Missing lock GET /api/snapshots when DELETE /api/snapshots is running in async mode

[cchazalet]

aptly 1.6.3
Jenny 1.0.7

Using our tool Jenny, when I execute the GET /api/snapshots request to list snapshots while a DELETE /api/snapshots task is running in asynchronous mode, I get a 500 error:
Error #1: key not found

Here is the sequence of requests:

Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 15.137393ms | 127.0.0.1 | DELETE   "/api/snapshots/trixie-security--test--main_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 14.073079ms | 127.0.0.1 | DELETE   "/api/snapshots/trixie-security--stable--main_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 201 | 5.9931ms | 127.0.0.1 | POST "/api/mirrors/trixie-security--test--contrib/snapshots"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 201 | 22.350422ms | 127.0.0.1 | POST "/api/repos/trixie-security--stable--contrib/snapshots"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 200 | 24.870867ms | 127.0.0.1 | GET "/api/snapshots/trixie-security--test--contrib_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfor diff/diff/trixie-security--stable--contrib_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 14.941925ms | 127.0.0.1 | DELETE "/api/snapshots/trixie-security--test--contrib_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 12.169098ms | 127.0.0.1 | DELETE "/api/snapshots/trixie-security--stable--contrib_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 201 | 8.882201ms | 127.0.0.1 | POST "/api/mirrors/trixie-security--test--non-free/snapshots"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 201 | 10.596446ms | 127.0.0.1 | POST "/api/repos/trixie-security--stable--non-free/snapshots"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 200 | 24.895437ms | 127.0.0.1 | GET "/api/snapshots/trixie-security--test--non-free_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfor diff/diff/trixie-security--stable--non-free_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 16.661178ms | 127.0.0.1 | DELETE "/api/snapshots/trixie-security--test--non-free_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 15.281004ms | 127.0.0.1 | DELETE "/api/snapshots/trixie-security--stable--non-free_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 201 | 17.057037ms | 127.0.0.1 | POST "/api/mirrors/trixie-security--test--non-free-firmware/snapshots"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 201 | 8.325555ms | 127.0.0.1 | POST "/api/repos/trixie-security--stable--non-free-firmware/snapshots"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 200 | 59.638874ms | 127.0.0.1 | GET "/api/snapshots/trixie-security--test--non-free-firmware_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfor diff/diff/trixie-security--stable--non-free-firmware_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 43.6013ms | 127.0.0.1 | DELETE   "/api/snapshots/trixie-security--test--non-free-firmware_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:52 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:52 | 202 | 19.431461ms | 127.0.0.1 | DELETE   "/api/snapshots/trixie-security--stable--non-free-firmware_87d6240e-52e0-44ad-84ee-4b2fdcbb17f1_tmpfordiff?_async=true"
Aug 14 10:51:54 server1 aptly[46508]: [GIN] 2026/08/14 - 10:51:54 | 500 | 2.005464641s | 127.0.0.1 | GET      "/api/snapshots"
Aug 14 10:51:54 server1 aptly[46508]: Error #01: key not found

I think a lock is missing during snapshot deletion to prevent this error.

When performing the same action in Jenny but sending the DELETE /api/snapshots requests with async=False, I don't get the error.

[rolandmas]

FYI: Our workaround in Jenny is to postpone the snapshot deletion until after we get the listing of existing snapshots. There's still a risk that another operation triggers a "GET /api/snapshots" at that later time, but the window of time for the race condition is much shorter.