crash

Crash reports are opt-in, off by default, and the user sees the exact payload before every send. When reporting is off nothing is collected or written.

A GUI app started through telamon-framework-ui already has the panic hook and the fatal Qt message hook installed. What an app adds is a settings switch and a page that lists pending reports, shows the payload and sends or discards them.

How it works

• Switch: Settings, per user, in ~/.config/telamon/crash-reporting.toml (enabled = false).
• Endpoint: a Sentry-compatible DSN from /etc/telamon/crash-reporting.toml, default /usr/share/telamon/crash-reporting.toml. It is the Telamon OS relay, which posts each report it receives as a public issue in github.com/EternalCoder454/AtlasOS. An empty dsn in /etc turns sending off: send then fails with "no endpoint configured".
• Sources: Rust panics (install), fatal errors that are not panics (record_fatal), systemd-coredump entries of the user's own processes (collect_coredumps) and update and rollback failures from the helper (collect_events).
• Queue: reports wait in $XDG_STATE_HOME/telamon/crash-reports/pending/ for the user's decision (pending, discard). Sent ones move to sent/ and are pruned after 90 days. Every report and marker is written atomically (a temp file, fsync, rename), so a crash while saving leaves the old file or the new one, never a cut one. A file in pending/ or sent/ that is not a report (damaged, cut short by an older version) is moved to quarantine/ and kept there for 90 days; it is never listed or sent.

What a report holds: Telamon OS version, channel and previous version; app name, version and category; the stack trace; kernel; GPU model and driver; uptime; CPU model, RAM total and use; a timestamp and the report type. A rotating random ID (new every 30 days, never /etc/machine-id) stays on the machine and is not sent, so public reports cannot be linked to each other. Never collected: core dumps, user names, host names, MAC or IP addresses, serials, email addresses, credentials and tokens, installed apps, file contents, command lines, environment or working directory. Every string is scrubbed with Scrubber.

Limits hold across every app of the user, so an app in a restart loop queues one report, not some per start. Panic and fatal reports are limited to 5 an hour, and the same crash (same message and location) is saved once a day. The same coredump (same program, signal and top five frames of the crashed thread) is also queued once a day. At most 50 reports wait in pending/; past that the oldest are deleted.

Example

use telamon_framework_system::crash;

// A settings page: the user's switch.
crash::Settings { enabled: true }.save()?;

// A reports page: show each payload, then send on a yes.
for report in crash::pending() {
    println!("{}", report.to_json_pretty()?);
    // after the user agrees:
    crash::send(&report)?;
    // or, if they decline:
    // crash::discard(&report)?;
}

Collect on a timer or at start-up, on a worker thread (both block): crash::collect_coredumps(None) and crash::collect_events(None) queue what is new since the last call (both return nothing when reporting is off).

Settings

#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)] pub struct Settings { pub enabled: bool }

Off unless the file says enabled = true.

Endpoint

#[derive(Debug, Clone, PartialEq, Eq)] pub struct Endpoint { pub key: String, pub store_url: String }

A GlitchTip DSN of the form https://<key>@<host>[/prefix]/<project>. store_url is https://host/api/<project>/store/.

Report

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] pub struct Report. The file layout is in On-disk formats.

Scrubber

#[derive(Debug, Clone, Default)] pub struct Scrubber. Replaces home directories, user names, host names, MAC and IP addresses, machine and boot IDs, email addresses, credentials and tokens in strings. Matching is case-insensitive, and the text is normalized to NFC first.

Functions

SendFailure

Why a send failed, in words an app shows as they are (after "Could not send the crash report: ", or alone). Its Display is that sentence. Each variant also sets the io::Error's kind: ConnectionRefused for Unreachable, WouldBlock for RateLimited and ServerTrouble (try later), InvalidData for Rejected, Other for the rest; never NotFound, PermissionDenied or AlreadyExists, which mean "no endpoint", "reporting is off" and "already being sent". The HTTP status is read from curl's --write-out. The full curl error goes to stderr (the journal), never to the user.

Constants and re-exports