perf: rsa sign on slacc

[acid-chicken]

RSA 署名処理に slacc@0.1.5 を使用する

What

slacc に rayon ベースのスレッドプールを用意し、aws_lc_rs を使用して RSA 署名処理をそちらに退避させる。また、このスレッドプールのスレッド数の設定を config に threadPoolSize として追加。この設定値はデフォルトで 1 で、ワーカーごとに指定した数のスレッドプールが作られる。

Why

従前の RSA 署名処理は node:crypto を使用していて、これは同期処理なのでイベントループをブロックする。
Web Crypto API に移行して非同期処理にしても、内部的には libuv のスレッドでブロッキングされ、他の libuv のスレッドに待避する処理が詰まる。そもそもこの libuv のスレッド数はデフォルトで 4 であり、何も考えずにこちらに退避させると最悪の場合 clusterLimit * 4 スレッドで CPU バウンドな署名処理が走り、スパイクを重篤化させる可能性がある（皮肉にも同期処理のおかげで回避されてきたともいえる）。
slacc に managed なスレッドプールを作り、こちらにこの CPU バウンドな処理を積むことで、libuv のスレッドで I/O バウンドな処理が詰まることなく、イベントスレッドがブロックされないようにできる。

Additional info (optional)

• slacc の変更点については: misskey-dev/slacc@0d9e043...master
• 運用者向け: threadPoolSize については基本的に 1 で良いです。特に、同一環境上に PostgreSQL などが同居していたりする状況でみだりにスレッドプール数を上げすぎてしまうと、スパイク時に頻繁なコンテキストスイッチで OOM などを引き起こして問題を発生させるリスクがあります。大規模なサーバで clusterLimit を CPU のコア数より減らして運用している場合などで初めて threadPoolSize の調整が効いてくるようになるかと思います。

Checklist

• Read the contribution guide
• Test working in a local environment
• (If needed) Add story of storybook
• (If needed) Update CHANGELOG.md
• (If possible) Add tests

[codecov]

Codecov Report

❌ Patch coverage is 45.00000% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 24.88%. Comparing base (408d056) to head (221b55c).
⚠️ Report is 1 commits behind head on develop.

Files with missing lines	Patch %	Lines
packages/backend/src/boot/common.ts	16.66%	3 Missing and 2 partials ⚠️
...s/backend/src/core/activitypub/ApRequestService.ts	77.77%	2 Missing ⚠️
...ages/backend/src/core/activitypub/JsonLdService.ts	0.00%	2 Missing ⚠️
packages/backend/src/boot/master.ts	0.00%	1 Missing ⚠️
packages/backend/src/boot/worker.ts	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #17322      +/-   ##
===========================================
+ Coverage    15.22%   24.88%   +9.66%     
===========================================
  Files          247     1153     +906     
  Lines        12322    39279   +26957     
  Branches      4170    10935    +6765     
===========================================
+ Hits          1876     9775    +7899     
- Misses        8183    23640   +15457     
- Partials      2263     5864    +3601     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Backend memory usage comparison

Before GC

Metric	base (MB)	head (MB)	Diff (MB)	Diff (%)
VmRSS	304.44 MB	327.59 MB	+23.15 MB	+7.60%
VmHWM	304.44 MB	327.59 MB	+23.15 MB	+7.60%
VmSize	23081.89 MB	23173.52 MB	+91.63 MB	+0.39%
VmData	1348.50 MB	1374.08 MB	+25.58 MB	+1.89%

After GC

Metric	base (MB)	head (MB)	Diff (MB)	Diff (%)
VmRSS	304.48 MB	327.60 MB	+23.11 MB	+7.59%
VmHWM	304.48 MB	327.60 MB	+23.11 MB	+7.59%
VmSize	23082.06 MB	23173.61 MB	+91.55 MB	+0.39%
VmData	1348.67 MB	1374.17 MB	+25.50 MB	+1.89%

After Request

Metric	base (MB)	head (MB)	Diff (MB)	Diff (%)
VmRSS	305.06 MB	327.93 MB	+22.86 MB	+7.49%
VmHWM	305.06 MB	327.93 MB	+22.86 MB	+7.49%
VmSize	23082.31 MB	23173.61 MB	+91.30 MB	+0.39%
VmData	1348.92 MB	1374.17 MB	+25.25 MB	+1.87%

⚠️ Warning: Memory usage has increased by more than 5%. Please verify this is not an unintended change.

See workflow logs for details

[github-actions]

このPRによるapi.jsonの差分
差分はありません。
Get diff files from Workflow Page

[Copilot]

Pull request overview

This PR migrates RSA signing in the backend to slacc@0.1.5 and introduces a configurable “extra” thread pool to offload CPU-bound signing work away from the Node.js event loop / libuv thread pool.

Changes:

• Upgrade slacc (and platform-specific packages) to 0.1.5 and adjust pnpm supply-chain delay exclusions.
• Replace RSA signing in ActivityPub/JSON-LD signing paths to use slacc’s RSA implementation.
• Add threadPoolSize config (default 1) and initialize the extra thread pool during backend boot.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Excludes slacc packages (and related) from minimum release age delay.
pnpm-lock.yaml	Locks slacc upgrade to 0.1.5 across platforms.
packages/backend/package.json	Bumps slacc and platform-specific optional deps to 0.1.5.
packages/backend/src/core/activitypub/JsonLdService.ts	Switches RSA signing to slacc (RsaKeyPair.sign).
packages/backend/src/core/activitypub/ApRequestService.ts	Switches HTTP signature signing to slacc (but introduces an async/signature mismatch to fix).
packages/backend/src/config.ts	Adds threadPoolSize config with defaulting in loadConfig().
packages/backend/src/boot/common.ts	Introduces initExtraThreadPool() that calls slacc.init(threadPoolSize).
packages/backend/src/boot/worker.ts	Initializes extra thread pool on worker startup.
packages/backend/src/boot/master.ts	Initializes extra thread pool on master startup.
chart/files/default.yml	Documents new threadPoolSize config option.
.devcontainer/devcontainer.yml	Documents new threadPoolSize config option.
.config/example.yml	Documents new threadPoolSize config option.
.config/docker_example.yml	Documents new threadPoolSize config option.
.config/cypress-devcontainer.yml	Documents new threadPoolSize config option.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

Pull request overview

This PR migrates RSA signing in the backend from node:crypto synchronous APIs to slacc@0.1.5, offloading CPU-bound signing work onto a managed thread pool, and introduces a new threadPoolSize config option to control that pool size.

Changes:

• Replace RSA signing implementation in ActivityPub request signing and JSON-LD signatures to use slacc (async/offloaded).
• Add and initialize threadPoolSize configuration (default 1) and wire thread-pool initialization into boot + unit test runtime.
• Update dependency manifests/lockfile and document the new config option in examples + changelog.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Excludes slacc packages (and related) from minimum release age delay.
pnpm-lock.yaml	Updates slacc and platform packages to 0.1.5 with new engine constraints.
packages/backend/package.json	Bumps slacc and platform-specific optional deps to 0.1.5.
packages/backend/src/core/activitypub/ApRequestService.ts	Makes request signing async and routes RSA signing through slacc (RsaKeyPair.sign).
packages/backend/src/core/activitypub/JsonLdService.ts	Routes RsaSignature2017 signing through slacc while keeping verification via node:crypto.
packages/backend/src/config.ts	Adds threadPoolSize to config types and loads it with a default of 1.
packages/backend/src/boot/common.ts	Adds initExtraThreadPool() wrapper around slacc.init() with a one-time guard.
packages/backend/src/boot/worker.ts	Initializes the extra thread pool early in worker startup.
packages/backend/src/boot/master.ts	Initializes the extra thread pool in master startup as well.
packages/backend/jest.config.unit.cjs	Uses a custom Jest test environment for unit tests.
packages/backend/test/jest.environment.unit.cjs	Initializes slacc thread pool for unit tests (init(1)).
packages/backend/test/unit/ap-request.ts	Updates unit tests to await the now-async signing helpers.
chart/files/default.yml	Documents threadPoolSize in the chart default config.
.devcontainer/devcontainer.yml	Documents threadPoolSize in devcontainer config.
.config/example.yml	Documents threadPoolSize in the example config.
.config/docker_example.yml	Documents threadPoolSize in the docker example config.
.config/cypress-devcontainer.yml	Documents threadPoolSize in the cypress devcontainer config.
CHANGELOG.md	Notes the new threadPoolSize option and mentions RSA signing offload.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[syuilo]

/preview

[syuilo]

👍