yegor256/rultor

Tail.FakeConnect.read() in src/main/java/com/rultor/agents/daemons/Tail.java reads the daemon directory with this.xml.xpath("/talk/daemon/dir/text() "), with a trailing space inside the XPath expression. Every other caller in the same file uses /talk/daemon/dir/text() without the trailing space, including SSHConnect.read() ten lines earlier and EndsDaemon.process() in the neighbouring class. The trailing space is tolerated by the current XPath engine, but the expression is no longer recognised by a literal search of the codebase, and the cosmetic drift between two callers that mean the same thing is a footgun the next time someone tries to refactor or grep for the XPath. The mismatch slipped past xslint because the literal is a Java string, not an XSL document. Drop the trailing space on the text() call at line 259 so the FakeConnect path matches the rest of the file. No behaviour change is expected.

src/main/java/com/rultor/Time.java, iso() at lines 66-71 and parse(String) at lines 86-93. iso() formats the millis in GMT and emits a trailing Z. parse(String) builds a SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss", Locale.US) and never calls setTimeZone, so the parser interprets the input in the JVM default time zone. SimpleDateFormat.parse is also lenient about trailing characters, so the Z written by iso() is silently dropped and never enforced. The result is that new Time(new Time(msec).iso()).msec() differs from msec by the JVM offset on every host where the default zone is not GMT/UTC. The daemon round-trips through these two methods on every build: started and ended are written via iso() into the talk XML and read back via new Time(string) in EndsRequest and elsewhere, so the elapsed-time numbers exposed to users are wrong by the offset on any non-UTC host, and the wall-clock columns shown on the website are wrong by the same offset. Smallest fix in parse(String): mirror iso() by se

Quite often, when I try to merge a pull request using Rultor, I get a confusing error like this: git push origin master remote: error: GH013: Repository rule violations found for refs/heads/master. remote: - A conversation must be resolved before this pull request can be merged. To github.com:objectionary/lints.git ! [remote rejected] master -> master (push declined due to repository rule violations) error: failed to push some refs to 'github.com:objectionary/lints.git' The problem is that the error comes from git push at the very end of the merge process — after Docker is started and the full build is run. At that point, the error message is raw and unhelpful. In this particular case, I had to figure out on my own that the rejection was caused by an outdated (but unresolved) review thread left by a reviewer on an already-superseded commit. GitHub branch protection rules can block a merge for various reasons: unresolved review conversations, missing required approvals, failing re

In src/main/java/com/rultor/agents/daemons/StartsDaemon.java, lines 209-218, the upload() method iterates over the entries of Profile.assets() and pipes each value to a remote shell: for (final Map.Entry<String, InputStream> asset : this.profile.assets().entrySet()) { shell.exec( String.format( "cat > %s", Ssh.escape(String.format("%s/%s", dir, asset.getKey())) ), asset.getValue(), Logger.stream(Level.INFO, true), Logger.stream(Level.WARNING, true) ); ... } Profile.assets() is declared in src/main/java/com/rultor/spi/Profile.java as returning Map<String, InputStream>, where the values are raw InputStream instances that the caller owns. Shell.exec() consumes the stream but does not close it. The loop discards each InputStream reference at the end of an iteration without ever calling close(). Every asset declared in .rultor.yml therefore leaks one InputStream per build start. With memory-backed profiles the l

What happens In src/main/java/com/rultor/agents/req/Decrypt.java, the GPG decryption command is built by interpolating the symmetric passphrase directly into a shell command line: final String script = String.format( "gpg --batch --decrypt --passphrase %s ...", Ssh.escape(String.format("rultor-key:%s", this.profile.name())) ); The passphrase rultor-key:<profile-name> is the actual symmetric secret used to decrypt the repository's .enc files. It is embedded into the run.sh script that StartsDaemon uploads to the build host, where run.sh runs under set -ex (StartsDaemon writes set -ex -o pipefail at the top of every script). With -x, bash prints every command — including this one with the passphrase — to stdout. That stdout is captured into the rultor build log, which is published. So a single rultor build of a public project writes the decryption passphrase in plaintext into a log that is publicly readable. Any reader who also obtains the .enc files can decrypt the repositor