An automated review of #1189 flagged an unbounded await in the reviewed apply path. In crates/registry-breg/src/postgres/mutation.rs, source.approved_evidence(&authority, &accepted).await? runs outside any deadline guard, while the request action that follows it is wrapped in tokio::time::timeout_at(deadline, ...).
Failure scenario: a manual reviewed apply reaches an authority that answers after the 30-second REQUEST_ACTION_TIMEOUT but within its configured HTTP timeout, which permits up to 60 seconds. The request runs well past the action bound and then fails immediately, because the already-expired deadline is what the database mutation is given. A reviewed apply that also requires Evidence can take longer still, since the Evidence helper starts a fresh deadline.
Suggested fix:
- Wrap the authority result lookup in the existing action
deadline, and pass that deadline through to the Evidence helper rather than letting it start a new one.
- Add a test with a slow authority that asserts the action fails at its own bound instead of after the full HTTP timeout.
Filed from the review of #1189; not merge-blocking.
An automated review of #1189 flagged an unbounded await in the reviewed apply path. In
crates/registry-breg/src/postgres/mutation.rs,source.approved_evidence(&authority, &accepted).await?runs outside any deadline guard, while the request action that follows it is wrapped intokio::time::timeout_at(deadline, ...).Failure scenario: a manual reviewed apply reaches an authority that answers after the 30-second
REQUEST_ACTION_TIMEOUTbut within its configured HTTP timeout, which permits up to 60 seconds. The request runs well past the action bound and then fails immediately, because the already-expired deadline is what the database mutation is given. A reviewed apply that also requires Evidence can take longer still, since the Evidence helper starts a fresh deadline.Suggested fix:
deadline, and pass that deadline through to the Evidence helper rather than letting it start a new one.Filed from the review of #1189; not merge-blocking.