propagete nntp errors properly accross board

Author: sirrobot01

.github/workflows/beta-docker.yml

@@ -9,83 +9,171 @@ permissions:
   contents: read
   packages: write
 
+env:
+  DOCKERHUB_IMAGE: cy01/blackhole
+  GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/decypharr
+
 jobs:
-  docker:
+  prepare:
     runs-on: ubuntu-latest
+    outputs:
+      beta_version: ${{ steps.calculate_version.outputs.beta_version }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.25'
-          cache: true
-
       - name: Calculate beta version
         id: calculate_version
         run: |
           LATEST_TAG=$(git tag | grep -v 'beta' | sort -V | tail -n1)
           echo "Found latest tag: ${LATEST_TAG}"
-          
+
           IFS='.' read -r -a VERSION_PARTS <<< "$LATEST_TAG"
           MAJOR="${VERSION_PARTS[0]}"
           MINOR="${VERSION_PARTS[1]}"
           PATCH="${VERSION_PARTS[2]}"
-          
+
           NEW_PATCH=$((PATCH + 1))
           BETA_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
-          
+
           echo "Calculated beta version: ${BETA_VERSION}"
-          echo "beta_version=${BETA_VERSION}" >> $GITHUB_ENV
+          echo "beta_version=${BETA_VERSION}" >> $GITHUB_OUTPUT
+
+  build:
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - name: Prepare platform pair
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Cache Docker layers
-        uses: actions/cache@v3
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-
-      # Login to Docker Hub
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # Login to GitHub Container Registry
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push beta Docker image
-        uses: docker/build-push-action@v5
+      - name: Build and push by digest (Docker Hub)
+        id: build_dockerhub
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.beta_version }}
+            CHANNEL=beta
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+          outputs: type=image,name=${{ env.DOCKERHUB_IMAGE }},push-by-digest=true,name-canonical=true,push=true
+
+      - name: Build and push by digest (GHCR)
+        id: build_ghcr
+        uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            cy01/blackhole:beta
-            ghcr.io/${{ github.repository_owner }}/decypharr:beta
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+          platforms: ${{ matrix.platform }}
           build-args: |
-            VERSION=${{ env.beta_version }}
+            VERSION=${{ needs.prepare.outputs.beta_version }}
             CHANNEL=beta
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          outputs: type=image,name=${{ env.GHCR_IMAGE }},push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digests
+        run: |
+          mkdir -p /tmp/digests/dockerhub /tmp/digests/ghcr
+
+          dockerhub_digest="${{ steps.build_dockerhub.outputs.digest }}"
+          echo "Docker Hub digest: ${dockerhub_digest}"
+          touch "/tmp/digests/dockerhub/${dockerhub_digest#sha256:}"
+
+          ghcr_digest="${{ steps.build_ghcr.outputs.digest }}"
+          echo "GHCR digest: ${ghcr_digest}"
+          touch "/tmp/digests/ghcr/${ghcr_digest#sha256:}"
+
+      - name: Upload Docker Hub digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-dockerhub-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/dockerhub/*
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Upload GHCR digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-ghcr-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/ghcr/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Docker Hub digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests/dockerhub
+          pattern: digests-dockerhub-*
+          merge-multiple: true
+
+      - name: Download GHCR digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests/ghcr
+          pattern: digests-ghcr-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Docker Hub manifest and push
+        working-directory: /tmp/digests/dockerhub
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.DOCKERHUB_IMAGE }}:beta \
+            $(printf '${{ env.DOCKERHUB_IMAGE }}@sha256:%s ' *)
 
-      - name: Move cache
+      - name: Create GHCR manifest and push
+        working-directory: /tmp/digests/ghcr
         run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+          docker buildx imagetools create \
+            --tag ${{ env.GHCR_IMAGE }}:beta \
+            $(printf '${{ env.GHCR_IMAGE }}@sha256:%s ' *)

internal/logger/ratelimit.go

@@ -96,50 +96,51 @@ func (r *RateLimitedLogger) shouldLog(key string) bool {
 }
 
 // RateLimitedEvent provides a fluent API for rate-limited logging.
-// If suppressed, returns a no-op logger that discards all output.
+// It holds a reference to the parent logger and key, evaluating the rate limit
+// on each log call rather than at creation time.
 type RateLimitedEvent struct {
-	logger    zerolog.Logger
-	shouldLog bool
+	parent *RateLimitedLogger
+	key    string
 }
 
 // Rate returns a RateLimitedEvent for fluent logging with deduplication.
-// Usage: logger.Rate(key).Error().err(err).Msg("message")
-// If rate-limited, the log is silently discarded (no nil check needed).
+// Usage: logger.Rate(key).Error().Err(err).Msg("message")
+// The rate limit is checked on each Error/Warn/Info/Debug call, not at creation.
 func (r *RateLimitedLogger) Rate(key string) *RateLimitedEvent {
 	return &RateLimitedEvent{
-		logger:    r.logger,
-		shouldLog: r.shouldLog(key),
+		parent: r,
+		key:    key,
 	}
 }
 
 // Error returns an error event, or a no-op event if rate-limited.
 func (e *RateLimitedEvent) Error() *zerolog.Event {
-	if e.shouldLog {
-		return e.logger.Error()
+	if e.parent.shouldLog(e.key) {
+		return e.parent.logger.Error()
 	}
 	return nopLogger.Error()
 }
 
 // Warn returns a warning event, or a no-op event if rate-limited.
 func (e *RateLimitedEvent) Warn() *zerolog.Event {
-	if e.shouldLog {
-		return e.logger.Warn()
+	if e.parent.shouldLog(e.key) {
+		return e.parent.logger.Warn()
 	}
 	return nopLogger.Warn()
 }
 
 // Info returns an info event, or a no-op event if rate-limited.
 func (e *RateLimitedEvent) Info() *zerolog.Event {
-	if e.shouldLog {
-		return e.logger.Info()
+	if e.parent.shouldLog(e.key) {
+		return e.parent.logger.Info()
 	}
 	return nopLogger.Info()
 }
 
 // Debug returns a debug event, or a no-op event if rate-limited.
 func (e *RateLimitedEvent) Debug() *zerolog.Event {
-	if e.shouldLog {
-		return e.logger.Debug()
+	if e.parent.shouldLog(e.key) {
+		return e.parent.logger.Debug()
 	}
 	return nopLogger.Debug()
 }

pkg/manager/fixer.go

@@ -139,6 +139,7 @@ func (f *Fixer) FixTorrent(ctx context.Context, entry *storage.Entry, skipCurren
 		if success {
 			f.manager.logger.Info().
 				Str("debrid", debridName).
+				Str("name", entry.Name).
 				Str("infohash", entry.InfoHash).
 				Msg("Successfully re-inserted entry")
 

pkg/manager/manager.go

@@ -444,7 +444,7 @@ func (m *Manager) Stop() error {
 		m.repair.Stop()
 	}
 
-	// Close storage (releases bbolt file lock)
+	// Close storage
 	if m.storage != nil {
 		m.logger.Info().Msg("Closing storage database")
 		if err := m.storage.Close(); err != nil {

pkg/mount/dfs/backend/cgofuse/fs.go

@@ -139,7 +139,7 @@ func (f *FS) Readdir(path string, fill func(name string, stat *fuse.Stat_t, ofst
 		// Root directory - list all torrents/entries
 		entries := f.manager.GetEntries()
 		for _, entry := range entries {
-			fill(entry.Name(), nil, 0)
+			fill(entry.Name(), f.entryStat(&entry), 0)
 		}
 		return 0
 	}
@@ -160,7 +160,7 @@ func (f *FS) Readdir(path string, fill func(name string, stat *fuse.Stat_t, ofst
 			_, children = f.manager.GetTorrentChildren(groupOrTorrent)
 		}
 		for _, child := range children {
-			fill(child.Name(), nil, 0)
+			fill(child.Name(), f.entryStat(&child), 0)
 		}
 		return 0
 	}
@@ -172,12 +172,39 @@ func (f *FS) Readdir(path string, fill func(name string, stat *fuse.Stat_t, ofst
 	// get the torrent's children (files)
 	_, children := f.manager.GetTorrentChildren(torrentName)
 	for _, child := range children {
-		fill(child.Name(), nil, 0)
+		fill(child.Name(), f.entryStat(&child), 0)
 	}
 
 	return 0
 }
 
+// entryStat creates a fuse.Stat_t for a FileInfo entry
+// This is used by Readdir to provide file type information to clients like Samba
+func (f *FS) entryStat(info *manager.FileInfo) *fuse.Stat_t {
+	stat := &fuse.Stat_t{
+		Uid:     f.config.UID,
+		Gid:     f.config.GID,
+		Blksize: 4096,
+	}
+
+	modTime := info.ModTime()
+	stat.Atim = fuse.NewTimespec(modTime)
+	stat.Mtim = fuse.NewTimespec(modTime)
+	stat.Ctim = fuse.NewTimespec(modTime)
+
+	if info.IsDir() {
+		stat.Mode = fuse.S_IFDIR | 0755
+		stat.Nlink = 2
+	} else {
+		stat.Mode = fuse.S_IFREG | 0644
+		stat.Nlink = 1
+		stat.Size = info.Size()
+		stat.Blocks = (stat.Size + 511) / 512
+	}
+
+	return stat
+}
+
 // Open opens a file
 func (f *FS) Open(path string, flags int) (int, uint64) {
 	// Check if read-only access

pkg/storage/hybrid/store.go

@@ -130,8 +130,6 @@ func New(config Config) (*Store, error) {
 	logPath := config.DataPath
 	var err error
 
-	fmt.Println("Opening log at", logPath)
-
 	s.log, err = openAppendLog(logPath)
 	if err != nil {
 		cancel()

pkg/usenet/fs/reader/fetcher.go

@@ -184,11 +184,20 @@ func (sf *SegmentFetcher) doFetch(ctx context.Context, segIdx int) error {
 				}
 
 				// Stream body directly to disk
-				_, err := conn.StreamBody(messageID, writer)
+				n, err := conn.StreamBody(messageID, writer)
 				if err != nil {
 					return err
 				}
 
+				// Treat zero-byte articles as missing — the article exists on the
+				// server but its body is empty/corrupted after yEnc decoding.
+				if n == 0 {
+					return &nntp.Error{
+						Type:    nntp.ErrorTypeArticleNotFound,
+						Message: "article produced no data after decoding",
+					}
+				}
+
 				// Finalize the write (updates cache state)
 				if dw, ok := writer.(*diskStreamWriter); ok {
 					dw.Finalize()

pkg/usenet/fs/reader/reader.go

@@ -257,9 +257,10 @@ func (sr *StreamingReader) readFromCache(p []byte, off int64, startSeg, endSeg i
 		segDataOffset := readStart - segStart
 		copyLen := readEnd - readStart
 
-		// Defensive bounds check
+		// Bounds check — empty segment data means the article was corrupted
 		if segDataOffset < 0 || segDataOffset >= int64(len(data)) {
-			continue
+			return totalRead, fmt.Errorf("segment %d has no data (expected %d bytes at offset %d)",
+				segIdx, segEnd-segStart, segStart)
 		}
 		availableInSeg := int64(len(data)) - segDataOffset
 		if copyLen > availableInSeg {