Documentation
¶
Overview ¶
Package bbolthealth pkg/util/bbolthealth/repair.go c0-com-util helper for bbolt files. Used by visor subsystems whose bbolt stores hold rebuildable data (telemetry, content-addressed CXO leaves, etc.) where automatic recover-by-deletion is preferred over a panic at commit time.
Motivation: bbolt's commit path runs in an internal batch goroutine triggered via time.AfterFunc, so an inconsistency assertion (e.g. "circular dependency occurred" from WriteInodeToPage) panics in a goroutine the caller can't recover. Trying to open a known-corrupt file just defers the crash to first write. The cheap defense is to integrity-check the file BEFORE the real open and move it aside if it fails.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RepairIfCorrupt ¶
RepairIfCorrupt opens the bbolt file at path (if it exists), runs a synchronous integrity walk of every reachable page, and — if any problem is found — moves the file aside with a timestamped ".corrupt.<unix>" suffix so the subsequent bolt.Open creates a fresh, empty file.
Returns nil when:
- the file doesn't exist (nothing to check)
- the file passes the integrity check
- a corrupt file was successfully moved aside
Returns an error only when:
- statting the path failed for a reason other than non-existence
- a corrupt file CANNOT be moved aside (permissions, ENOSPC)
In the move-failed case, opening the existing file would just defer a process-killing panic, so callers should propagate.
The integrity check uses a WRITABLE open (not ReadOnly): bbolt only initializes the freelist on a writable open, and the freelist is precisely where the kind of inconsistencies that trigger commit-time panics live. The handle is closed immediately so the caller's real open isn't blocked.
Both bolt.Open and the synchronous integrity walk can panic on corruption (freelist inconsistencies like "invalid freelist page: N, page type is leaf" during Open; FastCheck page assertions during the walk). The probe wraps both in recover() so a panic during the integrity check is treated as proof of corruption and the file is moved aside, rather than propagating up to crash-loop the caller. (bbolt's own tx.Check() is unusable here: it scans in an internal goroutine whose panic recover() cannot reach — see probeIntegrity.)
Callers that want operator visibility into the repair should snapshot the directory's ".corrupt.<unix>" entries before calling and re-scan after to detect a new entry — RepairIfCorrupt itself does no logging (no logger dependency).
Types ¶
This section is empty.
Source Files