{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/1018","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1018/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1018/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1018/events","html_url":"https://github.com/letsencrypt/boulder/issues/1018","id":112494984,"number":1018,"title":"Switch OCSP Updater storeResponse update guard","user":{"login":"rolandshoemaker","id":5080674,"avatar_url":"https://avatars.githubusercontent.com/u/5080674?v=3","gravatar_id":"","url":"https://api.github.com/users/rolandshoemaker","html_url":"https://github.com/rolandshoemaker","followers_url":"https://api.github.com/users/rolandshoemaker/followers","following_url":"https://api.github.com/users/rolandshoemaker/following{/other_user}","gists_url":"https://api.github.com/users/rolandshoemaker/gists{/gist_id}","starred_url":"https://api.github.com/users/rolandshoemaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rolandshoemaker/subscriptions","organizations_url":"https://api.github.com/users/rolandshoemaker/orgs","repos_url":"https://api.github.com/users/rolandshoemaker/repos","events_url":"https://api.github.com/users/rolandshoemaker/events{/privacy}","received_events_url":"https://api.github.com/users/rolandshoemaker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/letsencrypt/boulder/milestones/11","html_url":"https://github.com/letsencrypt/boulder/milestones/v2%20Goals%20(Technical%20Debt)","labels_url":"https://api.github.com/repos/letsencrypt/boulder/milestones/11/labels","id":1351759,"number":11,"title":"v2 Goals (Technical Debt)","description":"","creator":{"login":"bdaehlie","id":84762,"avatar_url":"https://avatars.githubusercontent.com/u/84762?v=3","gravatar_id":"","url":"https://api.github.com/users/bdaehlie","html_url":"https://github.com/bdaehlie","followers_url":"https://api.github.com/users/bdaehlie/followers","following_url":"https://api.github.com/users/bdaehlie/following{/other_user}","gists_url":"https://api.github.com/users/bdaehlie/gists{/gist_id}","starred_url":"https://api.github.com/users/bdaehlie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdaehlie/subscriptions","organizations_url":"https://api.github.com/users/bdaehlie/orgs","repos_url":"https://api.github.com/users/bdaehlie/repos","events_url":"https://api.github.com/users/bdaehlie/events{/privacy}","received_events_url":"https://api.github.com/users/bdaehlie/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":1,"state":"open","created_at":"2015-10-12T20:44:43Z","updated_at":"2015-10-21T17:34:14Z","due_on":"2015-12-15T06:00:00Z","closed_at":null},"comments":1,"created_at":"2015-10-21T01:48:22Z","updated_at":"2015-10-21T17:34:14Z","closed_at":"2015-10-21T17:34:14Z","body":"As noted in #1004 instead of using the `Status` field as a guard for the `UPDATE` statement we should use `WHERE ocspLastUpdated < :ocspLastUpdated` so that we never overwrite a newer OCSP response than what was pulled from the database."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/149971791","html_url":"https://github.com/letsencrypt/boulder/issues/1018#issuecomment-149971791","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1018","id":149971791,"user":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"created_at":"2015-10-21T17:34:14Z","updated_at":"2015-10-21T17:34:14Z","body":"The choice to use the status field as the guard rather than the ocspLastUpdated timestamp was intentional. In distributed systems you cannot rely on clocks being identical across machines, even if you are running ntpd. Machines' clocks going out of sync is a very common failure mode, so whenever you can avoid a dependency on two machines' clocks being the same, you do.\r\n\r\nIn this case, the invariant we are maintaining is that OCSP Updater should never write an OCSP response to the DB that does not match the current `Status` reflected in the DB."}}