Skip to content

Revert "Use OS tempdir for artifact metadata"

Stan Hu requested to merge sh-revert-workhorse-tmpdir-optimization into master

What does this MR do and why?

The Rails multipart middleware only allows temporary uploads to be stored in certain paths (https://gitlab.com/gitlab-org/gitlab/blob/dd1e70d3676891025534dc4a1e89ca9383178fe7/lib/gitlab/middleware/multipart.rb#L154-164). This middleware includes Ruby's Dir.tmpdir, but this method may not necessarily return /tmp (https://github.com/ruby/ruby/blob/v2_7_5/lib/tmpdir.rb#L23-L30). For example, if the permissions of /tmp do not contain the sticky bit, Ruby may return the current working directory. In addition, the problem will also show up if Workhorse and GitLab Rails have TMPDIR set differently.

!87255 (merged) changed the behavior so that artifact metadata is always stored in /tmp. When Ruby's Dir.tmpdir differs from that path, then artifact uploads will be rejected with a 400 Bad Request.

To avoid this issue, we revert the changes in !87255 (merged) and always take the recommended temp path from Rails.

Relates to #363701 (closed)

How to set up and validate locally

  1. Set up a GitLab Omnibus instance with no object storage configured.
  2. Run chmod -t /tmp.
  3. Run a job that uploads a CI artifact. See 400 Bad Request.

Compile this branch and overwrite /opt/gitlab/embedded/bin/gitlab-workhorse:

  1. sudo gitlab-ctl stop gitlab-workhorse
  2. cp gitlab-workhorse /opt/gitlab/embedded/bin
  3. sudo gitlab-ctl start gitlab-workhorse.

Retry the job. It should succeed with the artifact upload.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Stan Hu

Merge request reports