feat(recovery): execute time-bounded physical basebackup tar

[seonghobae]

ACTIVE Draft — bounded physical basebackup execution

Protected main@b84f0c94154043a3473939c01bb6471de5a129ae remains unchanged. This branch is an explicit child of fix/recovery-evidence-weakref-coverage-b84f0c9@5951b7a4d779903b8924abaef2a387cae50b7f54 (#233). Current exact head is d85107f4b74ffedd0ce3003ddb8b81f51e09bbf0; GitHub reports this Draft mechanically mergeable against that unchanged predecessor. Fresh targeted branch inventory finds only feat/postgres-physical-basebackup-b84f0c9 on this named source lane. Protected main was not mutated.

Branch-only capability boundary

This Draft executes one time- and byte-bounded pg_basebackup --pgdata=- --format=tar --wal-method=fetch through retained package authority. It requires a private empty writable regular output file, rejects caller read-only capability widening, retains/revalidates the selected output inode, reopens it through /proc/self/fd for an independent package output offset, retains a root-owned non-set-id pg_basebackup executable inode, restricts inherited libpq environment, copies provider stdout through a finite pipe/byte budget, durably invalidates partial output on ordinary failures, and revalidates final file identity/mode/link/size.

Success remains narrow. It does not prove continuous WAL archive integrity, timeline ancestry, WAL replay/PITR, restore/catalog/RLS/application usability, external key/TLS/provider/host recovery, target lifecycle, or deployment RPO/RTO/HA/DR.

Latest RED → GREEN: blocking executable token before the timeout boundary

After the final-symlink repair, fresh source review found that retained executable authority was still opened with blocking O_RDONLY before regular-file validation and before the subprocess timeout began. A caller-selected absolute path named pg_basebackup can be a FIFO or another blocking special-file token; a FIFO with no writer could therefore stall the package before it reached the existing fstat() rejection.

• RED 75f455fec095094735f275ccc2bf94c1582a3e09 adds test_pg_basebackup_fifo_open_is_nonblocking_and_rejected. The deterministic guard models the POSIX FIFO-open boundary without timing dependence: the exact preceding source attempts the selected token without O_NONBLOCK, reaching the RED assertion before any child process can run.
• GREEN d85107f4b74ffedd0ce3003ddb8b81f51e09bbf0 adds os.O_NONBLOCK to the retained executable open and updates the public authority contract. The existing fstat() regular-file check still rejects the FIFO, so the change removes the pre-validation availability hazard without broadening accepted executable types.
• Focused exact-source reconstruction on GREEN proves the same FIFO token is opened with both O_NOFOLLOW and O_NONBLOCK and then rejected through the fixed content-free PostgreSQL physical base-backup executable is unsafe boundary.
• Exact RED→GREEN compare is one production file and one commit (+11/-7); no adjacent recovery source changed. Issue fix(recovery): harden pg_basebackup executable authority #283 tracks this executable-authority hardening until protected-main integration.

Earlier executable hardening: final-symlink substitution

Fresh review of the earlier branch had found that the caller path basename was validated as pg_basebackup while the retained open followed its final symlink. That separated pathname identity from executable identity: a caller-controlled pg_basebackup symlink could resolve to a different root-owned executable and still satisfy the owner/mode/inode checks.

• RED a4e019cfeb04793fb72f56c4c32fdc282236f347 adds test_symlink_pg_basebackup_is_rejected_before_execution; focused reconstruction retained the substitute symlink target.
• Obsolete hosted CI 32349566801 and Release Acceptance 32349566824 were cancelled after the branch advanced; cancelled evidence is non-passing and does not transfer.
• GREEN 2795f8642770ef2000658edefcdba297c30d75b6 added os.O_NOFOLLOW while preserving descriptor-pinned execution, root ownership, regular-file/execute-bit checks, group/other-write rejection, set-id rejection, fixed diagnostics, and pathname-replacement resistance. That repair is retained by the current head.

Other hardened boundaries retained

The branch retains prior reviewed repairs for caller numeric-FD substitution; independent output open-file-description authority; effective-user ownership/private-mode/single-link checks; rejection of read-only capability widening; executable pathname replacement after retention; finite provider-output byte authority; pipe/thread construction and short-write failure; durable partial-output invalidation; and process-control/read-descriptor ownership races.

The earlier hosted deterministic pump-descriptor RED remains 133f04a9dcd23ecad03d4d6574fda6f49843a922, where CI 32318905830 / Python 3.10 job 96276917723 checked out that exact head and reported 1 failed, 1400 passed. Its refined fix is retained by current ancestry; that predecessor evidence does not substitute for current-head gates.

Exact current-head validation

Fresh commit-scoped evidence for unchanged exact d85107f4b74ffedd0ce3003ddb8b81f51e09bbf0 is currently non-passing as a set:

• CI 32350477525: completed / success;
• Release Acceptance 32350477497: completed / success;
• exact-head Security Scan / SAST Semgrep: not materialized in the commit-scoped inventory;
• formal reviews: none at the latest fresh inventory; and
• inline review threads: none at the latest fresh inventory.

The exact-head CI/Release successes prove their own current checkout only. Absent Security/SAST and absent formal review remain non-passing evidence; no predecessor, cancelled, stale, status-only, author-only, or other-head evidence transfers.

Integration boundary

#233 is the exact predecessor and must integrate first. Its repository-local exact-head checks are green, but its current same-head independent-review state remains non-passing through the read-only central coverage/review control plane tracked in #244. This pg writer does not mutate ContextualWisdomLab/.github, copy a central workaround, churn #233 to manufacture an event, self-approve, or weaken gates.

Keep this PR Draft until the current GREEN head proves every then-required exact-head/current-base quality/security/coverage/package/provenance/release gate, #233 integrates through live governance, this branch is reconciled to resulting protected main, zero valid findings/threads remain, and any qualifying non-author current-last-push approval required by then-live policy exists.

Refs #204, #233, #244, #257, #283.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a16282d-edb1-48a3-8ce7-cf495a0c3d8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}