mirror of
https://github.com/mudler/LocalAI.git
synced 2026-11-06 04:23:15 -05:00
Ettore Di Giacinto
a0e32049d4
The install dialog and the upgrade approval ask the owner for the permissions of a release. The owner answers from the verified manifest of the staged package, so every read downloaded the package again, checked its signature, and held the operation lock the whole time. A second read (a retry, the upgrade approval, a reopened dialog) paid the full cost again and waited behind the first. Keep the verified answer per release, keyed by the digest the library pins, for ten minutes, and let concurrent reads share one download. The operation lock is held for the stage only. A moving tag has no fixed bytes and is still read every time. The installed flag is read on every call, and the nonce still binds the digest, so nothing is shown as allowed that the owner has not confirmed. The dialogs now say what they wait for after three seconds instead of a bare "Reading what this add-on asks for...". The update check cache is empty after every start, so a moving channel read as "not known" on each visit until an administrator asked. The owner now checks the installed add-ons in the background shortly after start and every 30 minutes. Measured with a package that takes 500 ms to download: the second read went from 510 ms to 13 microseconds, and two concurrent reads from 410 and 820 ms to 404 ms each. Assisted-by: Claude:claude-sonnet-5-5