LibreOffice-Prozesse begrenzen und eigene Nachfahren bereinigen

DokuReader.py

@@ -36,6 +36,14 @@
         helper_status = 1
     raise SystemExit(helper_status)
 
+if __name__ == "__main__" and len(sys.argv) > 1 and sys.argv[1] == "--libreoffice-process-helper":
+    try:
+        from libreoffice_process import helper_main
+        helper_status = helper_main(sys.argv[2:])
+    except Exception:
+        helper_status = 1
+    raise SystemExit(helper_status)
+
 import os
 import json
 import shutil
@@ -48,6 +56,7 @@
 from datetime import datetime, timezone
 from pathlib import Path
 from office_conversion import convert_word_to_pdf, valid_pdf
+from libreoffice_process import run_libreoffice_process
 
 import tkinter as tk
 from tkinter import ttk, filedialog, messagebox, simpledialog
@@ -2027,21 +2036,25 @@ def _office_to_pdf(self, path: str, tmpdir: Path) -> str | None:
             executable = shutil.which(candidate)
             if not executable:
                 continue
+            if platform.system() == "Windows":
+                console_entry = Path(executable).with_suffix(".com")
+                if console_entry.is_file():
+                    executable = str(console_entry)
             staged = None
             try:
                 with tempfile.TemporaryDirectory(prefix=".dokureader-libreoffice-", dir=tmpdir) as temporary:
                     work = Path(temporary).resolve()
                     output_directory = work / "output"
                     output_directory.mkdir()
                     profile = work / "profile"
-                    result = subprocess.run(
+                    succeeded = run_libreoffice_process(
                         [executable, "-env:UserInstallation=" + profile.as_uri(),
                          "--headless", "--norestore", "--convert-to", "pdf",
                          "--outdir", str(output_directory), str(Path(path).resolve())],
-                        stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=180, check=False,
+                        timeout=180,
                     )
                     output = output_directory / (Path(path).stem + ".pdf")
-                    if result.returncode != 0 or not valid_pdf(output):
+                    if not succeeded or not valid_pdf(output):
                         continue
                     # Vorbereitung außerhalb des Profils: dessen Bereinigung muss
                     # vor dem Ersetzen einer früheren Konvertierung gelingen.

README.md

@@ -298,7 +298,7 @@ selection without opening the application or changing its library.
 ### Optional System Dependencies
 
 For full preview rendering and external document conversion:
-- **LibreOffice:** Required for headless DOC/DOCX/ODT/RTF to PDF conversion. Each attempt uses a fresh private user profile and output directory, with a 180-second launcher timeout. Only a newly produced, readable PDF with pages and exit code 0 is accepted. Failed conversion, profile cleanup or publication preserves the previous output. The launcher timeout does not guarantee that every descendant process has exited.
+- **LibreOffice:** Required for headless DOC/DOCX/ODT/RTF to PDF conversion. Each attempt uses a fresh private profile and output directory with a 180-second deadline. Windows terminates the owned process job and observes its exit before returning; an available `soffice.com` console entry is preferred. Linux/macOS send SIGKILL to the owned process group before waiting for and reaping its supervisor. Cleanup allows up to five additional seconds. Only a fresh readable PDF with pages, exit code 0 and successful cleanup is accepted. Conversion, profile cleanup or publication failures preserve previous output. The deadline applies per attempt; another converter may subsequently be tried. Detached POSIX processes fall outside this group boundary; termination of every grandchild is not generally proven.
 - **Poppler:** Required if using the optional `pdf2image` preview backend.
 - **Microsoft Word:** Supported on Windows 10 or later with pywin32. Word automation runs in an owned process job with a 180-second deadline covering startup, export and shutdown, plus at most five seconds for cleanup. Existing Word processes are not reused or terminated.
 

README_de.md

@@ -302,7 +302,7 @@ ohne die App zu öffnen oder die Bibliothek zu verändern.
 ### Optionale Systemabhängigkeiten
 
 Für den vollen Funktionsumfang bei Vorschau und Konvertierung:
-- **LibreOffice:** Erforderlich für die automatisierte Konvertierung von DOC/DOCX/ODT/RTF nach PDF. Jeder Versuch verwendet ein neues privates Benutzerprofil und Ausgabeverzeichnis; der gestartete Prozess erhält 180 Sekunden Frist. Nur eine neu erzeugte, lesbare PDF mit Seiten und Exit-Code 0 wird übernommen. Fehler bei Konvertierung, Profilbereinigung oder Veröffentlichung erhalten die vorherige Ausgabe. Die Prozessfrist garantiert nicht, dass sämtliche Nachfahren beendet sind.
+- **LibreOffice:** Erforderlich für die automatisierte Konvertierung von DOC/DOCX/ODT/RTF nach PDF. Jeder Versuch verwendet ein neues privates Benutzerprofil und Ausgabeverzeichnis mit 180 Sekunden Frist. Unter Windows wird der eigene Prozessjob vor Rückgabe beendet und sein Ende geprüft; ein vorhandener `soffice.com`-Konsoleneinstieg hat Vorrang. Unter Linux/macOS erhält die eigene Prozessgruppe SIGKILL, bevor ihr Helfer beendet und geerntet wird. Für die Bereinigung sind bis zu fünf zusätzliche Sekunden vorgesehen. Nur eine neue, lesbare PDF mit Seiten, Exit-Code 0 und erfolgreicher Bereinigung wird übernommen. Konvertierungs-, Profilbereinigungs- und Veröffentlichungsfehler erhalten die vorherige Ausgabe. Die Frist gilt je Versuch, anschließend kann ein anderer Konverter versucht werden. Unter POSIX bleiben aus der Gruppe abgesetzte Prozesse außerhalb dieses Schutzes; das Ende sämtlicher Enkelprozesse ist nicht allgemein nachgewiesen.
 - **Poppler:** Erforderlich bei Nutzung des optionalen `pdf2image`-Vorschau-Backends.
 - **Microsoft Word:** Unter Windows 10 oder neuer mit pywin32 unterstützt. Die Word-Automatisierung läuft in einem eigenen Prozessjob mit 180 Sekunden Frist für Start, Export und Schließen sowie höchstens fünf Sekunden Aufräumfrist. Bereits laufende Word-Prozesse werden weder verwendet noch beendet.
 

libreoffice_process.py

@@ -0,0 +1,89 @@
+"""Bound an owned LibreOffice job/session without inherited output pipes."""
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import tempfile
+import time
+
+from office_conversion import run_windows_job
+
+
+def helper_command(result, command):
+    if getattr(sys, "frozen", False):
+        prefix = [sys.executable, "--libreoffice-process-helper"]
+    else:
+        prefix = [sys.executable, str(Path(__file__).resolve())]
+    return prefix + [str(result), str(os.getpid()), *command]
+
+
+def run_libreoffice_process(command, timeout=180):
+    """Return success only after owned cleanup; raise on cleanup failure.
+
+    POSIX targets stay in a private session. Detached descendants are outside
+    that boundary; only the directly owned session leader can be reaped here.
+    """
+    if os.name == "nt":
+        return run_windows_job(command, timeout)
+    if signal.getsignal(signal.SIGCHLD) != signal.SIG_DFL:
+        raise OSError("Owned process groups require the default SIGCHLD handler")
+    with tempfile.TemporaryDirectory(prefix="dokureader-lo-process-") as temporary:
+        result = Path(temporary) / "result.json"
+        started = time.monotonic()
+        process = subprocess.Popen(helper_command(result, command), start_new_session=True,
+                                   stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                   stderr=subprocess.DEVNULL)
+        succeeded = False
+        try:
+            while time.monotonic() - started < timeout:
+                if result.exists():
+                    code = json.loads(result.read_text(encoding="utf-8"))
+                    succeeded = type(code) is int and code == 0
+                    break
+                time.sleep(0.02)
+        finally:
+            # Never poll/wait/reap the leader before this signal. Even a crashed
+            # leader reserves its PID while unreaped, preventing PGID reuse.
+            try:
+                os.killpg(process.pid, signal.SIGKILL)
+            except ProcessLookupError:
+                pass
+            finally:
+                try:
+                    process.wait(timeout=5)
+                except subprocess.TimeoutExpired as exc:
+                    raise OSError("Owned LibreOffice supervisor did not exit") from exc
+        return succeeded
+
+
+def helper_main(argv):
+    """Report converter exit atomically, retain the leader until parent cleanup."""
+    if os.name == "nt" or len(argv) < 3:
+        return 1
+    result, parent, command = Path(argv[0]), int(argv[1]), argv[2:]
+    if (os.getsid(0) != os.getpid() or os.getpgrp() != os.getpid()
+            or parent <= 0 or os.getppid() != parent):
+        return 1
+    try:
+        child = subprocess.Popen(command, stdin=subprocess.DEVNULL,
+                                 stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        while child.poll() is None:
+            if os.getppid() != parent:
+                os.killpg(os.getpgrp(), signal.SIGKILL)
+            time.sleep(0.02)
+        code = child.returncode
+    except OSError:
+        code = -1
+    staging = result.with_suffix(".tmp")
+    staging.write_text(json.dumps(code), encoding="utf-8")
+    os.replace(staging, result)
+    while True:
+        if os.getppid() != parent:
+            os.killpg(os.getpgrp(), signal.SIGKILL)
+        time.sleep(0.02)
+
+
+if __name__ == "__main__":
+    raise SystemExit(helper_main(sys.argv[1:]))

tests/source_platform_smoke.py

@@ -35,7 +35,7 @@ def runner(cmd, stdout=None, stderr=None, timeout=None, check=None):
                 writer.write(stream)
         finally:
             writer.close()
-        return mock.Mock(returncode=0)
+        return True
 
     return runner
 
@@ -116,7 +116,7 @@ def main() -> None:
                 xdg_mock.assert_called_once_with(["xdg-open", str(txt_path)], check=False, timeout=30)
 
             with mock.patch.object(DokuReader.shutil, "which", side_effect=lambda name: "/usr/bin/soffice" if name == "soffice" else None), \
-                 mock.patch.object(DokuReader.subprocess, "run", side_effect=_fake_soffice_run(tmpdir)) as soffice_mock:
+                 mock.patch.object(DokuReader, "run_libreoffice_process", side_effect=_fake_soffice_run(tmpdir)) as soffice_mock:
                 office_pdf = app._office_to_pdf(str(office_path), tmpdir)
                 _assert(office_pdf is not None, "LibreOffice-Fallback erzeugte keine PDF.")
                 _assert(Path(office_pdf).exists(), "LibreOffice-Fallback-Ausgabe fehlt.")

tests/test_libreoffice_output.py

@@ -1,6 +1,5 @@
 """LibreOffice failures cannot publish old, partial or invalid output."""
 from pathlib import Path
-from types import SimpleNamespace
 from unittest.mock import Mock
 import subprocess
 
@@ -41,9 +40,9 @@ def run(command, **kwargs):
             write_pdf(output)
         if kind == "timeout":
             raise subprocess.TimeoutExpired(command, 180)
-        return SimpleNamespace(returncode=7 if kind == "nonzero" else 0)
+        return kind != "nonzero"
 
-    monkeypatch.setattr(app.subprocess, "run", run)
+    monkeypatch.setattr(app, "run_libreoffice_process", run)
     assert app.App._office_to_pdf(None, str(source), tmp_path) is None
     assert source.read_bytes() == b"unchanged original"
     assert destination.read_bytes() == previous
@@ -69,9 +68,9 @@ def run(command, **kwargs):
         assert command[-1] == str(source.resolve())
         write_pdf(output_directory / destination.name, pages=2)
         captured.append(output_directory.parent)
-        return SimpleNamespace(returncode=0)
+        return True
 
-    monkeypatch.setattr(app.subprocess, "run", run)
+    monkeypatch.setattr(app, "run_libreoffice_process", run)
     result = app.App._office_to_pdf(None, str(source), tmp_path)
     assert result == str(destination)
     from pypdf import PdfReader
@@ -83,7 +82,7 @@ def run(command, **kwargs):
 def test_start_error_retains_word_fallback(tmp_path, monkeypatch):
     monkeypatch.setattr(app.shutil, "which", lambda name: "/private/soffice" if name == "soffice" else None)
     monkeypatch.setattr(app.platform, "system", lambda: "Windows")
-    monkeypatch.setattr(app.subprocess, "run", Mock(side_effect=OSError("cannot start")))
+    monkeypatch.setattr(app, "run_libreoffice_process", Mock(side_effect=OSError("cannot start")))
     word = Mock(return_value="word-result.pdf")
     monkeypatch.setattr(app, "convert_word_to_pdf", word)
     assert app.App._office_to_pdf(None, "source.docx", tmp_path) == "word-result.pdf"
@@ -106,10 +105,10 @@ def run(command, **kwargs):
         attempts.append((output, profile))
         if len(attempts) == 1:
             write_pdf(output / "source.pdf", pages=2)
-            return SimpleNamespace(returncode=1)
-        return SimpleNamespace(returncode=0)
+            return False
+        return True
 
-    monkeypatch.setattr(app.subprocess, "run", run)
+    monkeypatch.setattr(app, "run_libreoffice_process", run)
     assert app.App._office_to_pdf(None, str(source), tmp_path) is None
     assert len(attempts) == 2
     assert attempts[0][0] != attempts[1][0]
@@ -129,9 +128,9 @@ def test_finalization_failure_keeps_previous_pdf(tmp_path, monkeypatch, isolated
     def run(command, **kwargs):
         output = Path(command[command.index("--outdir") + 1]) / "source.pdf"
         write_pdf(output, pages=2)
-        return SimpleNamespace(returncode=0)
+        return True
 
-    monkeypatch.setattr(app.subprocess, "run", run)
+    monkeypatch.setattr(app, "run_libreoffice_process", run)
     if failure == "cleanup":
         real_temporary = app.tempfile.TemporaryDirectory
 
@@ -160,3 +159,25 @@ def fail_publish(src, dst):
     assert source.read_bytes() == b"original"
     assert destination.read_bytes() == previous
     assert sorted(path.name for path in tmp_path.iterdir()) == ["source.odt", "source.pdf"]
+
+
+def test_windows_prefers_available_console_entry(tmp_path, monkeypatch):
+    source = tmp_path / "source.odt"
+    source.write_bytes(b"original")
+    executable = tmp_path / "soffice.exe"
+    console = tmp_path / "soffice.com"
+    executable.touch()
+    console.touch()
+    monkeypatch.setattr(app.shutil, "which", lambda name: str(executable) if name == "soffice" else None)
+    monkeypatch.setattr(app.platform, "system", lambda: "Windows")
+
+    def run(command, **kwargs):
+        assert command[0] == str(console)
+        assert kwargs["timeout"] == 180
+        output = Path(command[command.index("--outdir") + 1]) / "source.pdf"
+        write_pdf(output)
+        return True
+
+    monkeypatch.setattr(app, "run_libreoffice_process", run)
+    assert app.App._office_to_pdf(None, str(source), tmp_path) == str(tmp_path / "source.pdf")
+    assert source.read_bytes() == b"original"