2.8 KiB
Explicit large-upload candidate — not a released package
General Blossom keeps its 16 MiB default. ARCHY_BLOSSOM_MAX_UPLOAD_BYTES
accepts an explicit positive decimal byte count up to 2147483648; malformed or
excessive values fail startup. No live setting or catalog entry is changed.
Podsteadr's fixture generator requires --large-upload-candidate to request the
2 GiB setting; the supplied immutable image must actually implement this option.
Old package images ignore the new variable and must not be represented as qualified.
The pinned upstream worker used ReadableStream.tee() for hash and disk branches;
the faster branch could queue ahead. upload-worker-patch.ts instead awaits each
complete disk write before yielding that chunk to the incremental hasher. The
patch refuses changed upstream integration and handles partial/no-progress writes.
Authentication, hash verification, temporary-file cleanup and ownership remain
upstream responsibilities. Independent review is still required.
Recorded qualification
- Source policy/patch tests: 3 passed, including malformed limits and refusal of changed/repeated patch application.
- Candidate image built offline from the previously qualified immutable package;
production source is at
6bc14b6a0. No released version/tag assigned. - Actual default-limit/auth/retention negatives pass.
- Actual signed 2 GiB upload, descriptor, exact tail range, service recreation,
full-length/hash verification and owner-authorized cleanup pass with fixture
transport source
6468ad120. - Containers had a 512 MiB memory limit and zero swap allowance. No OOM/kill; cgroup limit/reclaim events occurred. This is not a claim of ample headroom, concurrent-upload capacity, phone performance or Raspberry Pi compatibility.
- The initial streaming-fetch attempt failed HTTP411 because it did not deliver the required fixed Content-Length. The fixture now uses node:http with backpressure, not a whole-payload RAM buffer. Failed evidence is retained.
Reproduction boundaries
Build tests/apps/blossom/Upload.fixture.Dockerfile with docker/blossom as its
context, a full immutable qualified BLOSSOM_BASE, --pull=never, network disabled,
and bounded resources. This delta-image recipe does not replace clean release
build/provenance acceptance. Run run-upload-disposable.sh with the immutable
candidate in BLOSSOM_FIXTURE_IMAGE; allow >5 GiB free disposable storage and a
bounded outer timeout. The script uses no external network, host ports, real keys,
wallets or persistent installed-app storage. It recreates services only against
its own named volume and cleans that volume on exit.
Remaining: required review; versioned clean package build/provenance; nonempty ownership migration/rollback; managed service-key provisioning/rotation/start ordering; actual manager/device acceptance. No deployment or catalog activation.