path)
+	}
 	return cas, nil
 }

vendor/git.autistici.org/ai3/go-common/renovate.json

+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ]
+}

vendor/git.autistici.org/ai3/go-common/serverutil/http.go

 package serverutil
 
 import (
+	"compress/gzip"
 	"context"
 	"crypto/tls"
+	"fmt"
 	"io"
 	"log"
 	"net"
 	"net/http"
-	"net/http/pprof"
+	_ "net/http/pprof"
 	"os"
 	"os/signal"
+	"strconv"
 	"syscall"
 	"time"
 
-	"github.com/coreos/go-systemd/daemon"
+	"git.autistici.org/ai3/go-common/tracing"
+	"github.com/NYTimes/gziphandler"
+	"github.com/coreos/go-systemd/v22/daemon"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 )
 
-var gracefulShutdownTimeout = 3 * time.Second
+var (
+	gracefulShutdownTimeout = 3 * time.Second
+
+	gzipLevel        = gzip.BestSpeed
+	gzipMinSize      = 1300
+	gzipContentTypes = []string{
+		"application/json",
+		"application/javascript",
+		"text/html",
+		"text/plain",
+		"text/css",
+	}
+)
 
 // ServerConfig stores common HTTP/HTTPS server configuration parameters.
 type ServerConfig struct {
 	TLS                 *TLSServerConfig `yaml:"tls"`
 	MaxInflightRequests int              `yaml:"max_inflight_requests"`
+	RequestTimeoutSecs  int              `yaml:"request_timeout"`
 	TrustedForwarders   []string         `yaml:"trusted_forwarders"`
+
+	// TODO: switch do disable_compression (flip default) later.
+	EnableCompression bool `yaml:"enable_compression"`
 }
 
-func (config *ServerConfig) buildHTTPServer(h http.Handler) (*http.Server, error) {
+func (config *ServerConfig) buildHTTPHandler(h http.Handler) (http.Handler, *tls.Config, error) {
 	var tlsConfig *tls.Config
 	var err error
 	if config != nil {
 		if config.TLS != nil {
 			tlsConfig, err = config.TLS.TLSConfig()
 			if err != nil {
-				return nil, err
+				return nil, nil, err
 			}
 			h, err = config.TLS.TLSAuthWrapper(h)
 			if err != nil {
-				return nil, err
+				return nil, nil, err
 			}
 		}
 
@@ -47,7 +68,7 @@ func (config *ServerConfig) buildHTTPServer(h http.Handler) (*http.Server, error
 		if len(config.TrustedForwarders) > 0 {
 			h, err = newProxyHeaders(h, config.TrustedForwarders)
 			if err != nil {
-				return nil, err
+				return nil, nil, err
 			}
 		}
 
@@ -56,18 +77,68 @@ func (config *ServerConfig) buildHTTPServer(h http.Handler) (*http.Server, error
 		if config.MaxInflightRequests > 0 {
 			h = newLoadSheddingWrapper(config.MaxInflightRequests, h)
 		}
+
+		// Wrap the handler with a TimeoutHandler if 'request_timeout'
+		// is set.
+		if config.RequestTimeoutSecs > 0 {
+			h = http.TimeoutHandler(h, time.Duration(config.RequestTimeoutSecs)*time.Second, "")
+		}
+	}
+
+	// Add all the default handlers (health, monitoring, etc).
+	h = addDefaultHandlers(h)
+
+	// Optionally enable compression.
+	if config != nil && config.EnableCompression {
+		gzwrap, err := gziphandler.GzipHandlerWithOpts(
+			gziphandler.CompressionLevel(gzipLevel),
+			gziphandler.MinSize(gzipMinSize),
+			gziphandler.ContentTypes(gzipContentTypes),
+		)
+		if err != nil {
+			return nil, nil, err
+		}
+		h = gzwrap(h)
+	}
+
+	return h, tlsConfig, nil
+}
+
+func buildListener(addr string, tlsConfig *tls.Config) (net.Listener, error) {
+	// Create the net.Listener first, so we can detect
+	// initialization-time errors safely.
+	l, err := net.Listen("tcp", addr)
+	if err != nil {
+		return nil, err
+	}
+	if tlsConfig != nil {
+		l = tls.NewListener(l, tlsConfig)
+	}
+	return l, nil
+}
+
+func buildServer(h http.Handler, config *ServerConfig, addr string) (*http.Server, error) {
+	// Wrap with tracing handler (exclude metrics and other
+	// debugging endpoints).
+	h = tracing.WrapHandler(h, guessEndpointName(addr))
+
+	// Create the top-level HTTP handler with all our additions.
+	hh, tlsConfig, err := config.buildHTTPHandler(h)
+	if err != nil {
+		return nil, err
 	}
 
 	// These are not meant to be external-facing servers, so we
 	// can be generous with the timeouts to keep the number of
 	// reconnections low.
-	return &http.Server{
-		Handler:      defaultHandler(h),
-		ReadTimeout:  30 * time.Second,
-		WriteTimeout: 30 * time.Second,
-		IdleTimeout:  600 * time.Second,
-		TLSConfig:    tlsConfig,
-	}, nil
+	srv := &http.Server{
+		Handler:           hh,
+		ReadHeaderTimeout: 30 * time.Second,
+		IdleTimeout:       600 * time.Second,
+		TLSConfig:         tlsConfig,
+	}
+
+	return srv, nil
 }
 
 // Serve HTTP(S) content on the specified address. If config.TLS is
@@ -77,21 +148,15 @@ func (config *ServerConfig) buildHTTPServer(h http.Handler) (*http.Server, error
 // the listener, otherwise it will handle graceful termination on
 // SIGINT or SIGTERM and return nil.
 func Serve(h http.Handler, config *ServerConfig, addr string) error {
-	// Create the HTTP server.
-	srv, err := config.buildHTTPServer(h)
+	srv, err := buildServer(h, config, addr)
 	if err != nil {
 		return err
 	}
 
-	// Create the net.Listener first, so we can detect
-	// initialization-time errors safely.
-	l, err := net.Listen("tcp", addr)
+	l, err := buildListener(addr, srv.TLSConfig)
 	if err != nil {
 		return err
 	}
-	if srv.TLSConfig != nil {
-		l = tls.NewListener(l, srv.TLSConfig)
-	}
 
 	// Install a signal handler for gentle process termination.
 	done := make(chan struct{})
@@ -115,8 +180,9 @@ func Serve(h http.Handler, config *ServerConfig, addr string) error {
 
 	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
 
-	// Notify systemd that we are ready to serve.
-	daemon.SdNotify(false, "READY=1")
+	// Notify systemd that we are ready to serve. This call is
+	// allowed to fail (in case there is no systemd).
+	daemon.SdNotify(false, "READY=1") // nolint
 
 	err = srv.Serve(l)
 	if err != http.ErrServerClosed {
@@ -127,29 +193,94 @@ func Serve(h http.Handler, config *ServerConfig, addr string) error {
 	return nil
 }
 
-func defaultHandler(h http.Handler) http.Handler {
+// ServeWithContext operates like Serve but with a controlling Context
+// that can be used to stop the HTTP server.
+func ServeWithContext(ctx context.Context, h http.Handler, config *ServerConfig, addr string) error {
+	srv, err := buildServer(h, config, addr)
+	if err != nil {
+		return err
+	}
+
+	l, err := buildListener(addr, srv.TLSConfig)
+	if err != nil {
+		return err
+	}
+
+	go func() {
+		<-ctx.Done()
+
+		sctx, cancel := context.WithTimeout(context.Background(), gracefulShutdownTimeout)
+		srv.Shutdown(sctx) // nolint: errcheck
+		srv.Close()
+		cancel()
+	}()
+
+	daemon.SdNotify(false, "READY=1") // nolint
+
+	err = srv.Serve(l)
+	if err == http.ErrServerClosed {
+		err = nil
+	}
+
+	return err
+}
+
+func addDefaultHandlers(h http.Handler) http.Handler {
 	root := http.NewServeMux()
 
 	// Add an endpoint for HTTP health checking probes.
 	root.Handle("/health", http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		io.WriteString(w, "OK")
+		io.WriteString(w, "OK") // nolint
 	}))
 
 	// Add an endpoint to serve Prometheus metrics.
 	root.Handle("/metrics", promhttp.Handler())
 
-	// Add the net/http/pprof debug handlers.
-	root.Handle("/debug/pprof/", pprof.Handler(""))
+	// Let the default net/http handler deal with /debug/
+	// URLs. Packages such as net/http/pprof register their
+	// handlers there in ways that aren't reproducible.
+	root.Handle("/debug/", http.DefaultServeMux)
 
 	// Forward everything else to the main handler, adding
 	// Prometheus instrumentation (requests to /metrics and
 	// /health are not included).
 	root.Handle("/", promhttp.InstrumentHandlerInFlight(inFlightRequests,
-		promhttp.InstrumentHandlerCounter(totalRequests, h)))
+		promhttp.InstrumentHandlerCounter(totalRequests,
+			propagateDeadline(h))))
 
 	return root
 }
 
+const deadlineHeader = "X-RPC-Deadline"
+
+// Read an eventual deadline from the HTTP request, and set it as the
+// deadline of the request context.
+func propagateDeadline(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if hdr := req.Header.Get(deadlineHeader); hdr != "" {
+			if deadlineNano, err := strconv.ParseInt(hdr, 10, 64); err == nil {
+				deadline := time.Unix(0, deadlineNano)
+				ctx, cancel := context.WithDeadline(req.Context(), deadline)
+				defer cancel()
+				req = req.WithContext(ctx)
+			}
+		}
+		h.ServeHTTP(w, req)
+	})
+}
+
+func guessEndpointName(addr string) string {
+	_, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return addr
+	}
+	host, err := os.Hostname()
+	if err != nil {
+		return addr
+	}
+	return fmt.Sprintf("%s:%s", host, port)
+}
+
 // HTTP-related metrics.
 var (
 	// Since we instrument the root HTTP handler, we don't really

vendor/git.autistici.org/ai3/go-common/serverutil/json.go

@@ -3,6 +3,7 @@ package serverutil
 import (
 	"encoding/json"
 	"log"
+	"mime"
 	"net/http"
 )
 
@@ -14,7 +15,7 @@ func DecodeJSONRequest(w http.ResponseWriter, r *http.Request, obj interface{})
 		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		return false
 	}
-	if r.Header.Get("Content-Type") != "application/json" {
+	if ct, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type")); ct != "application/json" {
 		http.Error(w, "Need JSON request", http.StatusBadRequest)
 		return false
 	}
@@ -29,19 +30,15 @@ func DecodeJSONRequest(w http.ResponseWriter, r *http.Request, obj interface{})
 
 // EncodeJSONResponse writes an application/json response to w.
 func EncodeJSONResponse(w http.ResponseWriter, obj interface{}) {
-	data, err := json.Marshal(obj)
-	if err != nil {
-		log.Printf("JSON serialization error: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("Pragma", "no-cache")
 	w.Header().Set("Cache-Control", "no-store")
 	w.Header().Set("Expires", "-1")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
-	if _, err = w.Write(data); err != nil {
-		log.Printf("error writing response: %v", err)
+
+	err := json.NewEncoder(w).Encode(obj)
+	if err != nil {
+		log.Printf("error writing JSON response: %v", err)
+		// Too late to return an error to the client now.
 	}
 }

vendor/git.autistici.org/ai3/go-common/serverutil/proxy_headers.go

@@ -4,13 +4,12 @@ import (
 	"fmt"
 	"net"
 	"net/http"
-
-	"github.com/gorilla/handlers"
+	"strings"
 )
 
 type proxyHeaders struct {
-	wrap, phWrap http.Handler
-	forwarders   []net.IPNet
+	wrap       http.Handler
+	forwarders []net.IPNet
 }
 
 func newProxyHeaders(h http.Handler, trustedForwarders []string) (http.Handler, error) {
@@ -20,7 +19,6 @@ func newProxyHeaders(h http.Handler, trustedForwarders []string) (http.Handler,
 	}
 	return &proxyHeaders{
 		wrap:       h,
-		phWrap:     handlers.ProxyHeaders(h),
 		forwarders: f,
 	}, nil
 }
@@ -32,12 +30,28 @@ func (p *proxyHeaders) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 	ip := net.ParseIP(host)
 	if ip != nil && matchIPNetList(ip, p.forwarders) {
-		p.phWrap.ServeHTTP(w, r)
-		return
+		if fwd := getForwardedIP(r); fwd != "" {
+			r.RemoteAddr = fwd
+		}
 	}
 	p.wrap.ServeHTTP(w, r)
 }
 
+// Parse the X-Real-IP or X-Forwarded-For headers, if present, to get
+// the original client IP.
+func getForwardedIP(r *http.Request) string {
+	if s := r.Header.Get("X-Real-IP"); s != "" {
+		return s
+	}
+	if s := r.Header.Get("X-Forwarded-For"); s != "" {
+		if n := strings.IndexByte(s, ','); n > 0 {
+			s = s[:n]
+		}
+		return s
+	}
+	return ""
+}
+
 func fullMask(ip net.IP) net.IPMask {
 	if ip.To4() == nil {
 		return net.CIDRMask(128, 128)

vendor/git.autistici.org/ai3/go-common/serverutil/tls.go

@@ -2,15 +2,20 @@ package serverutil
 
 import (
 	"crypto/tls"
+	"errors"
+	"fmt"
+	"log"
 	"net/http"
 	"regexp"
+	"strings"
 
 	common "git.autistici.org/ai3/go-common"
 )
 
 // TLSAuthACL describes a single access control entry. Path and
 // CommonName are anchored regular expressions (they must match the
-// entire string).
+// entire string). The first path to match in a list of ACLs will
+// identify the ACL to be applied.
 type TLSAuthACL struct {
 	Path       string `yaml:"path"`
 	CommonName string `yaml:"cn"`
@@ -28,10 +33,11 @@ func (p *TLSAuthACL) compile() error {
 	return err
 }
 
-func (p *TLSAuthACL) match(req *http.Request) bool {
-	if !p.pathRx.MatchString(req.URL.Path) {
-		return false
-	}
+func (p *TLSAuthACL) matchPath(req *http.Request) bool {
+	return p.pathRx.MatchString(req.URL.Path)
+}
+
+func (p *TLSAuthACL) matchCN(req *http.Request) bool {
 	for _, cert := range req.TLS.PeerCertificates {
 		if p.cnRx.MatchString(cert.Subject.CommonName) {
 			return true
@@ -40,6 +46,31 @@ func (p *TLSAuthACL) match(req *http.Request) bool {
 	return false
 }
 
+// TLSAuthACLListFlag is a convenience type that allows callers to use
+// the 'flag' package to specify a list of TLSAuthACL objects. It
+// implements the flag.Value interface.
+type TLSAuthACLListFlag []*TLSAuthACL
+
+func (l TLSAuthACLListFlag) String() string {
+	var out []string
+	for _, acl := range l {
+		out = append(out, fmt.Sprintf("%s:%s", acl.Path, acl.CommonName))
+	}
+	return strings.Join(out, ",")
+}
+
+func (l *TLSAuthACLListFlag) Set(value string) error {
+	parts := strings.SplitN(value, ":", 2)
+	if len(parts) != 2 {
+		return errors.New("bad acl format")
+	}
+	*l = append(*l, &TLSAuthACL{
+		Path:       parts[0],
+		CommonName: parts[1],
+	})
+	return nil
+}
+
 // TLSAuthConfig stores access control lists for TLS authentication. Access
 // control lists are matched against the request path and the
 // CommonName component of the peer certificate subject.
@@ -52,9 +83,13 @@ func (c *TLSAuthConfig) match(req *http.Request) bool {
 	if c == nil || len(c.Allow) == 0 {
 		return true
 	}
+
 	for _, acl := range c.Allow {
-		if acl.match(req) {
-			return true
+		if acl.matchPath(req) {
+			if acl.matchCN(req) {
+				return true
+			}
+			break
 		}
 	}
 	return false
@@ -81,21 +116,27 @@ func (c *TLSServerConfig) TLSConfig() (*tls.Config, error) {
 		return nil, err
 	}
 
-	cas, err := common.LoadCA(c.CA)
-	if err != nil {
-		return nil, err
-	}
-
 	// Set some TLS-level parameters (cipher-related), assuming
 	// we're using EC keys.
 	tlsConf := &tls.Config{
 		Certificates:             []tls.Certificate{cert},
-		ClientAuth:               tls.RequireAndVerifyClientCert,
-		ClientCAs:                cas,
 		CipherSuites:             serverCiphers,
 		MinVersion:               tls.VersionTLS12,
 		PreferServerCipherSuites: true,
+		NextProtos:               []string{"h2", "http/1.1"},
+	}
+
+	// Require client certificates if a CA is specified.
+	if c.CA != "" {
+		cas, err := common.LoadCA(c.CA)
+		if err != nil {
+			return nil, err
+		}
+
+		tlsConf.ClientAuth = tls.RequireAndVerifyClientCert
+		tlsConf.ClientCAs = cas
 	}
+
 	tlsConf.BuildNameToCertificate()
 
 	return tlsConf, nil
@@ -119,6 +160,13 @@ func (c *TLSServerConfig) TLSAuthWrapper(h http.Handler) (http.Handler, error) {
 			h.ServeHTTP(w, r)
 			return
 		}
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+
+		// Log the failed access, useful for debugging.
+		var tlsmsg string
+		if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
+			tlsmsg = fmt.Sprintf("TLS client '%s' at", r.TLS.PeerCertificates[0].Subject.CommonName)
+		}
+		log.Printf("unauthorized access to %s from %s%s", r.URL.Path, tlsmsg, r.RemoteAddr)
+		http.Error(w, "Forbidden", http.StatusForbidden)
 	}), nil
 }

vendor/git.autistici.org/ai3/go-common/tracing/tracing.go

+package tracing
+
+import (
+	"encoding/json"
+	"errors"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+
+	othttp "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	b3 "go.opentelemetry.io/contrib/propagators/b3"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/exporters/zipkin"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	"go.opentelemetry.io/otel/sdk/trace"
+	semconv "go.opentelemetry.io/otel/semconv/v1.12.0"
+)
+
+var (
+	// Enabled reports whether tracing is globally enabled or not.
+	Enabled bool
+
+	initOnce sync.Once
+)
+
+const globalTracingConfigPath = "/etc/tracing/client.conf"
+
+type tracingConfig struct {
+	ReportURL string `json:"report_url"`
+	Sample    string `json:"sample"`
+}
+
+// Read the global tracing configuration file. Its location is
+// hardcoded, but it can be overriden using the TRACING_CONFIG
+// environment variable.
+func readTracingConfig() (*tracingConfig, error) {
+	// Read and decode configuration.
+	cfgPath := globalTracingConfigPath
+	if s := os.Getenv("TRACING_CONFIG"); s != "" {
+		cfgPath = s
+	}
+	data, err := ioutil.ReadFile(cfgPath)
+	if err != nil {
+		return nil, err
+	}
+
+	var config tracingConfig
+	if err := json.Unmarshal(data, &config); err != nil {
+		log.Printf("warning: error in tracing configuration: %v, tracing disabled", err)
+		return nil, err
+	}
+
+	if config.ReportURL == "" {
+		log.Printf("warning: tracing configuration contains no report_url, tracing disabled")
+		return nil, errors.New("no report_url")
+	}
+
+	return &config, nil
+}
+
+// Compute the service name for Zipkin: this is usually the program
+// name (without path), but it can be overriden by the TRACING_SERVICE
+// environment variable.
+func getServiceName() string {
+	if s := os.Getenv("TRACING_SERVICE"); s != "" {
+		return s
+	}
+	if s, err := os.Executable(); err == nil {
+		return filepath.Base(s)
+	}
+	return "unknown_service"
+}
+
+func defaultResource(serviceName string) *resource.Resource {
+	attrs := []attribute.KeyValue{
+		semconv.ServiceNameKey.String(serviceName),
+	}
+
+	if s, err := os.Hostname(); err == nil {
+		attrs = append(attrs, semconv.HostNameKey.String(s))
+	}
+	if s := os.Getenv("FLOAT_SERVICE"); s != "" {
+		attrs = append(attrs, attribute.Key("float.service").String(s))
+	}
+	if s := os.Getenv("FLOAT_CONTAINER_NAME"); s != "" {
+		attrs = append(attrs, semconv.ContainerNameKey.String(s))
+	}
+	if s := os.Getenv("FLOAT_CONTAINER_IMAGE"); s != "" {
+		imageName := s
+		tag := "latest"
+		if strings.Contains(imageName, ":") {
+			parts := strings.SplitN(imageName, ":", 2)
+			imageName = parts[0]
+			tag = parts[1]
+		}
+
+		attrs = append(attrs, semconv.ContainerImageNameKey.String(imageName))
+		attrs = append(attrs, semconv.ContainerImageTagKey.String(tag))
+	}
+
+	r, _ := resource.Merge(
+		resource.Default(),
+		resource.NewWithAttributes(semconv.SchemaURL, attrs...),
+	)
+	return r
+}
+
+// Initialize tracing. Tracing will be enabled if the system-wide
+// tracing configuration file is present and valid. Explicitly set
+// TRACING_ENABLE=0 in the environment to disable tracing.
+//
+// We need to check the configuration as soon as possible, because
+// it's likely that client transports are created before HTTP servers,
+// and we need to wrap them with opencensus at creation time.
+func initTracing(serviceName string) {
+	initOnce.Do(func() {
+		// Kill switch from environment.
+		if s := os.Getenv("TRACING_ENABLE"); s == "0" {
+			return
+		}
+
+		config, err := readTracingConfig()
+		if err != nil {
+			return
+		}
+
+		ze, err := zipkin.New(config.ReportURL)
+		if err != nil {
+			log.Printf("error creating Zipkin exporter: %v", err)
+			return
+		}
+
+		// The sampling policy only applies to incoming requests for
+		// which tracing is not already enabled: in this case, we
+		// always pass-through.
+		var sampler trace.Sampler
+		switch config.Sample {
+		case "", "always":
+			sampler = trace.AlwaysSample()
+		case "never":
+			sampler = trace.NeverSample()
+		default:
+			frac, err := strconv.ParseFloat(config.Sample, 64)
+			if err != nil {
+				log.Printf("warning: error in tracing configuration: sample: %v, tracing disabled", err)
+				return
+			}
+			sampler = trace.TraceIDRatioBased(frac)
+		}
+
+		tp := trace.NewTracerProvider(
+			trace.WithSampler(trace.ParentBased(sampler)),
+			trace.WithBatcher(ze),
+			trace.WithResource(defaultResource(serviceName)),
+		)
+
+		otel.SetTracerProvider(tp)
+
+		otel.SetTextMapPropagator(
+			propagation.NewCompositeTextMapPropagator(
+				propagation.TraceContext{},
+				propagation.Baggage{},
+				b3.New()))
+
+		log.Printf("tracing enabled (report_url %s)", config.ReportURL)
+
+		Enabled = true
+	})
+}
+
+// Init tracing support, if not using WrapHandler.
+func Init() {
+	initTracing(getServiceName())
+}
+
+// WrapTransport optionally wraps a http.RoundTripper with OpenCensus
+// tracing functionality, if it is globally enabled.
+//
+// Must call Init() first.
+func WrapTransport(t http.RoundTripper) http.RoundTripper {
+	if Enabled {
+		t = othttp.NewTransport(t)
+	}
+	return t
+}
+
+// WrapHandler wraps a http.Handler with OpenCensus tracing
+// functionality, if globally enabled. Automatically calls Init().
+func WrapHandler(h http.Handler, endpointAddr string) http.Handler {
+	serviceName := getServiceName()
+	initTracing(serviceName)
+	if !Enabled {
+		return h
+	}
+
+	// Format span names with the request URL path.
+	return othttp.NewHandler(
+		h, serviceName,
+		othttp.WithSpanNameFormatter(func(op string, r *http.Request) string {
+			return r.URL.Path
+		}),
+	)
+}

vendor/git.autistici.org/ai3/tools/replds/.gitlab-ci.yml

+include:
+  - "https://git.autistici.org/pipelines/debian/raw/master/common.yml"
+  - "https://git.autistici.org/pipelines/images/test/golang/raw/master/ci.yml"

vendor/git.autistici.org/ai3/tools/replds/LICENSE

+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

vendor/git.autistici.org/ai3/replds/README.md → vendor/git.autistici.org/ai3/tools/replds/README.md

@@ -122,3 +122,15 @@ directory* to run the repository tools on, and the final workflow is:
 * run the metadata-generation tools on the staging dir;
 * synchronize the data back to replds using the *sync* command.
 
+## Usage
+
+The Debian package comes with a
+[replds-instance-create](debian/replds-instance-create) script that
+can be used to set up multiple replds instances. For an instance named
+*foo*, the script will setup the *replds@foo* systemd service, and it
+will create the *replds-foo* user and group. Add users that need to
+read the repository files to that group. The configuration will be
+read from */etc/replds/foo.yml*.
+
+Note that files created by the daemon will be world-readable by
+default. Set the process umask if you wish to restrict this further.

vendor/git.autistici.org/ai3/replds/fs.go → vendor/git.autistici.org/ai3/tools/replds/fs.go

@@ -20,9 +20,9 @@ func newFS(dir string) *FS {
 
 // getAllNodes scans the root directory and returns a list of
 // Nodes. All errors are ignored.
-func (f *FS) getAllNodes() []Node {
-	var nodes []Node
-	dirLen := len(f.dir)
+func (f *FS) getAllNodes() []*Node {
+	var nodes []*Node
+	dirOffset := len(f.dir) + 1
 	if err := filepath.Walk(f.dir, func(path string, info os.FileInfo, err error) error {
 		// Ignore errors.
 		if err != nil {
@@ -32,8 +32,8 @@ func (f *FS) getAllNodes() []Node {
 		if !info.Mode().IsRegular() {
 			return nil
 		}
-		nodes = append(nodes, Node{
-			Path:      path[dirLen+1:],
+		nodes = append(nodes, &Node{
+			Path:      path[dirOffset:],
 			Timestamp: info.ModTime(),
 		})
 		return nil
@@ -44,7 +44,7 @@ func (f *FS) getAllNodes() []Node {
 }
 
 // setNode applies a Node to the underlying filesystem.
-func (f *FS) setNode(node Node) error {
+func (f *FS) setNode(node *Node) error {
 	path := filepath.Join(f.dir, node.Path)
 
 	// Tombstone? Then delete the file (ignore errors).
@@ -55,7 +55,7 @@ func (f *FS) setNode(node Node) error {
 	// Create parent directory if it does not exist.
 	dir := filepath.Dir(path)
 	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		if err = os.MkdirAll(dir, 0700); err != nil {
+		if err = os.MkdirAll(dir, 0755); err != nil {
 			return err
 		}
 	}
@@ -81,7 +81,7 @@ func writeFile(path string, data []byte) error {
 	err := os.Rename(tmp, path)
 	if err != nil {
 		// Clean up if something went wrong.
-		os.Remove(tmp)
+		os.Remove(tmp) // nolint
 	}
 	return err
 }