[dl-alexandre]

Problem

apple/boot.py runs palera1n -p -k <pongo> with subprocess.run(..., timeout=120). When that times out, Python SIGKILLs palera1n, but palera1n isn't the process doing the work. It posix_spawns checkra1n and only waitpids on it, so checkra1n survives as an orphan. It keeps writing to Orchard's palera1n log, and after each checkm8 timeout it waits for DFU again (Device reconnected in DFU mode, starting over).

I hit this on an iPad 6 (J71b) with a Linux host. One install attempt timed out at 20:58 because the cable wasn't replugged in time. That palera1n-*.log kept growing until 21:16. During that time, every DFU entry (21:14:08, 21:14:54, 21:15:50) was exploited again by the orphan. The last one booted Pongo, so the next orchard launch failed with:

orchard: Expected dfu at the selected port; found pongo

To anyone running Orchard, the device just seems to leave DFU on its own.

Change

run_process_group() replaces subprocess.run(check=True) for the bootstrap. It starts palera1n with start_new_session=True and, if Orchard stops waiting for any reason (timeout or KeyboardInterrupt), SIGKILLs the whole process group, checkra1n included, before re-raising. The success and non-zero-exit paths behave as before (CalledProcessError), and so does the RuntimeError('... outcome unknown ...') wrapping and the no-retry policy.

Testing

• test_bootstrap_timeout_stops_spawned_children runs a stand-in for palera1n that backgrounds a long-lived child, then checks that the child is gone after the timeout. The same scenario with plain subprocess.run(timeout=...) leaves the child running, which I checked separately. The test passed 25 out of 25 runs.
• test_bootstrap_failure_is_reported covers non-zero exit and success.
• test_adapter_boot_sequence_timeouts_and_no_retry_are_preserved now mocks run_process_group instead of subprocess.run. I couldn't run it locally: my venv's orchard_hardware 0.1.10 has no profiles, which fails with or without this change.

Not covered here: if Orchard itself is killed with SIGTERM, the Python handlers never run, so palera1n's group can still be left behind.

🤖 Generated with Claude Code