[Dryvnt]

Problem

moq auth serve ignores SIGTERM when it runs as PID 1, which is how the FROM scratch release image runs it. A lone auth stage returns from main before reaching drive(), so it never installs the shutdown handlers, and the kernel drops a signal that has no handler when the target is a namespace's PID 1. As a result, podman stop waits out its 10 s grace period and then SIGKILLs the server, and every Kubernetes pod stop waits out terminationGracePeriodSeconds. Outside PID 1 the bug is hidden, because the process dies from SIGTERM's default action.

Approach

• auth serve races shutdown_signal() (the helper drive() uses) and returns Ok(()) on the signal. biased makes sure the handlers are installed before serve logs that it is listening. The other auth verbs keep default signal handling: sign and verify block on stdin, where an installed handler would swallow the signal.
• rs/moq-cli/tests/auth_serve.rs (unix only) spawns moq auth serve, waits for the listening log line, sends SIGTERM (and, in a second test, SIGINT), and asserts exit 0. Without the fix, the process dies by the signal.
• The doc line "serve runs until killed" is updated.

Impact

• No public API or wire change. moq auth serve now exits 0 on SIGTERM/SIGINT instead of dying by the signal.

Alternatives

• Graceful drain via Server::router() plus axum's with_graceful_shutdown in the CLI: in-flight connect/revalidate/end calls would finish, at the cost of duplicating moq-auth's two serve helpers. Not done, because those calls are short and drive() drops its tasks on a signal too.
• A shutdown future on moq_auth::serve::Server::serve/serve_unix: the cleanest library shape, but a breaking moq-auth API change for a CLI bug.

Follow-ups

• Backport to release as a cherry-pick PR once this merges, so the published image stops cleanly.
• publish::tests::ts_passthrough_crosses_a_relay_through_a_flagged_jump flaked once locally (already tracked by quest/m1/test-flakes-2/ts-passthrough-jump.md).

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T09:43:19.626571Z	529fe5e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 529fe5e

One actionable regression below. Reusing the existing shutdown helper and polling it before server startup is a good, minimal direction; restrict it to auth serve so the synchronous auth commands retain their termination behavior. No public API expansion or graceful-drain machinery is necessary for this fix.

Verification: inspected all five changed files and surrounding auth dispatch, blocking input helpers, shutdown helper, and TCP/Unix serving paths through GitHub. Tests and container/PID-1 behavior were not executed. No prior review bearing this marker or matching independent finding was present at the final state/head/review check.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 529fe5e51f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2e5d3bef-ad44-49cb-ad06-e036b6a09793

---

📥 Commits

Reviewing files that changed from the base of the PR and between 529fe5e and 98bbba0.

---

📒 Files selected for processing (1)

• rs/moq-cli/src/auth.rs

---

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

---

Walkthrough

The auth serve command now runs its server concurrently with a shutdown signal and returns when either completes. Unix integration tests send SIGTERM and SIGINT to the serve process and check for a successful exit.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 98bbb

The new auth serve shutdown path handles SIGINT and SIGTERM, with tests checking successful exit. No concrete merge-blocking risk is established.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely states that moq auth serve now stops correctly on SIGTERM and SIGINT, which matches the main changes.
Description check		The description directly explains the PID 1 shutdown problem, the signal-handling fix, the Unix-only tests, and the documentation update.

---

✨ Finishing Touches

✨ Simplify code

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 98bbba0

Reviewed the two-file update since 529fe5e; the PR base is unchanged. The prior stdin/signal finding, also reported independently, is fixed in code: auth.rs:29–33 now installs handlers only in Command::Serve, and main.rs:307 directly awaits the other auth commands again. The biased polling order still installs the handlers before serving starts.

No new actionable bugs found. This is the simpler, appropriately scoped fix; no additional shutdown abstraction is needed.

Verification limits: GitHub source/diff review only; I did not execute tests or PID-1 checks. The stdin regression has no automated test; the author's manual SIGTERM result is reported in the existing thread, not independently reproduced here.

[kixelated]

Merge summary: the OpenAI and Codex P2 (handlers swallowing signals for auth sign/verify blocked on stdin) was fixed in 98bbba0 by racing shutdown only in the Serve arm, and the re-review of that head found nothing new, so I resolved both outdated threads. CI green. Thanks @Dryvnt! Enabling auto-merge on the current head. A backport to release is left as a separate follow-up.

(Written by Claude Opus 5.5)

[kixelated]

Dequeued by the merge queue: cargo fmt --all --check fails on test/interop/clients/rust/tail.rs. That file has been broken on main since #5377, and this change doesn't touch it. Open fixes are #5381 (adds a rustfmt config under test/interop) and #5383 (reformats the file). Re-enable auto-merge once one of them lands. No change is needed here.

(Written by Claude Opus 5.5)