GCS Publish: Wait for CDN to invalidate

sigstore / root-signing-staging

Staging TUF repository for Sigstore trust root

https://tuf-repo-cdn.sigstage.dev/

Apache License 2.0

3 stars 5 forks source link

GCS Publish: Wait for CDN to invalidate #85

Closed jku closed 3 months ago

jku commented 3 months ago

"invalidate-cdn-cache" can take a long time (at least 10 mins) to finish but we want to test the published repository so would rather wait.

I believe this fixes #84.

A better fix might involve a setup without cache invalidation:

The only thing we don't want to cache is timestamp.json: everything Elise can have a very long lifetime
I wonder if serving timestamp.json without caching is expensive?
alternatively would a short cache lifetime for timestamp work? does 10 seconds help at all? 1 minute?

jku commented 3 months ago

I believe there must be a better fix available but this should be better than failing the test because the invalidation is still ongoing: marking ready for review

jku commented 3 months ago

Update on this:

I've reviewed load balancer logs and CDN settings
There is a 2 min window after a root update when current "negative cache" settings may give clients inconsistent metadata
this inconsistency remains even with manual invalidation (but obviously waiting for the invalidation to finish does fix this testing issue)
I do not see what the reason could be for the reported intermittent errors that lead to the invalidation being added in the first place

jku commented 3 months ago

negative cache has been disabled for staging so I think I'll close this PR and remove the invalidation completely...

jku commented 3 months ago

Closing for now: let's see how #95 works