Repository navigation
fix(recovery): verify copied Runner droplet payloads - #151
Merged
Merged
Conversation
lweberru
requested review from
Breeless,
JoshSTACKIT,
LembDo and
dweezl
as code owners
October 24, 2026 10:09
10 of 13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The local recovery-preparation tool compared a warm app's copied droplet GUID with its template source GUID. CAPI assigns the copy a new GUID, so this check would reject a legitimate standby before any Runner stop.
Verify the immutable SHA-256 payload, staged state and exact owning app instead, while retaining the broker's original template-source GUID. Fail closed on missing/invalid checksums, changed source, foreign ownership or incomplete copies. Record both GUIDs and the payload checksum privately. Tests now model CAPI copies with genuinely different GUIDs.
Validation: 28 recovery/controller tests pass. The exact verifier also accepted the real current-source CF clone and rejected the older different-source clone using only GET requests, with zero lease or cloud mutations. English/German runbooks updated. This changes the local operator tool only; the successful Dev app release and native hold module remain unchanged, so no further app deployment is needed. Hosted-job recovery remains unqualified under #95.