From 945b0e5a04ab6398fcfec8e7c0397f76223cbf7f Mon Sep 17 00:00:00 2001
From: imbajin <jin@apache.org>
Date: Mon, 12 Oct 2026 04:55:56 +0800
Subject: [PATCH] fix(store): bound jemalloc downloads

Limit connection and total transfer time.
Preserve verified cache and partial-file cleanup.
Cover timeout fallback in launcher regressions.
Document optional allocator startup behavior.
---
 .../src/assembly/travis/test-check-port.sh    | 46 ++++++++++++++++++-
 hugegraph-store/README.md                     |  4 ++
 .../src/assembly/static/bin/util.sh           |  4 +-
 3 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/hugegraph-server/hugegraph-dist/src/assembly/travis/test-check-port.sh b/hugegraph-server/hugegraph-dist/src/assembly/travis/test-check-port.sh
index e8950355c7..8fd1ac5d4d 100755
--- a/hugegraph-server/hugegraph-dist/src/assembly/travis/test-check-port.sh
+++ b/hugegraph-server/hugegraph-dist/src/assembly/travis/test-check-port.sh
@@ -607,9 +607,11 @@ if [[ -n "$STORE_UTIL_SH" ]]; then
         }
 
         curl() {
-            [[ "$1" == "-fL" && "$2" == "-o" && "$4" == "--" ]] || return 64
+            [[ "$1" == "-fL" && "$2" == "--connect-timeout" && "$3" == "5" &&
+               "$4" == "--max-time" && "$5" == "30" && "$6" == "-o" &&
+               "$8" == "--" ]] || return 64
             if [[ "$CALLER" == "installer" ]]; then
-                echo "valid" > "$3"
+                echo "valid" > "$7"
                 return 0
             fi
             touch "$STALE_DOWNLOAD"
@@ -660,6 +662,46 @@ if [[ -n "$STORE_UTIL_SH" ]]; then
         LEFTOVERS=$(find "$WORK" -name 'lib.so.*' -type f | wc -l | tr -d ' ')
         expect "concurrent replacement cleans private temp files" "0" "$LEFTOVERS"
     )
+
+    echo ""
+    echo "10. Store optional download timeout preserves the cache and cleans partial bytes"
+    (
+        source "$STORE_UTIL_SH"
+        WORK=$(mktemp -d)
+        DEST="$WORK/lib.so"
+        CURL_CALLED="$WORK/curl-called"
+        trap 'rm -rf "$WORK"' EXIT
+        echo "cached" > "$DEST"
+
+        md5sum() { echo "good  $1"; }
+        curl() { touch "$CURL_CALLED"; return 28; }
+        if download_and_verify "https://example.com/lib.so" "$DEST" "good" >/dev/null 2>&1 &&
+           [[ ! -e "$CURL_CALLED" ]]; then
+            pass "verified jemalloc cache requires no network"
+        else
+            fail "verified jemalloc cache requires no network" "cache was rejected or curl was called"
+        fi
+
+        md5sum() { echo "bad  $1"; }
+        curl() {
+            [[ "$1" == "-fL" && "$2" == "--connect-timeout" && "$3" == "5" &&
+               "$4" == "--max-time" && "$5" == "30" && "$6" == "-o" &&
+               "$8" == "--" ]] || return 64
+            touch "$CURL_CALLED"
+            echo "partial" > "$7"
+            return 28
+        }
+        if download_and_verify "https://example.com/lib.so" "$DEST" "good" >/dev/null 2>&1; then
+            fail "bounded jemalloc timeout is reported" "download incorrectly succeeded"
+        elif [[ -e "$CURL_CALLED" ]]; then
+            pass "bounded jemalloc timeout is reported"
+        else
+            fail "bounded jemalloc timeout is reported" "curl did not receive the required timeouts"
+        fi
+        expect "timed out replacement preserves the old destination" "cached" "$(cat "$DEST")"
+        LEFTOVERS=$(find "$WORK" -name 'lib.so.*' -type f | wc -l | tr -d ' ')
+        expect "jemalloc timeout discards partial bytes" "0" "$LEFTOVERS"
+    )
 fi
 
 # --------------------------------------------------------------------------
diff --git a/hugegraph-store/README.md b/hugegraph-store/README.md
index f78f30b82e..bda2066c67 100644
--- a/hugegraph-store/README.md
+++ b/hugegraph-store/README.md
@@ -252,6 +252,10 @@ bin/start-hugegraph-store.sh [-g GC_TYPE] [-j "JVM_OPTIONS"] [-d DAEMON]
 - `-j`: Custom JVM options (e.g., `-j "-Xmx16g -Xms8g"`)
 - `-d`: Daemon mode (`true` = daemon, `false` = foreground; default: `true`). Set to `false` when running under Docker or a process supervisor so the container exits if Java dies.
 
+On supported architectures, startup reuses a checksum-verified jemalloc library or tries to download it.
+The optional download allows 5 seconds to connect and 30 seconds for the complete transfer. If it fails
+or times out, Store continues without adding jemalloc to `LD_PRELOAD`; partial downloads are discarded.
+
 Default JVM memory settings (defined in `start-hugegraph-store.sh`):
 - Max heap: 32GB
 - Min heap: 512MB
diff --git a/hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh b/hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh
index e45249a04b..d905db9a8d 100644
--- a/hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh
+++ b/hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh
@@ -330,7 +330,9 @@ download_and_verify() {
     local tmp
     # mktemp, not $$: a PID is shared by concurrent background subshells.
     tmp=$(mktemp -- "${filepath}.XXXXXX") || return 1
-    if curl -fL -o "$tmp" -- "$url"; then
+    # jemalloc is optional: an unavailable or stalled mirror must not block
+    # Store startup indefinitely. Bound both connection and complete transfer.
+    if curl -fL --connect-timeout 5 --max-time 30 -o "$tmp" -- "$url"; then
         actual_md5=$(md5sum -- "$tmp" | awk '{ print $1 }')
         if [[ "$actual_md5" != "$expected_md5" ]]; then
             echo "MD5 checksum verification failed for $filepath after download. Expected: $expected_md5, but got: $actual_md5"