44 lines
2.5 KiB
Markdown
44 lines
2.5 KiB
Markdown
# Manifest failed-fetch recovery
|
|
|
|
After a publication point passes validation, Panda keeps its direct VRPs, ASPAs,
|
|
router keys, child CA references, audit information and CCR contribution in the
|
|
state database. If a later fetch fails, it warns and uses that previously
|
|
validated result while it remains usable, following
|
|
[RFC 9286 section 6.6](https://www.rfc-editor.org/rfc/rfc9286.html#section-6.6).
|
|
This is automatic and independent of whether CCR output is enabled.
|
|
|
|
Results belong to a CA public key within its TAL namespace. Reuse additionally
|
|
requires the same CA certificate, publication locations, effective resources,
|
|
validation policy and TA resource constraints. A different certificate or policy
|
|
requires a fresh successful validation before a result can be reused.
|
|
|
|
The cache ends at the earliest relevant deadline: manifest nextUpdate, CRL
|
|
nextUpdate, CA/manifest EE validity, or validity of an accepted payload or child
|
|
certificate. Panda uses a conservative deadline for the whole instance. At the
|
|
boundary it stops reusing the result; repeated failures never extend this time.
|
|
A validation time preceding the cached validation time also prevents reuse.
|
|
|
|
When an instance fails, its cached descendants use cached results only: they do
|
|
not request another repository sync or validate newly downloaded objects. A
|
|
missing, expired or mismatched descendant cache stops that branch. Normal tree
|
|
limits still apply. Successful fresh parents can delete or revoke child CAs;
|
|
those children are not restored from an earlier cache. A successful empty result
|
|
supersedes the previous payloads.
|
|
|
|
The manifest anti-rollback history and result cache commit atomically. Reuse
|
|
never advances that history. Cache corruption, an inconsistent history, or a
|
|
storage/issuer failure cannot authorize reuse. Transport state is separate from
|
|
validated results, so a mutable repository view cannot silently replace cached
|
|
payloads or cached child certificates.
|
|
|
|
A cache hit preserves the fetch failure. `summary.json` includes
|
|
`failed_fetch_cached`, and the result remains `partial` with exit 3 when
|
|
`require-complete` is enabled. Publication to `publish-dir/latest` still requires
|
|
a complete success. Structured logs use `failed_fetch_cache_reused` with the
|
|
original verification time and effective deadline; publication-point audits use
|
|
`failed_fetch_cached` and terminal state `failed_cached`.
|
|
|
|
Keep the state database between invocations or daemon cycles to retain these
|
|
results. This does not require serializing RRDP objects to a filesystem mirror,
|
|
and does not change the current RRDP/rsync storage architecture.
|