Skip to content

verifier_tools/verify: Factor shared HTTP client and add checkpoint t… - #32

Merged
billy-lau merged 1 commit into
android:mainfrom
billy-lau:verifier/httpclient-timeout
Sep 23, 2026
Merged

billy-lau merged 1 commit into
android:mainfrom
billy-lau:verifier/httpclient-timeout

Conversation

@billy-lau

Copy link
Copy Markdown
Member

…imeouts/context

Previously, getSignedCheckpoint in internal/checkpoint/checkpoint.go called http.Get directly, using http.DefaultClient (Timeout: 0) without caller context.Context propagation. If a remote server stalled or dropped packets while fetching checkpoint or checkpoint.txt, the verifier could block indefinitely.

  1. Factor the tuned http.Transport configuration (DialContext with 10s timeout, ForceAttemptHTTP2: true, TLSHandshakeTimeout: 10s, and ResponseHeaderTimeout: 30s) into internal/httpclient.New(timeout) and share it across internal/tiles (5m total timeout) and internal/checkpoint (30s total timeout).
  2. Add getSignedCheckpointContext and FromURLWithPathContext in internal/checkpoint using http.NewRequestWithContext and %w error wrapping to preserve timeout and cancellation error chains.
  3. Wire signal.NotifyContext (SIGINT/SIGTERM) in cmd/verifier/verifier.go across both --fetch_entries and --payload_path verification paths so signal cancellation propagates to all checkpoint fetches.

Test:

  • cd verifier_tools/verify && gofmt -l . && go test -race -v ./...
  • Added TestNew in internal/httpclient/httpclient_test.go and TestHTTPClientTimeoutAndContextCancellation in internal/checkpoint/checkpoint_test.go.

Change-Id: Ibcadd345cf22a38083b9f7fb86c5379c8681fb59

…imeouts/context

Previously, `getSignedCheckpoint` in `internal/checkpoint/checkpoint.go` called
`http.Get` directly, using `http.DefaultClient` (`Timeout: 0`) without caller
`context.Context` propagation. If a remote server stalled or dropped packets
while fetching `checkpoint` or `checkpoint.txt`, the verifier could block
indefinitely.

1. Factor the tuned `http.Transport` configuration (`DialContext` with `10s`
   timeout, `ForceAttemptHTTP2: true`, `TLSHandshakeTimeout: 10s`, and
   `ResponseHeaderTimeout: 30s`) into `internal/httpclient.New(timeout)` and
   share it across `internal/tiles` (`5m` total timeout) and
   `internal/checkpoint` (`30s` total timeout).
2. Add `getSignedCheckpointContext` and `FromURLWithPathContext` in
   `internal/checkpoint` using `http.NewRequestWithContext` and `%w` error
   wrapping to preserve timeout and cancellation error chains.
3. Wire `signal.NotifyContext` (`SIGINT`/`SIGTERM`) in `cmd/verifier/verifier.go`
   across both `--fetch_entries` and `--payload_path` verification paths so
   signal cancellation propagates to all checkpoint fetches.

Test:
- `cd verifier_tools/verify && gofmt -l . && go test -race -v ./...`
- Added `TestNew` in `internal/httpclient/httpclient_test.go` and
  `TestHTTPClientTimeoutAndContextCancellation` in
  `internal/checkpoint/checkpoint_test.go`.

Change-Id: Ibcadd345cf22a38083b9f7fb86c5379c8681fb59
@billy-lau
billy-lau merged commit 108ab44 into android:main Sep 23, 2026
7 checks passed
@billy-lau
billy-lau deleted the verifier/httpclient-timeout branch September 25, 2026 02:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant