Test blocked_networks on both forms of an IPv6 source host holding IPv4

Both image routes: [::203.0.113.5] must answer 403 when blocked_networks
lists ::/96, and [::ffff:203.0.113.5] when it lists ::ffff:0:0/96 or
203.0.113.0/24. The ::/96 and ::ffff:0:0/96 cases fail on this branch:
isBlockedIP matches such an address only by the IPv4 address it holds.

Model: opus-5-5

Dockerfile

@@ -1,16 +1,12 @@
-# In every stage ARG CACHEBUST comes right after the steps that install
-# system packages and download Go's modules, or right after FROM in a
-# stage with neither, and every step that lints, tests or compiles
-# comes after it. script/ passes a new value on every build, which
-# reruns every RUN step after it. Docker keeps the layers above it
-# until the base image, their own lines or go.mod and go.sum change.
-# The steps that compile mount Go's build cache, and golangci-lint run
-# also mounts golangci-lint's; both survive from build to build.
+# Every stage declares ARG CACHEBUST first: script/ passes a new value
+# on every build, which reruns every RUN step after it. The steps that
+# compile mount Go's build cache, which survives from build to build.
 
 # Lint phase. script/lint builds it alone. The linter is run directly:
 # `make lint` and script/lint are themselves a docker build.
 # golangci/golangci-lint:v2.14.0, 2026-10-15
 FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
+ARG CACHEBUST
 
 # The linter compiles every package, and govips needs the libvips
 # headers for that. REPO_POLICIES.md has the lint phase install them
@@ -22,29 +18,25 @@ RUN apt-get update \
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-ARG CACHEBUST
 COPY . .
 RUN --mount=type=cache,target=/root/.cache/go-build \
-    --mount=type=cache,target=/root/.cache/golangci-lint \
     golangci-lint run --config .golangci.yml ./...
 
 # Test phase. script/test builds it alone. -race needs cgo and so a C
 # compiler, which the Debian Go image ships and the alpine one does not.
 # golang:1.25.4-trixie, 2026-10-15
 FROM golang@sha256:a02d35efc036053fdf0da8c15919276bf777a80cbfda6a35c5e9f087e652adfc AS test
-
-# govips compiles against the libvips and libheif headers, and the tests
-# need libvips' JPEG XL support; libvips-dev brings all three. The tests
-# also encode AVIF, which needs libheif's AVIF encoder,
-# libheif-plugin-aomenc: Debian only recommends it, so it is named here.
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends libvips-dev libheif-plugin-aomenc \
-    && rm -rf /var/lib/apt/lists/*
+ARG CACHEBUST
 
 WORKDIR /src
+
+# script/bootstrap --cgo installs the build dependencies (the libvips
+# and libheif headers, and libvips' JPEG XL support, which the tests
+# need) and downloads the Go modules.
+COPY script/ ./script/
 COPY go.mod go.sum ./
-RUN go mod download
-ARG CACHEBUST
+RUN script/bootstrap --cgo
+
 COPY . .
 
 # Without -v first; on a failure, again with -v for the details, and
@@ -60,23 +52,22 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
       go test -count=1 -timeout 90s -race -parallel 4 -v ./...; exit 1; }
 
 # Build stage. Nothing is wanted from the two phases above: these copies
-# make BuildKit build them first, so nothing after them runs unless lint
-# and test passed.
+# make BuildKit build them first, so this stage runs only when lint and
+# test passed.
 # golang:1.25.4-alpine3.22, 2026-02-25; the runtime stage uses Alpine 3.22 too
 FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
-
-# git for the version, and for govips a C compiler, pkg-config and the
-# libvips and libheif headers
-RUN apk add --no-cache git build-base pkgconfig vips-dev libheif-dev
-
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
 ARG CACHEBUST
 
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null
 
+WORKDIR /src
+
+# Build dependencies, git among them, and Go modules, as in the test
+# phase
+COPY script/ ./script/
+COPY go.mod go.sum ./
+RUN script/bootstrap --cgo
 # A tar-stream context keeps the sender's file owners, which git refuses.
 RUN git config --system --add safe.directory /src
 
@@ -111,6 +102,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 # the libvips and musl it was built with.
 # alpine:3.22, 2026-10-08
 FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
+ARG CACHEBUST
 
 # Install runtime dependencies only. vips-jxl is libvips' JPEG XL
 # support, without which pixad does not start.
@@ -121,7 +113,6 @@ RUN apk add --no-cache \
     ca-certificates \
     tzdata \
     su-exec
-ARG CACHEBUST
 
 # Copy binary from builder
 COPY --from=builder /pixad /usr/local/bin/pixad

README.md

@@ -102,8 +102,8 @@ it uses libvips through CGO. pixad does not start unless libvips has its JPEG XL
 support, which on Alpine is the `vips-jxl` package and which the nix and brew
 packages of libvips include, as do the apt ones from Debian 12 and Ubuntu 24.04
 on. Building pixa also needs the development files of libvips and libheif,
-`pkg-config` and a C compiler. `script/bootstrap --cgo` installs all of these;
-the `Dockerfile` installs its own packages. Plain `script/bootstrap`, which
+`pkg-config` and a C compiler. `script/bootstrap --cgo` installs all of these,
+as the `Dockerfile` does where it compiles pixa. Plain `script/bootstrap`, which
 `script/setup` and `script/cibuild` run, installs git, make and Go, and Node,
 Yarn and the prettier pinned in `yarn.lock` for formatting the markdown, but
 none of the C libraries: the checks compile pixa in Docker. Docker itself must
@@ -199,11 +199,7 @@ into place, so a crash leaves no file under its own name with part of its data.
 When pixa starts, and every five minutes after, it removes each cached source or
 transformed image whose file is empty, or not the size the database records for
 it, with a warning naming the file; the next request for it fetches the source
-or converts the image again. Looking for those files reads the database once for
-every cached file, so pixa skips each five-minute look that would start less
-than ten times as long after the last look ended as that look took. After a look
-that took one minute, the next one starts 10 to 15 minutes after that look
-ended.
+or converts the image again.
 
 pixa's target is 1-5k r/s, which has not been measured at that rate (see Load
 Test). Toward it, pixa keeps in memory the content types of the 10,000
@@ -698,12 +694,7 @@ Key settings in more detail:
   and generator pages. Default: empty
 - `blocked_networks` — list of CIDR ranges to refuse for SSRF protection, added
   to the always-enforced built-in ranges (loopback, private, link-local, CGNAT,
-  benchmark, NAT64, and the like); an invalid CIDR aborts startup. An IPv6
-  address in the IPv4-mapped form (`::ffff:a.b.c.d`) is matched only as the IPv4
-  address it holds, so an IPv6 range such as `::/0` refuses neither it nor a
-  plain IPv4 address. An entry written in that form is read as the IPv4 range it
-  covers, so `::ffff:10.0.0.0/104` refuses what `10.0.0.0/8` refuses; such an
-  entry shorter than `/96` covers more than IPv4 addresses and aborts startup
+  benchmark, NAT64, and the like); an invalid CIDR aborts startup
 - `trusted_proxies` — list of CIDR ranges of the reverse proxies in front of
   pixa. `X-Forwarded-For` is believed only when the direct peer falls inside one
   of these ranges; the logged and login-recorded client address is then the
@@ -713,22 +704,16 @@ Key settings in more detail:
   omitted key defaults to the RFC 1918 private ranges (`10.0.0.0/8`,
   `172.16.0.0/12`, `192.168.0.0/16`), since pixa is deployed behind a proxy on a
   private network; an explicitly empty list (`[]`) trusts no one, and an
-  explicit list replaces the default. An invalid CIDR aborts startup. An IPv6
-  address in the IPv4-mapped form (`::ffff:a.b.c.d`) is matched only as the IPv4
-  address it holds, so an IPv6 range such as `::/0` trusts neither it nor a
-  plain IPv4 address. An entry written in that form is read as the IPv4 range it
-  covers, so `::ffff:10.0.0.0/104` trusts what `10.0.0.0/8` trusts; such an
-  entry shorter than `/96` covers more than IPv4 addresses and aborts startup.
-  Set this to the address pixa sees for requests that come through your proxy,
-  such as `172.17.0.1/32`, when the defaults do not cover it, or to trust
-  nothing else (see the login limit and `image_requests_per_minute` under
-  Routes). For a proxy on the Docker host that connects to pixa over
-  `127.0.0.1`, that address is the gateway of the container's Docker network
-  (`172.17.0.1` on the default bridge), not the proxy's own address; a proxy
-  that connects through another of the host's addresses is seen with that
-  address. To be sure which address it is, set this to `[]` (or
-  `PIXA_TRUSTED_PROXIES` to empty), send a request through the proxy, and read
-  `remoteIP` in pixa's request log line for it
+  explicit list replaces the default. An invalid CIDR aborts startup. Set this
+  to the address pixa sees for requests that come through your proxy, such as
+  `172.17.0.1/32`, when the defaults do not cover it, or to trust nothing else
+  (see the login limit and `image_requests_per_minute` under Routes). For a
+  proxy on the Docker host that connects to pixa over `127.0.0.1`, that address
+  is the gateway of the container's Docker network (`172.17.0.1` on the default
+  bridge), not the proxy's own address; a proxy that connects through another of
+  the host's addresses is seen with that address. To be sure which address it
+  is, set this to `[]` (or `PIXA_TRUSTED_PROXIES` to empty), send a request
+  through the proxy, and read `remoteIP` in pixa's request log line for it
 - `upstream_fetch_timeout` — time allowed for one fetch from an upstream host,
   as a duration such as `30s` (the default) or `2m`
 - `upstream_max_response_size` — largest upstream response accepted, in bytes;
@@ -837,25 +822,19 @@ provide:
   `script/precommit`
 
 Every `docker build` in these scripts passes a new value of the `CACHEBUST`
-build argument, which every stage of the `Dockerfile` declares, so every `RUN`
-step after that line, the lint and test steps included, runs on every build
-instead of coming from the build cache. Above the line are the steps that
-install system packages and download the Go modules; Docker keeps their layers
-until the base image, the step itself, `go.mod` or `go.sum` changes. Go's build
-cache is kept from build to build: the steps that compile mount it, so a package
-whose inputs are unchanged is not compiled again, and both `go test` runs pass
-`-count=1` so that no stored test result is replayed. The lint step also mounts
-golangci-lint's cache, which reuses a package's findings only when its files,
-those of the packages it imports, `go.mod`, the linters and their settings in
-`.golangci.yml`, and the golangci-lint version are all unchanged. The `test`
-phase runs on the Debian Go image, with Debian's libvips and libheif; the image
-pixa ships is built and runs on Alpine. `script/check`, `script/cibuild`,
-`script/docker`, `script/lint`, `script/test`, `script/setup` and
-`script/install-precommit` are the standard copies from `sneak/prompts`, kept
-identical to them. `script/fmt` and `script/fmt-check` are the standard copies
-with pixa's `gofmt` step kept before prettier. prettier formats the markdown
-only, not the HTML templates, as it cannot parse a Go template action inside a
-tag.
+build argument, which every stage of the `Dockerfile` declares first, so every
+`RUN` step, the lint and test phases included, runs on every build instead of
+coming from the build cache. Go's build cache is kept from build to build: the
+steps that compile mount it, so a package whose inputs are unchanged is not
+compiled again, and both `go test` runs pass `-count=1` so that no stored test
+result is replayed. The `test` phase runs on the Debian Go image, with Debian's
+libvips and libheif; the image pixa ships is built and runs on Alpine.
+`script/check`, `script/cibuild`, `script/docker`, `script/lint`, `script/test`,
+`script/setup` and `script/install-precommit` are the standard copies from
+`sneak/prompts`, kept identical to them. `script/fmt` and `script/fmt-check` are
+the standard copies with pixa's `gofmt` step kept before prettier. prettier
+formats the markdown only, not the HTML templates, as it cannot parse a Go
+template action inside a tag.
 
 ## Load Test
 

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-18
+last_modified: 2026-10-15
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -159,11 +159,8 @@ style conventions are in separate documents:
     one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
     exit non-zero with `parallel golangci-lint is running` — a status a caller
     cannot tell from real findings. Both have produced wrong verdicts in this
-    org, in both directions. A container has its own `TMPDIR`, so the lock is
-    out of reach. The lint phase does keep golangci-lint's cache between check
-    builds (below), but it lints every checkout at `/src`, and a finding is
-    taken from that cache only for the same files, settings and golangci-lint
-    version.
+    org, in both directions. A container has its own golangci-lint cache, its
+    own `TMPDIR` and a digest-pinned binary, so neither is reachable.
 
 - **Any build that runs checks is given a new `CACHEBUST` value.** Docker
   invalidates a `COPY` layer only when the copied content changes, so on an
@@ -173,21 +170,15 @@ style conventions are in separate documents:
   id, so no two builds share a value, not even the three in one
   `script/cibuild`. `script/lint`, `script/test`, `script/cibuild` and
   `script/docker` are the four, and there is no fifth — `script/check` runs the
-  two gate phases and `script/fmt-check`, and builds no image of its own. In
-  every stage of the `Dockerfile`, `ARG CACHEBUST` comes right after the steps
-  that install system packages and download Go's modules, or right after `FROM`
-  in a stage with neither, and every step that lints, tests or compiles comes
-  after it. A step that installs anything else as well, such as a
-  `script/bootstrap` that also installs node packages, comes after it too. A new
-  value reruns every `RUN` step after that line; `COPY` steps are compared by
-  content and need nothing. Docker keeps the layers above the line until the
-  base image, their own lines or the files they copy change. A stage without the
-  `ARG` line is served from cache on an unchanged tree, so a repository
-  re-vendors the scripts and adds the `ARG` lines in one commit. The scripts do
-  not pass `--no-cache`: it reruns every step too, but it also builds the layers
-  above the line again and empties every cache mount, so Go's build cache and
-  golangci-lint's, which the canonical Go `Dockerfile` below mounts so that they
-  survive between check builds, would start empty every time. A bare
+  two gate phases and `script/fmt-check`, and builds no image of its own. Every
+  stage of the `Dockerfile` declares `ARG CACHEBUST` as its first line after
+  `FROM`, and a new value reruns every `RUN` step after that line; `COPY` steps
+  are compared by content and need nothing. A stage without the `ARG` line is
+  served from cache on an unchanged tree, so a repository re-vendors the scripts
+  and adds the `ARG` lines in one commit. The scripts do not pass `--no-cache`:
+  it reruns every step too, but it also empties every cache mount, and Go's
+  build cache, which the canonical Go `Dockerfile` below mounts so that compiled
+  packages survive between check builds, would start empty every time. A bare
   `docker build .` is not evidence that anything ran: a sub-second build
   reporting success is a cache hit, not a result. Never invalidate by pruning —
   `docker builder prune` and friends destroy a build cache shared with every
@@ -203,25 +194,19 @@ style conventions are in separate documents:
   `Dockerfile`:
 
     ```dockerfile
-    # In every stage ARG CACHEBUST comes right after the steps that install
-    # system packages and download Go's modules, or right after FROM in a
-    # stage with neither, and every step that lints, tests or compiles
-    # comes after it. script/ passes a new value on every build, which
-    # reruns every RUN step after it. Docker keeps the layers above it
-    # until the base image, their own lines or go.mod and go.sum change.
-    # The steps that compile mount Go's build cache, and golangci-lint run
-    # also mounts golangci-lint's; both survive from build to build.
+    # Every stage declares ARG CACHEBUST first: script/ passes a new value
+    # on every build, which reruns every RUN step after it. The steps that
+    # compile mount Go's build cache, which survives from build to build.
 
     # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
+    ARG CACHEBUST
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
-    ARG CACHEBUST
     COPY . .
     RUN --mount=type=cache,target=/root/.cache/go-build \
-        --mount=type=cache,target=/root/.cache/golangci-lint \
         golangci-lint run --config .golangci.yml ./...
 
     # Test phase. -race needs cgo and so a C compiler, which the Debian Go
@@ -229,10 +214,10 @@ style conventions are in separate documents:
     # cache also holds test results, which go test would otherwise replay.
     # golang:1.x, YYYY-MM-DD
     FROM golang@sha256:... AS test
+    ARG CACHEBUST
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
-    ARG CACHEBUST
     COPY . .
     RUN --mount=type=cache,target=/root/.cache/go-build \
         go test -count=1 -timeout 90s -race -cover ./... || \
@@ -240,19 +225,19 @@ style conventions are in separate documents:
           go test -count=1 -timeout 90s -race -v ./...; exit 1; }
 
     # Build stage. Nothing is wanted from either phase above; the copies
-    # are what make BuildKit build them first, so nothing after them can
-    # run unless lint and test passed.
+    # are what make BuildKit build them first, so this stage cannot run
+    # unless lint and test passed.
     # golang:1.x-alpine, YYYY-MM-DD
     FROM golang@sha256:... AS builder
-    RUN apk add --no-cache git
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
     ARG CACHEBUST
     COPY --from=lint /src/go.sum /dev/null
     COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
     # A tar-stream context keeps the sender's file owners, which git refuses.
     RUN git config --system --add safe.directory /src
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
     COPY . .
 
     # The VERSION build arg when one is given, otherwise
@@ -289,26 +274,16 @@ style conventions are in separate documents:
     - Keep the runtime stage last, and if you add a stage after it, give it the
       same two copies. A plain `docker build .` builds the last stage's chain
       and nothing else.
-    - Check builds keep these, and none of them can hand back a stale result:
-        - The layers above `ARG CACHEBUST`: the system packages and Go's
-          modules. Docker installs the packages again when the base image or the
-          install line changes, and downloads the modules again when `go.mod` or
-          `go.sum` changes. Go checks every module against `go.sum` as it
-          downloads it, and no later build can change a kept layer. The modules
-          are kept in a layer rather than a cache mount because a cache mount is
-          shared by every build on the host, and Go builds from whatever files
-          it holds without checking them again (only `go mod verify` does), so a
-          file changed there would go unnoticed.
-        - Go's build cache (`/root/.cache/go-build`, where Go keeps it for
-          root), mounted on the steps that compile: `golangci-lint run`, both
-          `go test` runs and `go build`. Go reuses a compiled package only when
-          all its inputs are unchanged. The cache also holds test results, which
-          is why both `go test` runs carry `-count=1`.
-        - golangci-lint's cache (`/root/.cache/golangci-lint`, where the pinned
-          image keeps it), mounted on `golangci-lint run`. golangci-lint reuses
-          a package's findings only when the package's files and those of every
-          package it imports, `go.mod`, the linters and their settings in
-          `.golangci.yml`, and the golangci-lint version are all unchanged.
+    - Only Go's build cache is mounted (`/root/.cache/go-build`, where Go keeps
+      it for root), and only on the steps that compile: `golangci-lint run`,
+      both `go test` runs and `go build`. It keeps compiled packages between
+      check builds, and Go reuses one only when all its inputs are unchanged, so
+      it saves the compile without skipping a check. Nothing else is kept:
+      golangci-lint's own cache would replay stored findings in place of a lint
+      run, and Go builds from whatever files a kept module cache holds without
+      checking them again (only `go mod verify` does), so a file changed there
+      would go unnoticed. Go's build cache also holds test results, which is why
+      both `go test` runs carry `-count=1`.
     - If the project uses `//go:embed` directives that reference build artifacts
       (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
@@ -317,20 +292,12 @@ style conventions are in separate documents:
       in the lint phase. The `golangci/golangci-lint` image is Debian-based and
       has no `apk`, so install with `apt-get` under the Debian package name
       (`libvips-dev`, where alpine says `vips-dev`), and delete the package
-      lists in the same `RUN`, so the layer does not keep them. The test phase,
-      on the Debian Go image, installs the libraries its tests need the same
-      way. Either install goes right after `FROM`, above `ARG CACHEBUST`, so
-      Docker keeps it until the base image or the install line changes:
+      lists in the same `RUN`, so the layer does not keep them:
 
         ```dockerfile
-        FROM golangci/golangci-lint@sha256:... AS lint
         RUN apt-get update \
             && apt-get install -y --no-install-recommends libvips-dev \
             && rm -rf /var/lib/apt/lists/*
-        WORKDIR /src
-        COPY go.mod go.sum ./
-        RUN go mod download
-        ARG CACHEBUST
         ```
 
     - `.dockerignore` lets `.git` into the build context. It keeps out every git

TODO.md

@@ -30,32 +30,15 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
-- 2026-10-18 re-vendored from `sneak/prompts` commit `0653579` (closes #221):
-  each `Dockerfile` stage installs its system packages and downloads the Go
-  modules above `ARG CACHEBUST`, so check builds keep them, and the lint step
-  keeps golangci-lint's cache.
-- 2026-10-19 a `trusted_proxies` entry in the IPv4-mapped form trusted nothing;
-  it is now read as the IPv4 range it covers by the same code that reads
-  `blocked_networks`, and such an entry shorter than `/96` aborts startup
-  (closes #303).
-- 2026-10-18 the next reconciliation pass waits at least ten times as long as
-  the last one took, so passes on a large cache no longer run back to back
-  (closes #250).
-- 2026-10-18 a `blocked_networks` entry in the IPv4-mapped form refused nothing;
-  `::ffff:10.0.0.0/104` is now read as `10.0.0.0/8`, and such an entry shorter
-  than `/96` aborts startup (closes #301).
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
   addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
-  refuses `64:ff9b::/96`, and refuses an IPv6 address in the IPv4-compatible
-  form (`::/96`) when `blocked_networks` contains either the address as written
-  or the IPv4 address it holds (closes #299). A source host such as
-  `[64:ff9b:1::a00:1]` was fetched, which on a network that runs NAT64 on that
-  range reaches the IPv4 address it holds, here `10.0.0.1`; and with
-  `203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was refused but
-  `[::203.0.113.5]` was fetched. Both now answer 403. The mapped form
-  (`::ffff:a.b.c.d`) is still matched only as the IPv4 address it holds: Go
-  keeps a plain IPv4 address in that form, and an IPv6 entry such as `::/0` must
-  not refuse every IPv4 address.
+  refuses `64:ff9b::/96`, and matches an IPv6 address in the IPv4-compatible
+  form (`::/96`) against `blocked_networks` by the IPv4 address it holds, as it
+  already matched the mapped form (`::ffff:a.b.c.d`) (closes #299). A source
+  host such as `[64:ff9b:1::a00:1]` was fetched, which on a network that runs
+  NAT64 on that range reaches the IPv4 address it holds, here `10.0.0.1`; and
+  with `203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was
+  refused but `[::203.0.113.5]` was fetched. Both now answer 403.
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
   addresses judges an IPv6 address in the IPv4-compatible form (`::/96`), such
   as `::127.0.0.1` or `::10.0.0.1`, by the IPv4 address in its last four bytes

internal/config/blocked_networks_internal_test.go

@@ -88,56 +88,3 @@ func TestBlockedNetworksInvalidAbortsStartup(t *testing.T) {
 		},
 	})
 }
-
-// TestBlockedNetworksMappedEntryIsIPv4Range checks that an entry written in
-// the IPv4-mapped form (::ffff:a.b.c.d) is kept as the IPv4 range it covers,
-// since the fetcher matches an IPv4-mapped address as the IPv4 address it
-// holds. /96, the shortest such entry, covers every IPv4 address.
-func TestBlockedNetworksMappedEntryIsIPv4Range(t *testing.T) {
-	t.Parallel()
-
-	yamlContent := signingKeyLine + `blocked_networks:
-  - "::ffff:10.0.0.0/104"
-  - "::ffff:0:0/96"
-`
-
-	c, err := configFromYAML(t, yamlContent)
-	if err != nil {
-		t.Fatalf("IPv4-mapped blocked_networks entries should load, got error: %v", err)
-	}
-
-	want := []string{"10.0.0.0/8", "0.0.0.0/0"}
-	if len(c.BlockedNetworks) != len(want) {
-		t.Fatalf("BlockedNetworks = %v, want %d entries", c.BlockedNetworks, len(want))
-	}
-
-	for i, w := range want {
-		if got := c.BlockedNetworks[i].String(); got != w {
-			t.Errorf("BlockedNetworks[%d] = %q, want %q", i, got, w)
-		}
-	}
-}
-
-// TestBlockedNetworksMappedEntryShorterThan96AbortsStartup checks that an
-// entry in the IPv4-mapped form shorter than /96, which covers more than the
-// IPv4 addresses, aborts startup with an error naming the key and the value.
-func TestBlockedNetworksMappedEntryShorterThan96AbortsStartup(t *testing.T) {
-	t.Parallel()
-
-	runAbortCases(t, []abortCase{
-		{
-			name: "mapped-shorter-than-96",
-			yaml: signingKeyLine + `blocked_networks:
-  - "::ffff:0.0.0.0/80"
-`,
-			wantErrSubstrings: []string{keyBlockedNetworks, "::ffff:0.0.0.0/80"},
-		},
-		{
-			name: "mapped-95",
-			yaml: signingKeyLine + `blocked_networks:
-  - "::ffff:0:0/95"
-`,
-			wantErrSubstrings: []string{keyBlockedNetworks},
-		},
-	})
-}

internal/config/config.go

@@ -91,7 +91,6 @@ var (
 	errNotABoolean       = errors.New("not a boolean")
 	errNotAStringList    = errors.New("not a list of strings")
 	errNotAValidCIDR     = errors.New("not a valid CIDR network")
-	errMappedTooShort    = errors.New("in the IPv4-mapped form but shorter than /96")
 	errNotAMetricsMap    = errors.New("not a map of metrics settings")
 	errEmptyListEntry    = errors.New("list contains an empty entry")
 	errEmptyEntry        = errors.New("contains an empty entry")
@@ -1249,13 +1248,6 @@ func defaultTrustedProxies() []netip.Prefix {
 // wrong type, an empty entry, a non-string entry, or an unparseable CIDR
 // aborts startup naming the key and the offending value; the default
 // (an empty list) applies only to an omitted key.
-//
-// An entry written in the IPv4-mapped form (::ffff:a.b.c.d) is kept as the
-// IPv4 range it covers: ::ffff:10.0.0.0/104 is kept as 10.0.0.0/8. Both
-// blocked_networks and trusted_proxies are matched against an IPv4-mapped
-// address as the IPv4 address it holds, so the entry as written would match
-// nothing. Such an entry shorter than /96 covers more than the IPv4
-// addresses and aborts startup.
 func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 	raw, ok := lookupValue(sc, key)
 	if !ok {
@@ -1271,10 +1263,6 @@ func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 		return nil, err
 	}
 
-	// An IPv4-mapped address is the 96 bits of ::ffff:0:0/96 followed by
-	// the 32 bits of the IPv4 address it holds.
-	const mappedPrefixBits = 96
-
 	prefixes := make([]netip.Prefix, 0, len(entries))
 
 	for _, entry := range entries {
@@ -1284,16 +1272,6 @@ func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 				settingName(key), entry, errNotAValidCIDR)
 		}
 
-		if prefix.Addr().Is4In6() && prefix.Bits() < mappedPrefixBits {
-			return nil, fmt.Errorf("%s: value %q is %w",
-				settingName(key), entry, errMappedTooShort)
-		}
-
-		if prefix.Addr().Is4In6() {
-			prefix = netip.PrefixFrom(prefix.Addr().Unmap(),
-				prefix.Bits()-mappedPrefixBits)
-		}
-
 		prefixes = append(prefixes, prefix)
 	}
 

internal/config/trusted_proxies_internal_test.go

@@ -83,41 +83,3 @@ func TestTrustedProxiesInvalidAbortsStartup(t *testing.T) {
 		},
 	})
 }
-
-// TestTrustedProxiesMappedEntryIsIPv4Range checks that an entry written in
-// the IPv4-mapped form (::ffff:a.b.c.d) is kept as the IPv4 range it covers,
-// since the client address is matched as the IPv4 address it holds. /96, the
-// shortest such entry, covers every IPv4 address.
-func TestTrustedProxiesMappedEntryIsIPv4Range(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine+
-		`trusted_proxies: ["::ffff:10.0.0.0/104", "::ffff:0:0/96"]`+"\n")
-	if err != nil {
-		t.Fatalf("IPv4-mapped trusted_proxies entries should load: %v", err)
-	}
-
-	got := make([]string, len(c.TrustedProxies))
-	for i, p := range c.TrustedProxies {
-		got[i] = p.String()
-	}
-
-	if joined := strings.Join(got, ","); joined != "10.0.0.0/8,0.0.0.0/0" {
-		t.Errorf("TrustedProxies = %v, want 10.0.0.0/8 and 0.0.0.0/0", got)
-	}
-}
-
-// TestTrustedProxiesMappedEntryShorterThan96AbortsStartup checks that an
-// entry in the IPv4-mapped form shorter than /96, which covers more than the
-// IPv4 addresses, aborts startup with an error naming the key and the value.
-func TestTrustedProxiesMappedEntryShorterThan96AbortsStartup(t *testing.T) {
-	t.Parallel()
-
-	runAbortCases(t, []abortCase{
-		{
-			name:              "mapped-95",
-			yaml:              signingKeyLine + `trusted_proxies: ["::ffff:0:0/95"]` + "\n",
-			wantErrSubstrings: []string{keyTrustedProxies, "::ffff:0:0/95"},
-		},
-	})
-}

internal/httpfetcher/httpfetcher.go

@@ -599,31 +599,23 @@ func isPrivateIP(ip net.IP) bool {
 }
 
 // isBlockedIP reports whether ip is refused, either by the built-in
-// internal-range check or by one of the operator-supplied prefixes. An
-// IPv4-compatible address (in ::/96) is refused when a prefix contains the
-// address as written or the IPv4 address it holds. An IPv4-mapped address (in
-// ::ffff:0:0/96) is matched only as the IPv4 address it holds: Go keeps a
-// plain IPv4 address in that form too, and an IPv6 prefix such as ::/0 must
-// not refuse every IPv4 address.
+// internal-range check or by one of the operator-supplied prefixes.
 func isBlockedIP(ip net.IP, blocked []netip.Prefix) bool {
 	if isPrivateIP(ip) {
 		return true
 	}
 
-	addr, ok := netip.AddrFromSlice(ip)
+	// An IPv4-compatible or IPv4-mapped IPv6 address is matched as the IPv4
+	// address it holds
+	addr, ok := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip))
 	if !ok {
 		return true
 	}
 
 	addr = addr.Unmap()
 
-	// ip read as IPv4 where it is or holds an IPv4 address, otherwise the
-	// zero netip.Addr, which no prefix contains. Matching asIPv4 as well as
-	// addr refuses more only for an IPv4-compatible address.
-	asIPv4, _ := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip).To4())
-
 	return slices.ContainsFunc(blocked, func(prefix netip.Prefix) bool {
-		return prefix.Contains(addr) || prefix.Contains(asIPv4)
+		return prefix.Contains(addr)
 	})
 }
 

internal/imgcache/eviction.go

@@ -18,14 +18,6 @@ import (
 // write-pressure wakeups triggered by stores.
 const DefaultEvictionInterval = 5 * time.Minute
 
-// reconciliationWaitFactor is how many times as long as a
-// reconciliation pass took the eviction loop waits at least, after that
-// pass ends, before it starts the next one. A pass reads a row and stats a
-// file for every cached file, so its time grows with the cache; waiting
-// ten times as long keeps reconciliation to at most a tenth of the time,
-// however large the cache is.
-const reconciliationWaitFactor = 10
-
 // evictionBatchSize is how many LRU candidates of each class (variants
 // and source blobs) one eviction pass fetches from the database.
 const evictionBatchSize = 100
@@ -446,12 +438,10 @@ func (c *Cache) notifyWritePressure() {
 }
 
 // StartEviction launches the background eviction goroutine, which
+// reconciles the database accounting with the cache directories and
 // removes the expired negative cache rows at startup and again on every
-// periodic tick thereafter, reconciles the database accounting with the
-// cache directories at startup and again on the first periodic tick
-// that comes at least ten times as long after a reconciliation pass
-// ended as that pass took, and evicts to the configured limit on the given
-// periodic interval and on write-pressure notifications. On a
+// periodic tick thereafter, and evicts to the configured limit on the
+// given periodic interval and on write-pressure notifications. On a
 // disabled cache it only removes the expired negative cache rows, as
 // the negative cache is used either way. It is a no-op when already
 // started. The goroutine outlives the caller, so it runs with its own
@@ -492,7 +482,7 @@ func (c *Cache) StopEviction(ctx context.Context) error {
 func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 	defer close(c.evictionDone)
 
-	nextReconciliation := c.runReconciliationPass(ctx)
+	c.runReconciliationPass(ctx)
 	c.runCleanExpired(ctx)
 	c.runEvictionPass(ctx)
 
@@ -504,20 +494,16 @@ func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 		case <-ctx.Done():
 			return
 		case <-ticker.C:
-			// Reconciliation walks the cache directories and reads a
-			// row for every file, so it runs only on the periodic
-			// ticker rather than on every write-pressure wakeup, and
-			// only on the first tick at or after nextReconciliation,
-			// which is ten times as long after the last pass ended as
-			// that pass took. Passes then never run back to back,
-			// however long one takes. A file whose best-effort
-			// accounting insert failed in a store stays unaccounted for
-			// until the next pass, up to about one eviction interval
-			// plus ten times the last pass's time.
-			if !time.Now().Before(nextReconciliation) {
-				nextReconciliation = c.runReconciliationPass(ctx)
-			}
-
+			// Reconciliation walks the cache directories, so it only
+			// runs on the periodic ticker rather than on every
+			// write-pressure wakeup, keeping it off the per-store hot
+			// path. Reusing the eviction interval itself (rather than a
+			// separate, longer one) is a deliberate choice: it is the
+			// simplest option that still bounds how long a store's
+			// best-effort accounting insert can stay silently
+			// unaccounted for to one interval, on a process that is
+			// already running this loop regardless.
+			c.runReconciliationPass(ctx)
 			c.runCleanExpired(ctx)
 		case <-c.evictionPressure:
 		}
@@ -541,25 +527,17 @@ func (c *Cache) runEvictionPass(ctx context.Context) {
 }
 
 // runReconciliationPass runs one reconciliation pass, logging failures
-// instead of propagating them (the loop must keep running), and returns
-// the earliest time the next pass may start: reconciliationWaitFactor
-// times as long after this pass ended as it took. It does nothing once
-// ctx is cancelled.
-func (c *Cache) runReconciliationPass(ctx context.Context) time.Time {
+// instead of propagating them (the loop must keep running). It does
+// nothing once ctx is cancelled.
+func (c *Cache) runReconciliationPass(ctx context.Context) {
 	if ctx.Err() != nil {
-		return time.Now()
+		return
 	}
 
-	started := time.Now()
-
 	err := c.reconcileAccounting(ctx)
 	if err != nil {
 		c.log.Warn("cache accounting reconciliation failed", "error", err)
 	}
-
-	ended := time.Now()
-
-	return ended.Add(reconciliationWaitFactor * ended.Sub(started))
 }
 
 // runCleanExpired runs CleanExpired, logging a failure instead of
@@ -578,8 +556,7 @@ func (c *Cache) runCleanExpired(ctx context.Context) {
 
 // reconcileAccounting synchronizes the database size accounting with
 // the actual contents of the cache directories. It runs at startup and
-// then on the first periodic eviction tick that comes at least ten times
-// as long after the last pass ended as that pass took, off the request
+// again on every periodic eviction tick thereafter, off the request
 // hot path: it adopts variant files that predate the accounting table
 // (or whose accounting insert failed, e.g. StoreVariant's best-effort
 // insert under transient DB contention), drops accounting rows whose
@@ -589,10 +566,9 @@ func (c *Cache) runCleanExpired(ctx context.Context) {
 // files left behind by crashed writes, and last checks the total cache
 // usage against the tables. It reads the tables a page at a time.
 // Running it periodically, not just once, bounds how long such drift can
-// accumulate unaccounted for on a long-running process to about one
-// eviction interval plus ten times the last pass's time.
-// Once ctx is cancelled, it stops at the next file or row and returns
-// ctx's error.
+// accumulate unaccounted for on a long-running process to one eviction
+// interval. Once ctx is cancelled, it stops at the next file or row and
+// returns ctx's error.
 func (c *Cache) reconcileAccounting(ctx context.Context) error {
 	if c.disabled {
 		return nil

internal/imgcache/eviction_internal_test.go

@@ -918,89 +918,6 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 	}
 }
 
-// TestReconciliationPassesAreSpacedByTenTimesTheirTime makes the hook
-// called after every read of the reconciliation pass sleep 10 ms, runs
-// the eviction loop on a 10 ms interval, and records when each of those
-// calls starts and ends. A pass starts before its first call and ends
-// after its last, so the time from the first call's start to the last
-// call's end is at most the pass's time. The next pass's first call must
-// start at least ten times that long after the last call ended.
-func TestReconciliationPassesAreSpacedByTenTimesTheirTime(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	// A pass made here, before the loop starts, counts the reads one
-	// pass makes on this empty cache, so the reads recorded below can be
-	// split into passes.
-	readsPerPass := 0
-	cache.reconciliationReadTestHook = func(int) { readsPerPass++ }
-
-	err := cache.reconcileAccounting(t.Context())
-	if err != nil {
-		t.Fatalf("reconcileAccounting failed: %v", err)
-	}
-
-	t.Logf("one reconciliation pass makes %d reads", readsPerPass)
-
-	if readsPerPass == 0 {
-		t.Fatal("a reconciliation pass made no read")
-	}
-
-	// The pass at startup and two after it.
-	const passes = 3
-
-	type read struct{ start, end time.Time }
-
-	// The channel holds every read the test looks at, so none of those
-	// is dropped; reads after them are, and never block the loop.
-	reads := make(chan read, passes*readsPerPass)
-
-	cache.reconciliationReadTestHook = func(int) {
-		start := time.Now()
-
-		time.Sleep(10 * time.Millisecond)
-
-		select {
-		case reads <- read{start: start, end: time.Now()}:
-		default:
-		}
-	}
-
-	cache.StartEviction(10 * time.Millisecond)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
-
-	recorded := make([]read, 0, passes*readsPerPass)
-	timeout := time.After(15 * time.Second)
-
-	for len(recorded) < passes*readsPerPass {
-		select {
-		case r := <-reads:
-			recorded = append(recorded, r)
-		case <-timeout:
-			t.Fatalf("saw %d reconciliation reads in 15 s, want %d (%d passes)",
-				len(recorded), passes*readsPerPass, passes)
-		}
-	}
-
-	for pass := range passes - 1 {
-		first := recorded[pass*readsPerPass]
-		last := recorded[(pass+1)*readsPerPass-1]
-		next := recorded[(pass+1)*readsPerPass]
-
-		passTime := last.end.Sub(first.start)
-		wait := next.start.Sub(last.end)
-
-		t.Logf("pass %d took at least %v, and the next pass started %v after it",
-			pass+1, passTime, wait)
-
-		if wait < 10*passTime {
-			t.Errorf("pass %d took at least %v, and the next pass started %v "+
-				"after it, want at least %v", pass+1, passTime, wait, 10*passTime)
-		}
-	}
-}
-
 // TestStopEvictionInterruptsPassInProgress holds the test database's
 // only connection, so the startup reconciliation pass waits for it, and
 // checks that StopEviction stops that pass instead of waiting for the

internal/server/source_url_internal_test.go

@@ -589,26 +589,19 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T)
 }
 
 // TestImageRoutesCheckIPv4AddressInIPv6SourceHost requests ipv6SourcePath on
-// source hosts that hold an IPv4 address, through a /v1/image/ URL with a
+// IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a
 // signature and through an encrypted URL, with the fetcher pixad uses.
 // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215),
-// answers 403. [::203.0.113.5] holds the public address 203.0.113.5 in the
-// IPv4-compatible form (::/96) and answers 403 when blocked_networks lists
-// 203.0.113.0/24 or ::/96. [::ffff:203.0.113.5] holds it in the IPv4-mapped
-// form (::ffff:0:0/96) and answers 403 when blocked_networks lists
-// 203.0.113.0/24. Go keeps the plain address 203.0.113.5 in the mapped form
-// too, and an IPv6 range must not refuse it: with ::/0 listed it is not
-// refused. Neither is [::203.0.113.5] with blocked_networks empty. Where a
-// host is not refused, the fetcher tries to connect to it, finds nothing
-// there, and the request fails with another status.
+// answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4
+// address in the IPv4-compatible form (::/96) and in the IPv4-mapped form
+// (::ffff:0:0/96). Each answers 403 when blocked_networks lists
+// 203.0.113.0/24, and when it lists the range of its own form. When
+// blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries
+// to connect to it, finds nothing there, and the request fails with another
+// status.
 func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
 	t.Parallel()
 
-	const (
-		ipv4CompatibleHost = "[::203.0.113.5]"
-		ipv4MappedHost     = "[::ffff:203.0.113.5]"
-	)
-
 	tests := []struct {
 		name            string
 		sourceHost      string
@@ -617,19 +610,19 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
 	}{
 		{"local-use NAT64 form of 10.0.0.1", "[64:ff9b:1::a00:1]", nil, true},
 		{"IPv4-compatible form of an address in blocked_networks",
-			ipv4CompatibleHost,
+			"[::203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
 		{"IPv4-compatible form with ::/96 in blocked_networks",
-			ipv4CompatibleHost,
+			"[::203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("::/96")}, true},
 		{"IPv4-mapped form of an address in blocked_networks",
-			ipv4MappedHost,
+			"[::ffff:203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
-		{"plain IPv4 address with ::/0 in blocked_networks",
-			"203.0.113.5",
-			[]netip.Prefix{netip.MustParsePrefix("::/0")}, false},
+		{"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks",
+			"[::ffff:203.0.113.5]",
+			[]netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true},
 		{"IPv4-compatible form of an address with blocked_networks empty",
-			ipv4CompatibleHost, nil, false},
+			"[::203.0.113.5]", nil, false},
 	}
 
 	for _, tt := range tests {

script/bootstrap

@@ -19,8 +19,9 @@
 #                            CGO image libraries (pkg-config, vips
 #                            with its JPEG XL support, libheif) for
 #                            the govips bindings instead of Node: to
-#                            compile pixa outside Docker, as
-#                            `make build` does
+#                            compile pixa, in the Dockerfile's test
+#                            phase and build stage, which format
+#                            nothing
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/cibuild

@@ -2,12 +2,11 @@
 # script/cibuild: run the CI build. It bootstraps first: a CI runner
 # checks out and runs this and nothing else, and script/fmt-check runs
 # the formatter on the host, which a pristine checkout cannot do.
-# A new CACHEBUST value reruns every RUN step after the ARG CACHEBUST
-# line, since a cached gate phase is a check that did not run; unlike
-# --no-cache, it keeps the layers above that line and the cache mounts.
+# A new CACHEBUST value reruns every RUN step, since a cached gate phase
+# is a check that did not run; unlike --no-cache, it keeps Go's build cache.
 # This relies on every stage of the Dockerfile declaring ARG CACHEBUST
-# before every step that lints, tests or compiles; a stage without that
-# line is served from cache on an unchanged tree, with no warning.
+# first; a stage without that line is served from cache on an unchanged
+# tree, with no warning.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/docker

@@ -1,12 +1,11 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
-# A new CACHEBUST value reruns every RUN step after the ARG CACHEBUST
-# line, since a cached gate phase is a check that did not run; unlike
-# --no-cache, it keeps the layers above that line and the cache mounts.
+# A new CACHEBUST value reruns every RUN step, since a cached gate phase
+# is a check that did not run; unlike --no-cache, it keeps Go's build cache.
 # This relies on every stage of the Dockerfile declaring ARG CACHEBUST
-# before every step that lints, tests or compiles; a stage without that
-# line is served from cache on an unchanged tree, with no warning.
+# first; a stage without that line is served from cache on an unchanged
+# tree, with no warning.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/lint

@@ -5,13 +5,11 @@
 # make its answer untrustworthy.
 #
 # The phase is not the last stage in the file, so it is built only when
-# --target names it. A new CACHEBUST value reruns every RUN step after
-# the ARG CACHEBUST line, since a cached lint layer is a lint that did
-# not run; unlike --no-cache, it keeps the layers above that line and
-# the cache mounts. This relies on every stage of the Dockerfile
-# declaring ARG CACHEBUST before every step that lints, tests or
-# compiles; a stage without that line is served from cache on an
-# unchanged tree, with no warning.
+# --target names it. A new CACHEBUST value reruns every RUN step, since
+# a cached lint layer is a lint that did not run; unlike --no-cache, it
+# keeps Go's build cache. This relies on every stage of the Dockerfile
+# declaring ARG CACHEBUST first; a stage without that line is served
+# from cache on an unchanged tree, with no warning.
 # --output type=cacheonly writes no image, since nothing uses one.
 set -eu
 

script/test

@@ -3,12 +3,11 @@
 # and this builds that phase alone, on the same terms as script/lint:
 # --target because a phase that is not the last stage is built only when
 # named, and a new CACHEBUST value because a cached test layer is a test
-# that did not run; unlike --no-cache, it keeps the layers above the ARG
-# CACHEBUST line and the cache mounts. This relies on every stage of the
-# Dockerfile declaring ARG CACHEBUST before every step that lints, tests
-# or compiles; a stage without that line is served from cache on an
-# unchanged tree, with no warning. --output type=cacheonly writes no
-# image, since nothing uses one.
+# that did not run; unlike --no-cache, it keeps Go's build cache. This
+# relies on every stage of the Dockerfile declaring ARG CACHEBUST first;
+# a stage without that line is served from cache on an unchanged tree,
+# with no warning. --output type=cacheonly writes no image, since
+# nothing uses one.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"