Repository navigation
perf: shrink libcpex_ffi and harden cedar against small host stacks - #69
Merged
Merged
Conversation
Size-first release profile and a leaner tokio floor cut the statically linked FFI footprint, and the cedar dispatch is made host-stack-agnostic so musl-based hosts (Alpine) stop hitting Cedar's stack guard. - Add [profile.release]: opt-level="z", lto=true, codegen-units=1, strip=true. libcpex_ffi.a links statically into host binaries, so this flows into their image size; a representative statically-linked consumer shrank ~21%. panic="abort" is intentionally not set (the FFI relies on catch_unwind at its #[no_mangle] boundary). No API/ABI change. - Trim the workspace tokio feature floor from ["full"] to ["rt","rt-multi-thread","sync","time","macros"] (the real union used by the crates); reqwest/hyper still union net/io where needed. Drops the unused fs/process/signal surface and the signal-hook-registry dep. - Wrap the cedar dispatch (parse + build_entities + is_authorized) in apl-pdp-cedar-direct in stacker::maybe_grow. cedar-policy aborts with 'recursion limit reached' when stacker::remaining_stack() is below its 100 KiB floor; musl's 128 KiB default thread stack trips it on inputs glibc handles fine. maybe_grow runs cedar on a fresh, large segment when the host stack is low (a no-op on glibc). stacker dedups with cedar's transitive pin, so no new crates. Adds a regression test that evaluates on a 128 KiB stack. 770 tests pass (cargo test --workspace). Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
araujof
added
bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Size-first release profile and a leaner tokio floor cut the statically linked FFI footprint, and the cedar dispatch is made host-stack-agnostic so musl-based hosts (Alpine) stop hitting Cedar's stack guard.
Changes
Tests
770 tests pass (cargo test --workspace).