fix(process): reap entire process group on cmd.Cancel

cmd/serv.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"net/url"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -289,7 +288,7 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		return nil
 	}
 
-	var command *exec.Cmd
+	var command *process.Cmd
 	gitBinPath := filepath.Dir(gitcmd.GitExecutable) // e.g. /usr/bin
 	gitBinVerb := filepath.Join(gitBinPath, verb)    // e.g. /usr/bin/git-upload-pack
 	if _, err := os.Stat(gitBinVerb); err != nil {
@@ -298,15 +297,14 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		verbFields := strings.SplitN(verb, "-", 2)
 		if len(verbFields) == 2 {
 			// use git binary with the sub-command part: "C:\...\bin\git.exe", "upload-pack", ...
-			command = exec.CommandContext(ctx, gitcmd.GitExecutable, verbFields[1], results.RepoStoragePath)
+			command = process.CommandContext(ctx, gitcmd.GitExecutable, verbFields[1], results.RepoStoragePath)
 		}
 	}
 	if command == nil {
 		// by default, use the verb (it has been checked above by allowedCommands)
-		command = exec.CommandContext(ctx, gitBinVerb, results.RepoStoragePath)
+		command = process.CommandContext(ctx, gitBinVerb, results.RepoStoragePath)
 	}
 
-	process.SetSysProcAttribute(command)
 	command.Dir = setting.RepoRootPath
 	command.Stdout = os.Stdout
 	command.Stdin = os.Stdin

modules/git/gitcmd/command.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"time"
@@ -47,7 +46,7 @@ type Command struct {
 	// otherwise some git commands might overwrite git dir internal files by a repo file.
 	gitDir string
 
-	cmd *exec.Cmd
+	cmd *process.Cmd
 
 	cmdCtx       context.Context
 	cmdCancel    process.CancelCauseFunc
@@ -432,30 +431,24 @@ func (c *Command) Start(ctx context.Context) (retErr error) {
 
 	c.cmdStartTime = time.Now()
 
-	c.cmd = exec.CommandContext(c.cmdCtx, c.prog, append(c.configArgs, c.args...)...)
+	c.cmd = process.CommandContext(c.cmdCtx, c.prog, append(c.configArgs, c.args...)...)
 	if c.cmdEnv == nil {
 		c.cmd.Env = os.Environ()
 	} else {
 		c.cmd.Env = c.cmdEnv
 	}
 
-	process.SetSysProcAttribute(c.cmd)
 	c.cmd.Env = append(c.cmd.Env, CommonGitCmdEnvs()...)
 	c.cmd.Dir = c.gitDir
 	c.cmd.Stdout = c.cmdStdout
 	c.cmd.Stdin = c.cmdStdin
 	c.cmd.Stderr = c.cmdStderr
-	c.cmd.Cancel = func() error {
-		// Golang's default cmd.Cancel only calls Process.Kill(), but here we need to close the parent pipes together:
-		// * for some commands like "git --batch-xxx", Windows git might have 2 processes (a wrapper and a real git process)
-		// * on Windows, if parent process is killed (context canceled), the children process won't be killed, and the pipe handles are still open.
-		// * if we don't close the parent pipes here, the children process won't exit.
-		//
-		// There is no such problem on POSIX, while it won't make things worse by closing the parent pipes also on POSIX.
-		err := c.cmd.Process.Kill()
+	c.cmd.WithOnCancelGracefully(func() error {
+		// Need to close the pipes to notify all sub processes to exit.
+		// Especially on Windows: there is no process group, and we didn't implement process job object (like process group).
 		c.closePipeFiles(c.parentPipeFiles)
-		return err
-	}
+		return nil
+	})
 	return c.cmd.Start()
 }
 

modules/git/gpg.go

@@ -27,7 +27,7 @@ type CommitSignSettings struct {
 	cachedPublicKeyContent atomic.Pointer[string]
 }
 
-func (css *CommitSignSettings) PublicKeyContent() (string, error) {
+func (css *CommitSignSettings) PublicKeyContent(ctx context.Context) (string, error) {
 	cached := css.cachedPublicKeyContent.Load()
 	if cached != nil {
 		return *cached, nil
@@ -43,7 +43,7 @@ func (css *CommitSignSettings) PublicKeyContent() (string, error) {
 		return s, nil
 	}
 
-	content, stderr, err := process.GetManager().Exec("gpg -a --export", "gpg", "-a", "--export", css.KeyID)
+	content, stderr, err := process.CommandContext(ctx, "gpg", "-a", "--export", css.KeyID).OutputString()
 	if err != nil {
 		return "", fmt.Errorf("unable to get default signing key: %s, %s, %w", css.KeyID, stderr, err)
 	}

modules/graceful/manager.go

@@ -11,7 +11,6 @@ import (
 
 	"gitea.dev/modules/gtprof"
 	"gitea.dev/modules/log"
-	"gitea.dev/modules/process"
 	"gitea.dev/modules/setting"
 )
 
@@ -62,9 +61,6 @@ func InitManager(ctx context.Context) {
 func initManager(ctx context.Context) {
 	initOnce.Do(func() {
 		manager = newGracefulManager(ctx)
-
-		// Set the process default context to the HammerContext
-		process.DefaultContext = manager.HammerContext()
 	})
 }
 

modules/markup/external/external.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"strings"
 
 	"gitea.dev/modules/markup"
@@ -147,7 +146,7 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 	processCtx, _, finished := process.GetManager().AddContext(ctx, fmt.Sprintf("Render [%s] for %s", cmdProg, baseLinkSrc))
 	defer finished()
 
-	cmd := exec.CommandContext(processCtx, cmdProg, cmdArgs...)
+	cmd := process.CommandContext(processCtx, cmdProg, cmdArgs...)
 	cmd.Env = append(
 		os.Environ(),
 		"GITEA_PREFIX_SRC="+baseLinkSrc,
@@ -159,7 +158,6 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 	var stderr bytes.Buffer
 	cmd.Stdout = output
 	cmd.Stderr = &stderr
-	process.SetSysProcAttribute(cmd)
 
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("%s render run command %s %v failed: %w\nStderr: %s", p.Name(), cmdProg, shellquote.Join(cmdArgs...), err, stderr.String())

modules/process/command.go

@@ -0,0 +1,61 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package process
+
+import (
+	"bytes"
+	"context"
+	"os/exec"
+	"time"
+)
+
+// defaultWaitDelay is how long CommandContext waits after sending SIGTERM before escalating to SIGKILL.
+const defaultWaitDelay = 10 * time.Second
+
+type Cmd struct {
+	*exec.Cmd
+
+	onCancelUserFunc func() error
+	termGraceful     bool
+}
+
+func (c *Cmd) WithOnCancelGracefully(userFunc func() error) *Cmd {
+	c.termGraceful, c.onCancelUserFunc = true, userFunc
+	return c
+}
+
+func (c *Cmd) WithOnCancelForceKill(userFunc func() error) *Cmd {
+	c.termGraceful, c.onCancelUserFunc = false, userFunc
+	return c
+}
+
+func (c *Cmd) WithDir(dir string) *Cmd {
+	c.Cmd.Dir = dir
+	return c
+}
+
+func (c *Cmd) WithWaitDelay(d time.Duration) *Cmd {
+	c.Cmd.WaitDelay = d
+	return c
+}
+
+func (c *Cmd) OutputString() (string, string, error) {
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	c.Cmd.Stdout = stdout
+	c.Cmd.Stderr = stderr
+	err := c.Cmd.Run()
+	return stdout.String(), stderr.String(), err
+}
+
+// CommandContext returns a wrapped exec.Cmd which kills the process group when the context is canceled.
+// By default, it uses graceful termination (SIGTERM) on Unix-like systems to make the subprocesses have chances
+// to clean up (e.g. remove temporary files or lock files).
+func CommandContext(ctx context.Context, name string, arg ...string) *Cmd {
+	c := &Cmd{Cmd: exec.CommandContext(ctx, name, arg...)}
+	setSysProcAttribute(c.Cmd)
+	c.Cmd.Cancel = c.onCancel
+	c.Cmd.WaitDelay = defaultWaitDelay
+	c.termGraceful = true
+	return c
+}

modules/process/command_unix.go

@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build unix
+
+package process
+
+import (
+	"os/exec"
+	"syscall"
+	"time"
+
+	"gitea.dev/modules/util"
+)
+
+func setSysProcAttribute(cmd *exec.Cmd) {
+	// When Gitea runs SubProcessA -> SubProcessB and SubProcessA gets killed by context cancel,
+	// use process group to make sure the sub processes can be killed and reaped instead of leaving defunct(zombie) processes.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+}
+
+func (c *Cmd) onCancel() error {
+	if c.onCancelUserFunc != nil {
+		if err := c.onCancelUserFunc(); err != nil {
+			return err
+		}
+	}
+	sig := util.Iif(c.termGraceful, syscall.SIGTERM, syscall.SIGKILL)
+	if sig == syscall.SIGTERM && c.Cmd.WaitDelay > 0 {
+		pgid, delay := c.Process.Pid, c.Cmd.WaitDelay
+		go func() {
+			time.Sleep(delay)
+			_ = syscall.Kill(-pgid, syscall.SIGKILL)
+		}()
+	}
+	// kill the whole process group
+	return syscall.Kill(-c.Process.Pid, sig)
+}

modules/process/command_unix_test.go

@@ -0,0 +1,136 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build unix
+
+package process
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCommandContextCancelKillProcessGroup(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	// When executing external commands, there can be multiple subprocesses involved.
+	// e.g.: Gitea ->  "git upload-pack" -> "git pack-objects".
+	// If the context is canceled (HTTP client disconnects), all subprocesses must terminate.
+
+	// Spawn a shell that itself spawns a long-lived background process and
+	// prints its PID — mimicking git upload-pack spawning git pack-objects.
+
+	r, w, err := os.Pipe()
+	require.NoError(t, err)
+
+	cmd := CommandContext(ctx, "sh", "-c", "sleep 600 & echo $!; wait")
+	cmd.Stdout = w
+	require.NoError(t, cmd.Start())
+	_ = w.Close() // parent keeps only the read end
+
+	t.Cleanup(func() {
+		// make sure our test doesn't leave a zombie process even if test fails
+		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		_ = cmd.Wait()
+	})
+
+	// Block until the shell prints the grandchild PID.
+	scanner := bufio.NewScanner(r)
+	require.True(t, scanner.Scan(), "expected grandchild PID on stdout")
+	grandchildPID, err := strconv.Atoi(strings.TrimSpace(scanner.Text()))
+	require.NoError(t, err)
+	_ = r.Close()
+
+	// Sanity: grandchild must be alive before we cancel.
+	grandchild, err := os.FindProcess(grandchildPID)
+	require.NoError(t, err)
+	require.NoError(t, grandchild.Signal(syscall.Signal(0)), "grandchild should be alive before cancel")
+
+	// Cancel the context
+	cancel()
+	_ = cmd.Wait()
+
+	// Subprocess should not exist after context cancel (killed by process group)
+	assert.Eventually(t, func() bool {
+		return grandchild.Signal(syscall.Signal(0)) != nil
+	}, 5*time.Second, 10*time.Millisecond)
+}
+
+func TestCommandContextWaitDelayOrphansGrandchild(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	r, w, err := os.Pipe()
+	require.NoError(t, err)
+
+	// Shell ignores SIGTERM; grandchild inherits SIG_IGN and also survives the group SIGTERM.
+	cmd := CommandContext(ctx, "sh", "-c", "trap '' TERM; sleep 600 & echo $!; wait").
+		WithWaitDelay(1 * time.Second)
+	cmd.Stdout = w
+	require.NoError(t, cmd.Start())
+	_ = w.Close()
+
+	var grandchildPID int
+	t.Cleanup(func() {
+		// Kill by process group — the PGID survives the group leader's death, so this reaches orphaned sleep.
+		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		_ = cmd.Wait()
+		if grandchildPID > 0 {
+			_ = syscall.Kill(grandchildPID, syscall.SIGKILL)
+		}
+	})
+
+	scanner := bufio.NewScanner(r)
+	require.True(t, scanner.Scan(), "expected grandchild PID on stdout")
+	grandchildPID, err = strconv.Atoi(strings.TrimSpace(scanner.Text()))
+	require.NoError(t, err)
+	_ = r.Close()
+
+	grandchild, err := os.FindProcess(grandchildPID)
+	require.NoError(t, err)
+	require.NoError(t, grandchild.Signal(syscall.Signal(0)), "grandchild should be alive before cancel")
+
+	cancel()
+	_ = cmd.Wait() // blocks ~1s until WaitDelay SIGKILL kills the direct child (shell)
+
+	assert.Eventually(t, func() bool {
+		return grandchild.Signal(syscall.Signal(0)) != nil
+	}, 5*time.Second, 10*time.Millisecond, "grandchild was orphaned: WaitDelay SIGKILL did not reach the process group")
+}
+
+func TestCommandContextSIGTERMIgnoredHangs(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	cmd := CommandContext(ctx, "sh", "-c", "trap '' TERM; sleep 600").WithWaitDelay(1 * time.Second)
+	require.NoError(t, cmd.Start())
+
+	waitDone := make(chan struct{})
+	go func() {
+		_ = cmd.Wait()
+		close(waitDone)
+	}()
+
+	t.Cleanup(func() {
+		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		<-waitDone
+	})
+
+	cancel()
+
+	select {
+	case <-waitDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("process did not exit after context cancel: SIGTERM ignored and no SIGKILL escalation occurred")
+	}
+}