bvandeusen
810baf63ac
Every archive import was failing immediately with "AssertionError:
daemonic processes are not allowed to have children" (operator-flagged
2026-05-30 — import_archive_file crashes in 49ms with the assertion).
Celery's prefork pool runs tasks in daemon processes; Python's
multiprocessing module refuses to let daemons spawn children, which is
exactly what probe_archive was doing via mp.get_context("spawn")
.Process. The Layer-3 crash-isolation feature added 2026-05-28 was
effectively a hard-blocker on the very import path it was meant to
protect.
Switched probe_archive to subprocess.run — no daemon restriction, still
isolates the probe (a probe segfault/OOM exits non-zero, doesn't kill
the worker). The probe body lifted to a tiny runner module
(_archive_probe_runner) that imports the unchanged _run_probe helper
and prints a single JSON line; parent parses stdout, returns the
ProbeResult exactly as before (timeout, signal, OOM, clean-rejection,
ok — all preserved).
cwd for the subprocess is the repo root derived from __file__ parents
so `python -m backend.app.utils._archive_probe_runner` resolves both in
the Celery container and pytest, regardless of where the worker was
launched.
Test refactor: test_archive_probe_target_bomb_guard →
test_run_probe_bomb_guard. Same in-process call to the (renamed) probe
body so the monkeypatched cap still takes effect; the real subprocess
path is exercised by the existing test_probe_archive_valid_zip /
test_probe_archive_corrupt_zip_clean_rejection tests.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
69 lines
2.4 KiB
Python
69 lines
2.4 KiB
Python
"""Layer-3 subprocess-isolated probe tests.
|
|
|
|
The bomb-guard cap is exercised against `_run_probe` directly (in-process,
|
|
where a monkeypatch on the module constant takes effect) — the real probe
|
|
runs in a subprocess that re-imports the module, so a parent-process
|
|
monkeypatch wouldn't reach the spawned interpreter.
|
|
"""
|
|
|
|
import zipfile
|
|
from pathlib import Path
|
|
|
|
from backend.app.utils import safe_probe
|
|
|
|
|
|
def _zip(path, entries):
|
|
with zipfile.ZipFile(path, "w") as zf:
|
|
for name, data in entries.items():
|
|
zf.writestr(name, data)
|
|
|
|
|
|
def test_probe_archive_valid_zip(tmp_path):
|
|
z = tmp_path / "ok.zip"
|
|
_zip(z, {"a.jpg": b"hello", "b.png": b"world"})
|
|
res = safe_probe.probe_archive(z)
|
|
assert res.ok is True
|
|
assert res.crashed is False
|
|
|
|
|
|
def test_probe_archive_corrupt_zip_clean_rejection(tmp_path):
|
|
z = tmp_path / "broken.zip"
|
|
z.write_bytes(b"PK\x03\x04 not really a zip past here")
|
|
res = safe_probe.probe_archive(z)
|
|
assert res.ok is False
|
|
# Corrupt-but-handled (zipfile raises BadZipFile in the child) — a
|
|
# clean rejection, not a hard crash.
|
|
assert res.crashed is False
|
|
assert res.reason
|
|
|
|
|
|
def test_inspect_archive_reports_size_and_clean_integrity(tmp_path):
|
|
z = tmp_path / "sized.zip"
|
|
_zip(z, {"a.txt": b"x" * 100, "b.txt": b"y" * 50})
|
|
total, bad = safe_probe._inspect_archive(z, ".zip")
|
|
assert total == 150
|
|
assert bad is None
|
|
|
|
|
|
def test_run_probe_bomb_guard(tmp_path, monkeypatch):
|
|
"""In-process call to _run_probe so the monkeypatched cap takes effect.
|
|
The public probe_archive runs in a subprocess which re-imports the
|
|
module and wouldn't see the patched constant."""
|
|
monkeypatch.setattr(safe_probe, "MAX_ARCHIVE_UNCOMPRESSED_BYTES", 10)
|
|
z = tmp_path / "bomb.zip"
|
|
_zip(z, {"big.txt": b"x" * 5000}) # 5000 uncompressed > 10-byte cap
|
|
status, detail = safe_probe._run_probe(str(z))
|
|
assert status == "error"
|
|
assert "bomb-guard cap" in detail
|
|
|
|
|
|
def test_probe_video_non_video_is_not_ok(tmp_path):
|
|
"""A text file is not a decodable video. Whether ffprobe is present
|
|
(returncode != 0) or absent (OSError → 'unavailable'), the result is
|
|
ok=False. We don't assert on crashed/reason so the test is robust to
|
|
ffprobe presence in CI."""
|
|
f = tmp_path / "nope.txt"
|
|
f.write_text("definitely not a video container")
|
|
res = safe_probe.probe_video(f)
|
|
assert res.ok is False
|