Repository navigation
A pin whose verdict is refused refuses the add with PIN_REFUSED (#71) - #85
Merged
Merged
Conversation
linuxnow
force-pushed
the
fix/71-verdict-refused
branch
from
October 18, 2026 09:56
a2f3f73 to
69c1eef
Compare
This was referenced Oct 18, 2026
linuxnow
force-pushed
the
fix/71-verdict-refused
branch
from
October 18, 2026 17:00
69c1eef to
fb2852d
Compare
verdict=refused was parsed, stored and then ignored. A plugin whose files failed qualification was added like any other. pins_check now refuses such a plugin with the new code PHD_ERR_PIN_REFUSED (-516), after the files have been checked against the pin: the verdict applies only to the pinned files, so files that differ still answer -509 first. Because the add and the replay share pins_check, an instance whose pin turns refused while it runs is refused at its next replay (instance_replay_refused with -516). The code is declared in protocol.h, and the README and protocol/plugin-hostd.json are regenerated from it. The test fails on main (the add answers resp 0). It covers pin_set, a pin_file under first-use (the plugin is not learned into the store), the replay, and changed files. A sabotage arm removes the check. Closes #71
Contributor
Author
linuxnow
force-pushed
the
fix/71-verdict-refused
branch
from
October 18, 2026 21:08
fb2852d to
cfb3fbb
Compare
This was referenced Oct 18, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #71 (the verdict part; the resource limits mentioned there are openmixer#1858).
The daemon parsed and stored
verdict=refusedbut never acted on it, so files that had failed qualification were added like any other plugin. pins_check now answers a new code,PHD_ERR_PIN_REFUSED(-516), once the files match the pin. The verdict was given for those exact files, so changed files still answer -509 first. The add and the replay both go through pins_check, so a pin that turns refused while its instance runs stops it at the next replay (instance_replay_refused <id> -516). Thepin_changedevent is not sent, because the files did not change.The code is declared in protocol.h. README.md and protocol/plugin-hostd.json are regenerated from it, and the pin section of the README says what the verdict does.
How it is tested:
a_pin_whose_verdict_is_refused_refuses_the_add_with_its_own_codefails on main, where the add answersresp 0. It covers pin_set, a pin_file under first-use (the refused plugin is not learned into the store either), the replay, changed files, and a positive control (the same files re-pinnedverdict=isolatedrun). A sabotage arm removes the check and the test goes red.The code is new, so a release that carries this is a minor bump.
Local checks in the Fedora worker image: test-pin, test-format, test-daemon, check-generated, check-schema, check-readme, test-perturbation, and the new sabotage arm.