From f09a8f246e78636ff5ac502cdadc5fa0ec21fa44 Mon Sep 17 00:00:00 2001 From: Greg Burd Date: Wed, 4 Nov 2026 15:28:11 -0500 Subject: [PATCH 1/4] release: libdb 2026.10.7.3 (LTS patch) --- build_android/Android.mk | 2 +- build_android/db.h | 6 +-- build_android/jdbc/jni/Android.mk | 2 +- build_windows/db.h | 6 +-- dist/RELEASE | 4 +- dist/configure | 6 +-- dist/meson.build | 4 +- dist/meson/db_subs.json | 6 +-- docs_src/_data/releases.toml | 1 + docs_src/guides/upgrading/_meta.toml | 1 + .../guides/upgrading/upgrade_2026_10_7_3.md | 44 +++++++++++++++++++ meson.build | 2 +- 12 files changed, 65 insertions(+), 19 deletions(-) create mode 100644 docs_src/guides/upgrading/upgrade_2026_10_7_3.md diff --git a/build_android/Android.mk b/build_android/Android.mk index 1e31003cff..acb732527c 100644 --- a/build_android/Android.mk +++ b/build_android/Android.mk @@ -1,6 +1,6 @@ # DO NOT EDIT: automatically built by dist/s_android. # Makefile for building a drop-in replacement of SQLite using -# libdb 2026.10.7.2 (November 3, 2026) +# libdb 2026.10.7.3 (November 4, 2026) ################################################################### LOCAL_PATH := $(call my-dir) include $(CLEAR_VARS) diff --git a/build_android/db.h b/build_android/db.h index 6cb38f04da..5fc45e6559 100644 --- a/build_android/db.h +++ b/build_android/db.h @@ -53,9 +53,9 @@ extern "C" { * level. Use this to identify the community fork; use the MAJOR/MINOR/PATCH * triplet for format/ABI compatibility decisions. */ -#define DB_CALVER "2026.10.7.2" -#define DB_VERSION_STRING "libdb 2026.10.7.2 (November 3, 2026)" -#define DB_VERSION_FULL_STRING "libdb 2026.10.7.2 (November 3, 2026)" +#define DB_CALVER "2026.10.7.3" +#define DB_VERSION_STRING "libdb 2026.10.7.3 (November 4, 2026)" +#define DB_VERSION_FULL_STRING "libdb 2026.10.7.3 (November 4, 2026)" /* * !!! diff --git a/build_android/jdbc/jni/Android.mk b/build_android/jdbc/jni/Android.mk index 608f542e4b..b08ee39b3f 100644 --- a/build_android/jdbc/jni/Android.mk +++ b/build_android/jdbc/jni/Android.mk @@ -1,6 +1,6 @@ # DO NOT EDIT: automatically built by dist/s_android. # Makefile for building Android.JDBC for DBSQL -# libdb 2026.10.7.2 (November 3, 2026) +# libdb 2026.10.7.3 (November 4, 2026) # # This Makefile will generate 3 files: # 1. Static libdb_sql library. An internal library and users don't diff --git a/build_windows/db.h b/build_windows/db.h index ec1fdf89cf..48a5e87b64 100644 --- a/build_windows/db.h +++ b/build_windows/db.h @@ -68,9 +68,9 @@ extern "C" { * level. Use this to identify the community fork; use the MAJOR/MINOR/PATCH * triplet for format/ABI compatibility decisions. */ -#define DB_CALVER "2026.10.7.2" -#define DB_VERSION_STRING "libdb 2026.10.7.2 (November 3, 2026)" -#define DB_VERSION_FULL_STRING "libdb 2026.10.7.2 (November 3, 2026)" +#define DB_CALVER "2026.10.7.3" +#define DB_VERSION_STRING "libdb 2026.10.7.3 (November 4, 2026)" +#define DB_VERSION_FULL_STRING "libdb 2026.10.7.3 (November 4, 2026)" /* * !!! diff --git a/dist/RELEASE b/dist/RELEASE index 517ef547a2..cbc5f34e25 100644 --- a/dist/RELEASE +++ b/dist/RELEASE @@ -8,7 +8,7 @@ # Format: YYYY.0M (append .MICRO for a same-month re-release, e.g. 2026.09.1). # Bump YYYY.0M for the month you cut the release; MICRO for follow-ups. # --------------------------------------------------------------------------- -DB_CALVER="2026.10.7.2" +DB_CALVER="2026.10.7.3" # --------------------------------------------------------------------------- # FORMAT / ABI COMPATIBILITY LEVEL -- FROZEN at 5.3.37, do NOT bump for a @@ -30,7 +30,7 @@ DB_VERSION_FULL="$DB_VERSION_FAMILY.$DB_VERSION_RELEASE.$DB_VERSION_MAJOR.$DB_VE DB_VERSION_UNIQUE_NAME=`printf "_%d%03d" $DB_VERSION_MAJOR $DB_VERSION_MINOR` -DB_RELEASE_DATE="November 3, 2026" +DB_RELEASE_DATE="November 4, 2026" # User-facing string leads with the CalVer identity; the frozen 5.3.37 is kept # as the parenthesised format/ABI compatibility level so tools that parse it # and existing environments still see a stable compat number. diff --git a/dist/configure b/dist/configure index c3b1d33e1a..89c2ec2b43 100755 --- a/dist/configure +++ b/dist/configure @@ -3596,11 +3596,11 @@ DB_VERSION_MINOR="0" DB_VERSION_PATCH="9" -DB_CALVER="2026.10.7.2" +DB_CALVER="2026.10.7.3" -DB_VERSION_STRING='"libdb 2026.10.7.2 (November 3, 2026)"' +DB_VERSION_STRING='"libdb 2026.10.7.3 (November 4, 2026)"' -DB_VERSION_FULL_STRING='"libdb 2026.10.7.2 (November 3, 2026)"' +DB_VERSION_FULL_STRING='"libdb 2026.10.7.3 (November 4, 2026)"' # Process all options before using them. diff --git a/dist/meson.build b/dist/meson.build index 51cacead38..040fc750c9 100644 --- a/dist/meson.build +++ b/dist/meson.build @@ -331,8 +331,8 @@ cdata.set('SIZEOF_CHAR_P', cc.sizeof('void *')) # Package strings. cdata.set_quoted('PACKAGE_NAME', 'Berkeley DB') cdata.set_quoted('PACKAGE_TARNAME', 'db') -cdata.set_quoted('PACKAGE_VERSION', '2026.10.7.2') -cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7.2') +cdata.set_quoted('PACKAGE_VERSION', '2026.10.7.3') +cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7.3') cdata.set_quoted('PACKAGE_BUGREPORT', '') cdata.set_quoted('PACKAGE_URL', '') cdata.set_quoted('LT_OBJDIR', '.libs/') diff --git a/dist/meson/db_subs.json b/dist/meson/db_subs.json index b32fdb60c6..3bbac93700 100644 --- a/dist/meson/db_subs.json +++ b/dist/meson/db_subs.json @@ -4,9 +4,9 @@ "DB_VERSION_MAJOR": "2026", "DB_VERSION_MINOR": "0", "DB_VERSION_PATCH": "9", - "DB_CALVER": "2026.10.7.2", - "DB_VERSION_STRING": "\"libdb 2026.10.7.2 (November 3, 2026)\"", - "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7.2 (November 3, 2026)\"", + "DB_CALVER": "2026.10.7.3", + "DB_VERSION_STRING": "\"libdb 2026.10.7.3 (November 4, 2026)\"", + "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7.3 (November 4, 2026)\"", "DB_VERSION_UNIQUE_NAME": "", "DB_CONST": "", "DB_PROTO1": "", diff --git a/docs_src/_data/releases.toml b/docs_src/_data/releases.toml index 9a2af4f94e..206cd24de5 100644 --- a/docs_src/_data/releases.toml +++ b/docs_src/_data/releases.toml @@ -14,6 +14,7 @@ historical = ["v5.3.28", "v4.6.21-SSI"] [notes] +"v2026.10.7.3" = "LTS patch release of the 2026.10.7 line, fixes only, formats unchanged: a replication election could choose a site with older data when two candidates' logs ended at the same position, losing transactions acknowledged as durable; a corrupt compressed B-tree record could crash the reader (unchecked length fields); and an SSI abort no longer prints BDB3010" "v2026.10.7.2" = "LTS patch release of the 2026.10.7 line, fixes only, formats unchanged: DB_TXN_SERIALIZABLE could commit a write skew (three missed conflicts, now caught), recovery of many prepared transactions ran out of lockers with lockers free on other stripes, and an equal-key put over a deleted key or an all-deleted duplicate set kept the deleted key's bytes under a non-identity bt_compare" "v2026.10.7.1" = "LTS patch release of the 2026.10.7 line, fixes only, formats unchanged: a reverse cursor walk (DB_PREV) could silently skip live records next to deleted ones (a strict-aliasing miscompile, seen with clang on aarch64), DB_TRUNCATE with a subdatabase name destroyed the whole file (now refused with EINVAL), and a lock-order inversion when discarding a written file from the cache, which a debug build reported as a panic" "v2026.10.7" = "First LTS release: the 2026.10.x line freezes the region, database and log formats, the soname and the ABI. On macOS arm64 the hybrid mutex is selected again (region format changes there only; see the 2026.10.7 upgrade note); every other platform is byte-identical to 2026.10.6" diff --git a/docs_src/guides/upgrading/_meta.toml b/docs_src/guides/upgrading/_meta.toml index 8f286bc704..af5e23837c 100644 --- a/docs_src/guides/upgrading/_meta.toml +++ b/docs_src/guides/upgrading/_meta.toml @@ -9,6 +9,7 @@ order = [ "moreinfo", "introduction", "upgrade_process", + "upgrade_2026_10_7_3", "upgrade_2026_10_7_2", "upgrade_2026_10_7_1", "upgrade_2026_10_7", diff --git a/docs_src/guides/upgrading/upgrade_2026_10_7_3.md b/docs_src/guides/upgrading/upgrade_2026_10_7_3.md new file mode 100644 index 0000000000..5758c1fc42 --- /dev/null +++ b/docs_src/guides/upgrading/upgrade_2026_10_7_3.md @@ -0,0 +1,44 @@ +--- +title: "Upgrading to libdb 2026.10.7.3" +api-name: "Upgrading to libdb 2026.10.7.3" +--- +## Upgrading to libdb 2026.10.7.3 + +libdb 2026.10.7.3 is the third patch release of the 2026.10.7 long-term support (LTS) line. It contains bug fixes only. + +**No upgrade procedure is needed.** The shared-memory region format, the database and log formats, the soname and the public ABI are the same as 2026.10.7, 2026.10.7.1 and 2026.10.7.2 on every platform. An environment created by any of them opens with 2026.10.7.3 and the other way round, and processes from all four releases can share one environment. Install it in place of 2026.10.7.2. + +In a replication group that mixes 2026.10.7.3 with earlier releases, see the election fix below. + +### Build signatures + +The signature depends on the platform and the configure options. On each +platform below, 2026.10.7 through 2026.10.7.3 built the same way print the +same value. + +| Platform (default `configure`) | 2026.10.7.2 | 2026.10.7.3 | +| --- | --- | --- | +| Linux x86_64 (Debian 12, gcc) | `0x841f4ea8` | `0x841f4ea8` | +| FreeBSD aarch64 (14.5, clang) | `0x56a06689` | `0x56a06689` | +| FreeBSD x86_64, macOS arm64, Windows | unchanged | unchanged | + +### What it fixes + +**A replication election could choose a site with older data.** Each site ranks the votes it receives to pick a winner. The ranking was meant to prefer the site with the newest data, but its last rule, used when two sites' logs end at the same position, ignored which generation of data each site held. Two candidates with logs ending at the same position but different data generations were ranked by whichever vote arrived last. If a majority of sites counted the older site's vote last, that site won, and the site with newer data rolled back its log to match on its next sync, losing transactions it had already acknowledged as durable. The first vote counted was also handled separately, so ties could resolve differently from site to site. The ranking is now one fixed order, applied to every vote the same way: sites that can be elected, then non-zero priority, then newest data generation, then log position, priority, the random tiebreaker and the site's ID. It no longer depends on arrival order, and it never ranks older data above newer. + +This needs two candidates whose logs end at exactly the same position, so it is rare. The conditions were reproduced on real sites; that a network delivers the votes in the losing order is argued, not shown end to end. `test/db/run_rep_cmpvote_order.sh` runs the vote values captured from those sites through every arrival order. It fails on 2026.10.7.2 and passes on 2026.10.7.3. + +During a rolling upgrade, old and new sites rank the affected ties differently, so in that case an election may need an extra round before the sites agree. It cannot produce two masters. Finish the upgrade promptly. + +**A corrupt compressed B-tree record could crash the reader.** A B-tree opened with `DB->set_bt_compress` stores records in a compressed form that includes length fields. The decoder trusted those lengths, and a page comes from disk: + +- it read each length field before checking that the bytes were there, so a truncated record read past its end; +- it added two lengths without checking for overflow, so a large enough value wrapped around, passed every size check, and made it copy about 4 GB; +- the first record in each group had its length used with no check at all, so one corrupted byte in the file crashed a plain `DB->get`. + +Each length is now checked before it is read or used, and a bad record returns `EINVAL`. Only B-trees with compression enabled, in builds configured with `--enable-compression`, are affected. `test/db/run_bt_decompress_bounds.sh` has five cases, including a real database with one length byte corrupted on disk. All five crash on 2026.10.7.2 and pass on 2026.10.7.3. + +### Also in this release + +- An SSI transaction that aborted with `DB_SNAPSHOT_CONFLICT` or `DB_SNAPSHOT_UNSAFE` while upgrading a page for writing also printed `BDB3010 error getting a page for writing`. The abort was correct and nothing was lost. The message is gone; the return codes are unchanged. +- In a build configured with `--enable-diagnostic`, the lock-order checker reported a deadlock, and panicked the environment, when a thread held a latch in one environment and took the same-numbered latch in another. A replication application whose send callback writes to a second environment hit it, as did every replication election test. Latches in different environments are no longer compared. Release builds do not include the checker. diff --git a/meson.build b/meson.build index 93f8ac06dc..8f4fb1f8cf 100644 --- a/meson.build +++ b/meson.build @@ -12,7 +12,7 @@ # meson test -C build --suite tiers # isolation + lock-matrix tiers project('libdb', 'c', - version: '2026.10.7.2', + version: '2026.10.7.3', # Sleepycat, matching LICENSE (byte-identical to Oracle's) and README.md. # This field previously named a copyleft licence that this fork # deliberately excludes: README.md explains that Berkeley DB releases from From 09eba7e6e4728d29a8f37797d8868171addfcf41 Mon Sep 17 00:00:00 2001 From: Greg Burd Date: Wed, 4 Nov 2026 17:06:02 -0500 Subject: [PATCH 2/4] test(audit): v2026.10.7.3 per-host qualification output --- .../QUAL-2026.10.7.3-freebsd-aarch64.txt | 45 ++++++++++++++ .../audit/QUAL-2026.10.7.3-freebsd-x86_64.txt | 45 ++++++++++++++ test/audit/QUAL-2026.10.7.3-linux-x86_64.txt | 58 +++++++++++++++++++ test/audit/QUALIFICATION-MATRIX.md | 5 +- 4 files changed, 151 insertions(+), 2 deletions(-) create mode 100644 test/audit/QUAL-2026.10.7.3-freebsd-aarch64.txt create mode 100644 test/audit/QUAL-2026.10.7.3-freebsd-x86_64.txt create mode 100644 test/audit/QUAL-2026.10.7.3-linux-x86_64.txt diff --git a/test/audit/QUAL-2026.10.7.3-freebsd-aarch64.txt b/test/audit/QUAL-2026.10.7.3-freebsd-aarch64.txt new file mode 100644 index 0000000000..5bc635aa1d --- /dev/null +++ b/test/audit/QUAL-2026.10.7.3-freebsd-aarch64.txt @@ -0,0 +1,45 @@ +# v2026.10.7.3 qualification: freebsd-aarch64 (FreeBSD 14.5-STABLE arm64) +base: 2625d8cd Merge pull request #260 from berkeleydb/release/2026.10.7.2 +cand: d12fe79e Merge remote-tracking branch 'origin/backport/2026.10.7/lock-order-per-env' into release/2026.10.7.3 + +## L1 region signature (default configure) + base: 0x56a06689 + cand: 0x56a06689 + L1 PASS + +## L2 soname, exported symbols, .text, handle sizes + base soname: libdb-2026.0.so + base exported symbols: 1848 + base .text: 1064460 + cand soname: libdb-2026.0.so + cand exported symbols: 1848 + cand .text: 1063228 + symbols removed: 0 added: 0 + handle_sizes (cand): run_handle_sizes.sh: PASS + +## L3 fixed bugs: base / release (each test from the candidate tree) + run_bt_decompress_bounds: FAIL / PASS + run_rep_cmpvote_order (fixed must PASS, pre-fix arm must FAIL, copy matches src): PASS + lock_order_check base: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|FAIL (two-env): status 0x86 -- the checker compared mutex indices across environments|FAIL: lock_order_check| + lock_order_check cand: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|PASS (two-env): latches with the same index in two environments were not reported|PASS: lock_order_check| + ssi_livelock BDB3010 lines over 3 runs: base 126 / release 0 + +## gate 1 test/db tier (release, diagnostic, compression+diagnostic) + cand rel: rc=1 pass=39 skip=4 fail=3 + run_qam_extent_vrfy.sh: FAIL (rc=124) + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + cand diag: rc=1 pass=39 skip=4 fail=3 + run_qam_extent_vrfy.sh: FAIL (rc=124) + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + cand comp: rc=1 pass=39 skip=4 fail=3 + run_qam_extent_vrfy.sh: FAIL (rc=124) + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + +## done 2026-11-04T21:17:41Z + +## run_qam_extent_vrfy alone, TIMEOUT=1200, base / release + base: run_qam_extent_vrfy.sh: PASS in 600 s + cand: run_qam_extent_vrfy.sh: PASS in 601 s diff --git a/test/audit/QUAL-2026.10.7.3-freebsd-x86_64.txt b/test/audit/QUAL-2026.10.7.3-freebsd-x86_64.txt new file mode 100644 index 0000000000..ef410916a7 --- /dev/null +++ b/test/audit/QUAL-2026.10.7.3-freebsd-x86_64.txt @@ -0,0 +1,45 @@ +# v2026.10.7.3 qualification: freebsd-x86_64 (FreeBSD 14.5-STABLE amd64) +base: 2625d8cd Merge pull request #260 from berkeleydb/release/2026.10.7.2 +cand: d12fe79e Merge remote-tracking branch 'origin/backport/2026.10.7/lock-order-per-env' into release/2026.10.7.3 + +## L1 region signature (default configure) + base: 0x56a06689 + cand: 0x56a06689 + L1 PASS + +## L2 soname, exported symbols, .text, handle sizes + base soname: libdb-2026.0.so + base exported symbols: 1848 + base .text: 1160828 + cand soname: libdb-2026.0.so + cand exported symbols: 1848 + cand .text: 1159004 + symbols removed: 0 added: 0 + handle_sizes (cand): run_handle_sizes.sh: PASS + +## L3 fixed bugs: base / release (each test from the candidate tree) + run_bt_decompress_bounds: FAIL / PASS + run_rep_cmpvote_order (fixed must PASS, pre-fix arm must FAIL, copy matches src): PASS + lock_order_check base: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|FAIL (two-env): status 0x86 -- the checker compared mutex indices across environments|FAIL: lock_order_check| + lock_order_check cand: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|PASS (two-env): latches with the same index in two environments were not reported|PASS: lock_order_check| + ssi_livelock BDB3010 lines over 3 runs: base 166 / release 0 + +## gate 1 test/db tier (release, diagnostic, compression+diagnostic) + cand rel: rc=1 pass=39 skip=4 fail=3 + run_qam_extent_vrfy.sh: FAIL (rc=124) + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + cand diag: rc=1 pass=39 skip=4 fail=3 + run_qam_extent_vrfy.sh: FAIL (rc=124) + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + cand comp: rc=1 pass=39 skip=4 fail=3 + run_qam_extent_vrfy.sh: FAIL (rc=124) + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + +## done 2026-11-04T21:16:51Z + +## run_qam_extent_vrfy alone, TIMEOUT=1200, base / release + base: run_qam_extent_vrfy.sh: PASS in 640 s + cand: run_qam_extent_vrfy.sh: PASS in 640 s diff --git a/test/audit/QUAL-2026.10.7.3-linux-x86_64.txt b/test/audit/QUAL-2026.10.7.3-linux-x86_64.txt new file mode 100644 index 0000000000..fdbd3f6cbb --- /dev/null +++ b/test/audit/QUAL-2026.10.7.3-linux-x86_64.txt @@ -0,0 +1,58 @@ +# v2026.10.7.3 qualification: linux-x86_64 (Linux 6.1.0-54-cloud-amd64 x86_64) +base: 2625d8cd Merge pull request #260 from berkeleydb/release/2026.10.7.2 +cand: 43f4a560 release: libdb 2026.10.7.3 (LTS patch) + +## L1 region signature (default configure) + base: 0x841f4ea8 + cand: 0x841f4ea8 + L1 PASS + +## L2 soname, exported symbols, .text, handle sizes + base soname: libdb-2026.0.so + base exported symbols: 1846 + base .text: 1307996 + cand soname: libdb-2026.0.so + cand exported symbols: 1846 + cand .text: 1308236 + symbols removed: 0 added: 0 + handle_sizes (cand): run_handle_sizes.sh: PASS + +## L3 fixed bugs: base / release (each test from the candidate tree) + run_bt_decompress_bounds: FAIL / PASS + run_rep_cmpvote_order (fixed must PASS, pre-fix arm must FAIL, copy matches src): PASS + (lock_order_check and ssi_livelock first failed to link: the dev box has liburing and the script + linked libdb.a without the build's LIBS. Re-run with the build's LIBS on the same trees:) + lock_order_check base: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|FAIL (two-env): status 0x6 -- the checker compared mutex indices across environments|FAIL: lock_order_check| + lock_order_check cand: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|PASS (two-env): latches with the same index in two environments were not reported|PASS: lock_order_check| + ssi_livelock BDB3010 lines over 3 runs: base 0 / release 0 + +## gate 1 test/db tier (release, diagnostic, compression+diagnostic) + cand rel: rc=0 pass=42 skip=3 fail=2 + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + cand diag: rc=0 pass=42 skip=3 fail=2 + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + cand comp: rc=0 pass=42 skip=3 fail=2 + rep_cmpvote_order: FAIL (12) + pre-fix: FAILED as required (bug reproduced) + +## done 2026-11-04T20:40:28Z + +## rep election TCL, --enable-diagnostic, base / release (#269) +== base (2625d8cd ) +rep001: FAIL +rep002: FAIL +rep005: FAIL +rep020: FAIL +rep021: FAIL +rep026: FAIL +rep037: FAIL +== cand (43f4a560 ) +rep001: PASS +rep002: PASS +rep005: PASS +rep020: PASS +rep021: PASS +rep026: PASS +rep037: PASS diff --git a/test/audit/QUALIFICATION-MATRIX.md b/test/audit/QUALIFICATION-MATRIX.md index a2eacc38a1..5f8a713c2d 100644 --- a/test/audit/QUALIFICATION-MATRIX.md +++ b/test/audit/QUALIFICATION-MATRIX.md @@ -65,8 +65,9 @@ hot path. Gate 8 (the soak) is skipped unless a fix touches resource lifetime. The release notes say which gates ran. The LTS patch releases are recorded in -[`QUAL-2026.10.7.1.md`](QUAL-2026.10.7.1.md) and -[`QUAL-2026.10.7.2.md`](QUAL-2026.10.7.2.md). +[`QUAL-2026.10.7.1.md`](QUAL-2026.10.7.1.md), +[`QUAL-2026.10.7.2.md`](QUAL-2026.10.7.2.md) and +[`QUAL-2026.10.7.3.md`](QUAL-2026.10.7.3.md). ## Additional gates for the LTS declaration From 5fb82411a56ef25d321a501345419c6394ffb51a Mon Sep 17 00:00:00 2001 From: Greg Burd Date: Wed, 4 Nov 2026 18:30:45 -0500 Subject: [PATCH 3/4] test(audit): v2026.10.7.3 qualification record --- test/audit/QUAL-2026.10.7.3.md | 121 +++++++++++++++++++++++++++++++++ 1 file changed, 121 insertions(+) create mode 100644 test/audit/QUAL-2026.10.7.3.md diff --git a/test/audit/QUAL-2026.10.7.3.md b/test/audit/QUAL-2026.10.7.3.md new file mode 100644 index 0000000000..dad2ba5c59 --- /dev/null +++ b/test/audit/QUAL-2026.10.7.3.md @@ -0,0 +1,121 @@ +# v2026.10.7.3 qualification (LTS patch release, 2026-11-04) + +The third patch release of the `2026.10.7` LTS line, qualified against the +gates for an LTS patch release in [`QUALIFICATION-MATRIX.md`](QUALIFICATION-MATRIX.md) +(gates 1–5 and 7, plus L1–L4). The candidate was compared with the base tag +`v2026.10.7.2` (`2625d8cd7`), both built the same way on the same host. + +**Candidate:** `release/2026.10.7.3`. The release commit `f09a8f246` (PR #271) +on `lts/2026.10.7` at `f2e1b768c`. The FreeBSD hosts qualified `d12fe79e1` +(the four backports merged locally, then the release commit). Linux qualified +`43f4a560b`, one commit earlier. The release differs from what was qualified in +two test-only commits, and in no library source: + +- `8bec6e80b` (from #268): `lock_order_check`'s new arm returns `int`, so clang + builds it. gcc had already built and run the old version on Linux. +- `a0772e835` (#273, from #272): `test/c/leak-run.sh` puts `src/` on its include + path. #269 made `lock_order_check.c` include `db_int.h`, so the CI leak job + could not build it. The qualification scripts build `lock_order_check` + through the Makefile, which already had `src/`. + +**Hosts:** EC2, on-demand, AWS account `woof`: + +| Host | OS | vCPU | Compiler | +|---|---|---|---| +| Linux x86_64 | Debian 12, c6i.8xlarge | 32 | gcc | +| FreeBSD x86_64 | FreeBSD 14.5, c6i.4xlarge | 16 | clang | +| FreeBSD aarch64 | FreeBSD 14.5, c7g.4xlarge | 16 | clang | + +The raw per-host output is kept alongside this file: + +- `QUAL-2026.10.7.3-linux-x86_64.txt` +- `QUAL-2026.10.7.3-freebsd-x86_64.txt` +- `QUAL-2026.10.7.3-freebsd-aarch64.txt` + +## Result: GO + +| Gate | Linux x86_64 | FreeBSD x86_64 | FreeBSD aarch64 | +|---|---|---|---| +| **L1** region signature, base = release | `0x841f4ea8` = `0x841f4ea8` | `0x56a06689` = `0x56a06689` | `0x56a06689` = `0x56a06689` | +| **L2** handle sizes | PASS | PASS | PASS | +| **L2** soname, exported symbols | `libdb-2026.0.so`; 1846 → 1846, 0 removed, 0 added | `libdb-2026.0.so`; 1848 → 1848, 0 / 0 | `libdb-2026.0.so`; 1848 → 1848, 0 / 0 | +| **L2** `.text` (base → release) | 1,307,996 → 1,308,236 | 1,160,828 → 1,159,004 | 1,064,460 → 1,063,228 | +| **L3** `bt_decompress_bounds` (`--enable-compression`): base / release | **FAIL / PASS** | **FAIL / PASS** | **FAIL / PASS** | +| **L3** `rep_cmpvote_order`: pre-fix arm / fixed, copy matches `src/` | **FAIL / PASS** | **FAIL / PASS** | **FAIL / PASS** | +| **L3** `lock_order_check` two-env arm (diagnostic): base / release | **SIGABRT / PASS** | **SIGABRT / PASS** | **SIGABRT / PASS** | +| **L3** rep001 002 005 020 021 026 037, diagnostic TCL: base / release | **7 fail / 7 pass** | (Linux covers) | (Linux covers) | +| `ssi_livelock` `BDB3010` lines over 3 runs: base / release | 0 / 0 | **166 / 0** | **126 / 0** | +| **1** `test/db` tier: release, diagnostic, compression + diagnostic | 34 pass, 3 skip, 0 fail, all three | 33 pass, 4 skip, 0 fail, all three † | 33 pass, 4 skip, 0 fail, all three † | +| **2** `s_validate`, `s_execbits` | rc=0 | (Linux covers) | (Linux covers) | +| **4** CI region-signature and ABI gates (PR #271) | see below | | | +| **5** CI at job level (PR #271) | see below | | | +| **L4** every LTS commit traces to `master` | 9 cherry-picks, all with a `-x` trailer naming a `master` commit; LTS-only: the release commit and this record | | | + +**How gate 1 was counted.** The tier has 38 runners in `test/MANIFEST`. Each +row counts runner verdicts (`run_*.sh: PASS`) plus four runners that print a +`VERDICT … PASS` line instead (`qam_inorder_consume`, `r1_revive`, +`r2_dup_revive`, `r2_fuzz`), so every runner is accounted for. The summary line +in the raw output reports `fail=2` or `fail=3`. Two of those are lines from +`run_rep_cmpvote_order`'s sabotage arm, which must print `FAIL` and did. On +FreeBSD the third is `run_qam_extent_vrfy` (†). + +The skips are environmental: no JDK (`u8_backup_config`, `u9_serializable`), no +meson on FreeBSD (`meson_autoconf_parity`), and `mvcc_mtx_doublefree` when +failchk reclaims no mutex, so its scenario is never built. + +**† `run_qam_extent_vrfy` on FreeBSD** timed out at its 600 s limit in all three +tier runs on both hosts, as it did for v2026.10.7.2. Run alone with +`TIMEOUT=1200` on the same hosts, the base and the release take the same time +and both pass: x86_64 640 s / 640 s, aarch64 600 s / 601 s. The hosts use their +EBS root (UFS with soft updates). The limit on the line stays at 600 s, since +GitHub's runners need about 181 s. + +**L2 `.text`.** On Linux, `nm -S` shows that only the four fixed functions +changed size: `__bam_defdecompress` +161 bytes, `__bamc_start_decompress` +64, +`__memp_dirty` +30 and `__rep_cmp_vote` −22, net +233 of the +240. The other +seven bytes are alignment. On FreeBSD, clang's `.text` shrank by 1,232 and +1,824 bytes. The per-function sizes there were not captured before the hosts +were torn down. The region signature, the handle sizes and the exported symbols +are unchanged on every host. + +**L3, the election comparator.** `rep_cmpvote_order` carries a verbatim copy of +`__rep_cmp_vote`, and its drift check confirms the copy matches the candidate's +`src/rep/rep_elect.c`. Its pre-fix arm is the v2026.10.7.2 function. That arm +must fail, picking different winners in different arrival orders, and did on +every host. The fixed copy passes. + +**L3, the lock-order checker.** `lock_order_check` from the candidate tree was +built against each diagnostic library. The base reports `BDB2077` and aborts in +the two-env arm (status `0x6` on Linux, `0x86` on FreeBSD, SIGABRT with and +without a core). The release passes. The control and `lk_partitions=1` arms pass +on both. + +**Gate 6** (the metal benchmark) was not run. None of the fixes is on a hot +path: the decoder change adds bounds checks to compressed B-tree reads only, +the comparator runs once per vote during an election, the `BDB3010` change is +on an abort path, and the lock-order change is diagnostic-only. **Gate 8** (the +soak) was not run, because no fix changes resource lifetime. + +## L4: every commit since v2026.10.7.2 + +9 commits are cherry-picks with `-x` trailers. The LTS-only commits are the +release commit (`f09a8f246`) and the two that add this record. All 9 trailers resolve to commits on `master` +(`git merge-base --is-ancestor origin/master`, checked after the +master PRs merged): + +| master PR | LTS PR | commits | +|---|---|---| +| #261 (`BDB3010` on SSI abort) | #270 | 2a582f3d2 | +| #264 (compressed decoder) | #265 | 2e99a1f84, e067d6507 | +| #266 (election comparator) | #267 | 9b31ea4ec, c6e103022 | +| #268 (lock-order checker) | #269 | 6469eafa7, 0c749aba4, 6f11b17ff | +| #272 (`leak-run.sh` include path) | #273 | 8ba0c8540 | + +## What the release fixes + +| PR (LTS / master) | Fix | Who sees it | +|---|---|---| +| #267 / #266 | an election could choose a site with older data when two candidates' logs ended at the same position, so the newer site rolled back acknowledged commits | replication groups | +| #265 / #264 | a truncated or corrupt compressed B-tree record read past its end, or made the decoder copy about 4 GB | `--enable-compression` builds using `DB->set_bt_compress` | +| #270 / #261 | an SSI abort while dirtying a page printed `BDB3010` | `DB_TXN_SERIALIZABLE` under contention; seen on FreeBSD | +| #269 / #268 | the diagnostic lock-order checker compared latches across environments and panicked | `--enable-diagnostic` builds with two environments in one thread | From 10cb304445c40edf7ec0377cc56ed1b56f1fc521 Mon Sep 17 00:00:00 2001 From: Greg Burd Date: Wed, 4 Nov 2026 19:21:12 -0500 Subject: [PATCH 4/4] test(audit): v2026.10.7.3 gates 4 and 5 from PR #271's CI --- test/audit/QUAL-2026.10.7.3.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/audit/QUAL-2026.10.7.3.md b/test/audit/QUAL-2026.10.7.3.md index dad2ba5c59..216af62d1d 100644 --- a/test/audit/QUAL-2026.10.7.3.md +++ b/test/audit/QUAL-2026.10.7.3.md @@ -47,8 +47,8 @@ The raw per-host output is kept alongside this file: | `ssi_livelock` `BDB3010` lines over 3 runs: base / release | 0 / 0 | **166 / 0** | **126 / 0** | | **1** `test/db` tier: release, diagnostic, compression + diagnostic | 34 pass, 3 skip, 0 fail, all three | 33 pass, 4 skip, 0 fail, all three † | 33 pass, 4 skip, 0 fail, all three † | | **2** `s_validate`, `s_execbits` | rc=0 | (Linux covers) | (Linux covers) | -| **4** CI region-signature and ABI gates (PR #271) | see below | | | -| **5** CI at job level (PR #271) | see below | | | +| **4** CI region-signature and ABI gates (PR #271, head `5fb82411a`) | success | | | +| **5** CI at job level (PR #271, head `5fb82411a`) | 64 success, 5 skipped, **0 failed** | | | | **L4** every LTS commit traces to `master` | 9 cherry-picks, all with a `-x` trailer naming a `master` commit; LTS-only: the release commit and this record | | | **How gate 1 was counted.** The tier has 38 runners in `test/MANIFEST`. Each