on libraries

diff --git a/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment b/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment
index 1e95bdeab6cf0aa88d4d30db6f70efd21f0a583d..681ec6add164a66516711e86f0259613ba8c8f71 100644 (file)
--- a/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment
+++ b/doc/bugs/35_failed_tests_on_beegfs/comment_6_172a92bf49be25355dda3f88b377a6f4._comment
@@ -19,8 +19,4 @@ inherit the close-on-exec flag. So it should be safe to just write new
 versions of all of those.
 
 Also there are a few uses of `openFd` that don't set CloseOnExec.
-
-There is also the problem that any haskell library that does anything
-with a file might use any of the above internally without setting
-close-on-exec.
 """]]

diff --git a/doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment b/doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment
new file mode 100644 (file)
index 0000000..8b8010e
--- /dev/null
+++ b/doc/bugs/35_failed_tests_on_beegfs/comment_8_853bf59715ac755d046b54b282eaac7c._comment
@@ -0,0 +1,27 @@
+[[!comment format=mdwn
+ username="joey"
+ subject="""comment 8"""
+ date="2025-09-04T20:56:54Z"
+ content="""
+There is also the problem that any haskell library that does anything
+with a file might use any of the above internally without setting
+close-on-exec.
+
+For example, opening a https connection can result in readFile opening a
+handle to a file in /etc/ssl/certs/, which will not be closed on exec. And
+which can leak out via another thread doing an exec at just the right time.
+
+But inheriting a single FD like that is not going to cause problems for beegfs
+or anything else.
+
+The ones I'd worry about is if a haskell library is doing something 
+with a file in the git-annex repo.
+
+Most dependencies of git-annex clearly don't open files there, and most open no
+files at all. Ones I need to check:
+
+* persistent-sqlite
+* feed (parseFeedFromFile)
+* concurrent-output (addOutputBuffer uses openTempFile; emitOutputBuffer uses T.readFile)
+* magic
+"""]]