verify: fail fast and never hang #345

We can also do .read_timeout() to catch connections that die partway through. It's an idle read() timeout, not a deadline.

Added .read_timeout(90s) on the shared client. Has to stay above the attestation fetch's 60s per-request override, or it'd cut that request short

The read timeout is for "any data received". As long as we get any data every 30 seconds, even a byte, it won't terminate. It would still be terminated by a 60 seconds generic deadline.

Has to stay above the attestation fetch's 60s per-request override, or it'd cut that request short

read_timeout() is an idle timer, .timeout() is a deadline timer. Idle timers can always be shorter than deadline timers, since idle timers only count "time since last byte", whereas deadline timers count "time since first byte". Time since last byte should always be less-or-equal time since first byte.

.read_timeout(30s) for the idle case (half-dead connections), plus .timeout(60s) as the generic deadline.

Can we make use of read_timeout instead to not kill slow connections?

read_timeout being added to the ClientBuilder, it's not available on RequestBuilder

Right, client-only. Leaving as is

Could we run a HEAD against the url?

Done - /archive/*.tar[.gz] app-source URLs now fall back to preflight_archive_url (HEAD) instead of skipping

When adding new functions, please add associated error types that cover all unique variants of a function. This one should have something like:

#[derive(Clone, Debug, thiserror::Error)]#[error("The archive for commit {commit} was not available at {url} (HTTP {code})")]pubstruct PreflightArchiveUrlError{pubcommit: String,puburl: String,pubcode: StatusCode,}

Added PreflightArchiveUrlError { label, url, code: StatusCode }

Same as above, please add an error type covering all unique error paths. Looks like there's only one, so it can also be a struct. If you have code has multiple spots where it returns an error, please use an enum. If you are returning an error caused by another function's error, please use #[source] if additional context would be helpful, or #[from] if no additional context would help, and it's not an abstract error type - when using #[from], you can use the ? sigil without issue.

Added AppSourceBranchMissingError (single path → struct)

This should also have a ClassifyAppSourceRefsError { commit: String, branch: Option<String> }.

Done. ClassifyAppSourceRefsError { commit: String, branch: String }. Made branch a String (not Option) since the only error arm is Some(branch) && !present. Didn't #[source]-chain it under AppSourceBranchMissingError — main prints the full Caused by: chain, so it'd just repeat branch/commit; the caller consumes it into the richer error instead.

please include #[source] AppSourceBranchMissingError, as we may add additional context fields to it later, and that may be missed.

Done: AppSourceBranchMissingError #[source]-ing ClassifyAppSourceRefsError (the outer error wraps the inner one, since only it carries the url)

just return reqwest's error type or use .expect("codepath introduces no variables")

Fixed .expect("archive HTTP client config is static"). Returns reqwest::Client now, so both call sites lose ?