1
0
mirror of https://github.com/git/git.git synced 2024-10-21 03:28:41 +02:00
Commit Graph

16773 Commits

Author SHA1 Message Date
Alexander Gavrilov
19fb896f5b Windows: Make OpenSSH properly detect tty detachment.
Apparently, CREATE_NO_WINDOW makes the OS tell the process
that it has a console, but without actually creating the
window. As a result, when git is started from GUI, ssh
tries to ask its questions on the invisible console.

This patch uses DETACHED_PROCESS instead, which clearly
means that the process should be left without a console.
The downside is that if the process manually calls
AllocConsole, the window will appear. A similar thing
might occur if it calls another console executable.

Signed-off-by: Alexander Gavrilov <angavrilov@gmail.com>
Acked-by: Johannes Sixt <johannes.sixt@telecom.at>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-06 09:26:06 -08:00
Deskin Miller
6e5121f26e git-svn: proper detection of bare repositories
When in a bare repository (or .git, for that matter), git-svn would fail
to initialise properly, since git rev-parse --show-cdup would not output
anything.  However, git rev-parse --show-cdup actually returns an error
code if it's really not in a git directory.

Fix the issue by checking for an explicit error from git rev-parse, and
setting $git_dir appropriately if instead it just does not output.

Signed-off-by: Deskin Miller <deskinm@umich.edu>
Acked-by: Eric Wong <normalperson@yhbt.net>
2008-11-06 01:39:41 -08:00
Eric Wong
aab5720551 git-svn: respect i18n.commitencoding config
SVN itself always stores log messages in the repository as
UTF-8.  git always stores/retrieves everything as raw binary
data with no transformations whatsoever.

To interact with SVN, we need to encode log messages as UTF-8
before sending them to SVN, as SVN cannot do it for us.  When
retrieving log messages from SVN, we also need to (attempt to)
reencode the UTF-8 log message back to the user-specified commit
encoding.

Note, handling i18n.logoutputencoding for "git svn log" also
needs to be done in a future change.

Also, this change only deals with the encoding of commit
messages and nothing else (path names, blob content, ...).

In-Reply-To: <8b168cfb0810282014r789ac01dnec51824de1078f0@mail.gmail.com>
James North <tocapicha@gmail.com> wrote:
> Hi,
>
> I'm using git-svn on a system with ISO-8859-1 encoding. The problem is
> when I try to use "git svn dcommit" to send changes to a remote svn
> (also ISO-8859-1).
>
> Seems like git-svn is sending commit messages with utf-8 (just a
> guessing...) and they look bad on the remote svn log. E.g. "Ca?\241a
> de cami?\243n"
>
> I have tried using i18n.commitencoding=ISO-8859-1 as suggested by the
> warning when doing "git svn dcommit" but messages still are sent with
> wrong encoding.

Signed-off-by: Eric Wong <normalperson@yhbt.net>
2008-11-06 00:52:18 -08:00
Eric Wong
163f3689e9 git-svn: don't escape tilde ('~') for http(s) URLs
Thanks to Jose Carlos Garcia Sogo and Björn Steinbrink for the
bug report.

On 2008.10.18 23:39:19 +0200, Björn Steinbrink wrote:
> Hi,
>
> Jose Carlos Garcia Sogo reported on #git that a git-svn clone of this
> svn repo fails for him:
> https://sucs.org/~welshbyte/svn/backuptool/trunk
>
> I can reproduce that here with:
> git-svn version 1.6.0.2.541.g46dc1.dirty (svn 1.5.1)
>
> The error message I get is:
> Apache got a malformed URI: Unusable URI: it does not refer to this
> repository at /usr/local/libexec/git-core/git-svn line 4057
>
> strace revealed that git-svn url-encodes ~ while svn does not do that.
>
> For svn we have:
> write(5, "<S:update-report send-all=\"true\" xmlns:S=\"svn:\">
> <S:src-path>https://sucs.org/~welshbyte/svn/backuptool/trunk</S:src-path>...
>
> While git-svn shows:
> write(7, "<S:update-report send-all=\"true\" xmlns:S=\"svn:\">
> <S:src-path>https://sucs.org/%7Ewelshbyte/svn/backuptool/trunk</S:src-path>...

Signed-off-by: Eric Wong <normalperson@yhbt.net>
2008-11-06 00:52:18 -08:00
Clemens Buchacher
16ed2f48be push: fix local refs update if already up-to-date
git push normally updates local refs only after a successful push. If the
remote already has the updates -- pushed indirectly through another repository,
for example -- we forget to update local tracking refs.

Signed-off-by: Clemens Buchacher <drizzd@aon.at>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-05 14:22:10 -08:00
Clemens Buchacher
5bdd8d4a30 do not force write of packed refs
We force writing a ref if it does not exist. Originally, we only had to look
for the ref file to check if it existed. Now we have to look for a packed ref
as well. Luckily, resolve_ref already does all the work for us.

Signed-off-by: Clemens Buchacher <drizzd@aon.at>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-05 14:09:43 -08:00
Miklos Vajna
bf98421a33 Implement git remote rename
The new rename subcommand does the followings:

1) Renames the remote.foo configuration section to remote.bar

2) Updates the remote.bar.fetch refspecs

3) Updates the branch.*.remote settings

4) Renames the tracking branches: renames the normal refs and rewrites
   the symrefs to point to the new refs.

Signed-off-by: Miklos Vajna <vmiklos@frugalware.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-05 12:23:48 -08:00
Junio C Hamano
6331adb9c4 Update draft release notes to 1.6.1
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-05 12:20:55 -08:00
Junio C Hamano
a1a846a19e Merge branch 'ar/mksnpath'
* ar/mksnpath:
  Use git_pathdup instead of xstrdup(git_path(...))
  git_pathdup: returns xstrdup-ed copy of the formatted path
  Fix potentially dangerous use of git_path in ref.c
  Add git_snpath: a .git path formatting routine with output buffer
  Fix potentially dangerous uses of mkpath and git_path
  Fix potentially dangerous uses of mkpath and git_path
  Fix mkpath abuse in dwim_ref and dwim_log of sha1_name.c
  Add mksnpath which allows you to specify the output buffer

Conflicts:
	builtin-revert.c
2008-11-05 11:35:53 -08:00
Junio C Hamano
d95f91d9e4 Merge branch 'jc/gitweb-fix-cloud-tag'
* jc/gitweb-fix-cloud-tag:
  Fix reading of cloud tags
2008-11-05 11:34:28 -08:00
Junio C Hamano
efcce2e1f0 Merge branch 'mv/maint-branch-m-symref'
* mv/maint-branch-m-symref:
  update-ref --no-deref -d: handle the case when the pointed ref is packed
  git branch -m: forbid renaming of a symref
  Fix git update-ref --no-deref -d.
  rename_ref(): handle the case when the reflog of a ref does not exist
  Fix git branch -m for symrefs.
2008-11-05 11:33:19 -08:00
Junio C Hamano
7bc9ed0d5b Merge branch 'mv/parseopt-checkout-index'
* mv/parseopt-checkout-index:
  parse-opt: migrate builtin-checkout-index.
2008-11-05 11:25:58 -08:00
Samuel Tardieu
e0e03a731b tag: Add more tests about mixing incompatible modes and options
Signed-off-by: Samuel Tardieu <sam@rfc1149.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 15:46:47 -08:00
Samuel Tardieu
6fa8342b12 tag: Check that options are only allowed in the appropriate mode
If "git tag -d -l -v ..." is called, only "-l" is honored, which is
arbitrary and wrong. Also, unrecognized options are accepted in the
wrong modes, causing for example "git tag -n 100" to create a tag
named "100" while the user may have wanted to type "git tag -n100".

This patch checks that "git tag" knows in what mode it operates before
performing any operation and accepts only the related options.

Signed-off-by: Samuel Tardieu <sam@rfc1149.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 15:46:39 -08:00
Junio C Hamano
5508064394 Merge branch 'maint'
* maint:
  format-patch documentation: mention the special case of showing a single commit
2008-11-04 15:11:26 -08:00
Pete Harlan
b0a7d11173 contrib/hooks/post-receive-email: Make revision display configurable
Add configuration option hooks.showrev, letting the user override how
revisions will be shown in the commit email.

Signed-off-by: Pete Harlan <pgit@pcharlan.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 14:43:16 -08:00
Pete Harlan
4471649f44 contrib/hooks/post-receive-email: Put rev display in separate function
The display of a revision in an email-appropriate format is done in
two places with similar code.  In preparation for making that display
more complex, move it into a separate function that handles both cases.

Signed-off-by: Pete Harlan <pgit@pcharlan.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 14:43:07 -08:00
Paul Mackerras
48a81b7cda gitk: Cope with unmerged files in local changes
This modifies gettreediffline so that it when we get both a "U" line
and an "M" line for the same file in the output from git diff-files
or git diff-index --cached (used when the user clicks on a fake commit)
we don't add the same filename to the treediff list twice.

This also makes getblobdiffline recognize the "* Unmerged path ..."
lines we get when we ask for the actual diffs, and makes a tiny
optimization in makediffhdr.

Signed-off-by: Paul Mackerras <paulus@samba.org>
2008-11-04 21:09:00 +11:00
Linus Torvalds
78892e3261 revision traversal: '--simplify-by-decoration'
With this, you can simplify history not by the contents of the tree, but
whether a commit has been named (ie it's referred to by some branch or
tag) or not.

This makes it possible to see the relationship between different named
commits, without actually seeing any of the details.

When used with pathspec, you would get the usual view that is limited to
the commits that change the contents of the tree plus commits that are
named.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 00:45:34 -08:00
Linus Torvalds
d467a525da Make '--decorate' set an explicit 'show_decorations' flag
We will want to add decorations without necessarily showing them, so add
an explicit revisions info flag as to whether we're showing decorations
or not.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 00:08:19 -08:00
Linus Torvalds
3a5e860815 revision: make tree comparison functions take commits rather than trees
This will make it easier to do various clever things that don't depend
on the pure tree contents.  It also makes the parameter passing much
simpler - the callers doesn't really look at trees anywhere else, and
it's really the function that should look at the low-level details.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 00:08:12 -08:00
Linus Torvalds
0f3a290b89 Add a 'source' decorator for commits
We already support decorating commits by tags or branches that point to
them, but especially when we are looking at multiple branches together,
we sometimes want to see _how_ we reached a particular commit.

We can abuse the '->util' field in the commit to keep track of that as
we walk the commit lists, and get a reasonably useful view into which
branch or tag first reaches that commit.

Of course, if the commit is reachable through multiple sources (which is
common), our particular choice of "first" reachable is entirely random
and depends on the particular path we happened to follow.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-04 00:08:03 -08:00
Paul Mackerras
fc4977e1b9 gitk: Make "show origin of this line" work on fake commits
This makes the "Show origin of this line" menu item work correctly
on the fake commits that gitk shows for local uncommitted changes.
With the fake commit for changes that aren't checked in to the index,
we can actually get a 3-way diff shown, which means we might have to
blame either the parent or the commit being merged in (which we get
from .git/MERGE_HEAD).

If the parent is the fake commit which shows the changes that have
been checked in to the index, then we need to get the SHA1 of the blob
for the version of the file that is in the index, then use git cat-file
blob to get the contents of the blob, and give that to git blame with --contents - so that git blame will do the blame on the index version
of the file.  In that case, we might get the all-zeroes SHA1 back from
git blame, meaning that the line is new in the index version of the
file, so then we have to use $nullid2 (the pseudo-SHA1 of the fake
commit for the checked-in changes).

Signed-off-by: Paul Mackerras <paulus@samba.org>
2008-11-04 12:57:44 +11:00
Markus Heidelberg
b1a46b70b3 Makefile: add install-man rules (quick and normal)
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 20:46:52 -08:00
Junio C Hamano
16088d8870 format-patch documentation: mention the special case of showing a single commit
Even long timers seem to have missed that "format-patch -1 $commit" is a
much simpler and more obvious way to say "format-patch $commit^..$commit"
from the current documentation (and an example "format-patch -3 $commit"
to get three patches).  Add an explicit instruction in a much earlier part
of the documentation to make it easier to find.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 20:45:55 -08:00
Giuseppe Bilotta
c752a0e00c gitweb: embed snapshot format parameter in PATH_INFO
When PATH_INFO is active, get rid of the sf CGI parameter by embedding
the snapshot format information in the PATH_INFO URL, in the form of an
appropriate extension.

Signed-off-by: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 19:23:10 -08:00
Giuseppe Bilotta
1ec2fb5fa3 gitweb: retrieve snapshot format from PATH_INFO
We parse requests for $project/snapshot/$head.$sfx as equivalent to
$project/snapshot/$head?sf=$sfx, where $sfx is any of the known
(although not necessarily supported) snapshot formats (or its default
suffix).

The filename for the resulting package preserves the requested
extensions (so asking for a .tgz gives a .tgz, and asking for a .tar.gz
gives a .tar.gz), although for obvious reasons it doesn't preserve the
basename (git/snapshot/next.tgz returns a file names git-next.tgz).

This introduces a potential case for ambiguity if a project has a head
that ends with a snapshot-like suffix (.zip, .tgz, .tar.gz, etc) and the
sf CGI parameter is not present; however, gitweb only produces URLs with
the sf parameter currently, so this is only a potential issue for
hand-coded URLs for extremely unusual project.

Signed-off-by: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 19:20:52 -08:00
David M. Syzdek
158629b2c9 Make Pthread link flags configurable
FreeBSD 4.x systems use the linker flags `-pthread' instead of the
linker flags `-lpthread' when linking against the pthread library.

Signed-off-by: David M. Syzdek <david.syzdek@acsalaska.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 16:41:41 -08:00
Junio C Hamano
9f8f132621 Update draft release notes to 1.6.1
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 16:37:39 -08:00
Junio C Hamano
84cdd3c635 Merge branch 'maint'
* maint:
  Add reference for status letters in documentation.
  Document that git-log takes --all-match.
  Update draft 1.6.0.4 release notes
2008-11-02 16:36:40 -08:00
Junio C Hamano
275ee50c81 Merge branch 'np/index-pack'
* np/index-pack:
  index-pack: don't leak leaf delta result
  improve index-pack tests
  fix multiple issues in index-pack
  index-pack: smarter memory usage during delta resolution
  index-pack: rationalize delta resolution code
2008-11-02 16:36:37 -08:00
Junio C Hamano
7ff866eb1b Merge branch 'sh/rebase-i-p'
* sh/rebase-i-p:
  git-rebase--interactive.sh: comparision with == is bashism
  rebase-i-p: minimum fix to obvious issues
  rebase-i-p: if todo was reordered use HEAD as the rewritten parent
  rebase-i-p: do not include non-first-parent commits touching UPSTREAM
  rebase-i-p: only list commits that require rewriting in todo
  rebase-i-p: fix 'no squashing merges' tripping up non-merges
  rebase-i-p: delay saving current-commit to REWRITTEN if squashing
  rebase-i-p: use HEAD for updating the ref instead of mapping OLDHEAD
  rebase-i-p: test to exclude commits from todo based on its parents
2008-11-02 16:36:33 -08:00
Junio C Hamano
0eb5ebc1d8 Merge branch 'ag/blame-encoding'
* ag/blame-encoding:
  builtin-blame: Reencode commit messages according to git-log rules.
2008-11-02 16:36:30 -08:00
Junio C Hamano
7429ed2bad Merge branch 'gb/gitweb-pathinfo'
* gb/gitweb-pathinfo:
  gitweb: generate parent..current URLs
  gitweb: parse parent..current syntax from PATH_INFO
  gitweb: use_pathinfo filenames start with /
  gitweb: generate project/action/hash URLs
  gitweb: parse project/action/hash_base:filename PATH_INFO
2008-11-02 16:36:25 -08:00
Junio C Hamano
bfd59c493d Merge branch 'cj/maint-gitpm-fix-maybe-self'
* cj/maint-gitpm-fix-maybe-self:
  Git.pm: do not break inheritance
2008-11-02 16:36:21 -08:00
Yann Dirson
a5a323f33c Add reference for status letters in documentation.
Also fix error in diff_filepair::status documentation, and point to
the in-code reference as well as the doc.

Signed-off-by: Yann Dirson <ydirson@altern.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:57:10 -08:00
Mikael Magnusson
7756ba74c0 Document that git-log takes --all-match.
Signed-off-by: Mikael Magnusson <mikachu@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:51:37 -08:00
David M. Syzdek
1689c5de87 autoconf: Add link tests to each AC_CHECK_FUNC() test
Update configure.ac to test libraries for getaddrinfo, strcasestr, memmem,
strlcpy, strtoumax, setenv, unsetenv, and mkdtemp.  The default compilers
on FreeBSD 4.9-SECURITY and FreeBSD 6.2-RELEASE-p4 do not generate warnings
for missing prototypes unless `-Wall' is used. This behavior renders the
results of AC_CHECK_FUNC() void on these platforms. The test AC_SEARCH_LIBS()
verifies a function is valid by linking to symbol within the system libraries.

Since this pattern needs to be repeated for many functions that are
checked with AC_CHECK_FUNC(), we add GIT_CHECK_FUNC() to drive the two
autoconf macros together.

Signed-off-by: David M. Syzdek <david.syzdek@acsalaska.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:39:54 -08:00
Giuseppe Bilotta
5e166843f5 gitweb: make the supported snapshot formats array global
The array of supported snapshot format is used and defined (with two
different names) in two routines, one of which (format_snapshot_links)
is often called multiple times per page.

Simplify code and speed up page generation by making the array global.

Signed-off-by: Giuseppe Bilotta <giuseppe.bilotta@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:37:55 -08:00
Nicolas Pitre
59dd9ed183 pack-objects: don't leak pack window reference when splitting packs
Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:35 -08:00
Nicolas Pitre
538cf6b6e5 extend test coverage for latest pack corruption resilience improvements
Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:35 -08:00
Nicolas Pitre
64bd76b1de pack-objects: allow "fixing" a corrupted pack without a full repack
When the pack data to be reused is found to be bad, let's fall back to
full object access through the generic path which has its own strategies
to find alternate object sources in that case.  This allows for "fixing"
a corrupted pack simply by copying either another pack containing the
object(s) found to be bad, or the loose object itself, into the object
store and launch a repack without the need for -f.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:35 -08:00
Nicolas Pitre
08698b1e32 make find_pack_revindex() aware of the nasty world
It currently calls die() whenever given offset is not found thinking
that such thing should never happen.  But this offset may come from a
corrupted pack whych _could_ happen and not be found.  Callers should
deal with this possibility gracefully instead.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:35 -08:00
Nicolas Pitre
03d660150c make check_object() resilient to pack corruptions
The check_object() function tries to get away with the least amount of
pack access possible when it already has partial information on given
object rather than calling the more costly packed_object_info().

When things don't look right, it should just give up and fall back to
packed_object_info() directly instead of die()'ing.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:35 -08:00
Nicolas Pitre
3d77d8774f make packed_object_info() resilient to pack corruptions
In the same spirit as commit 8eca0b47ff, let's try to survive a pack
corruption by making packed_object_info() able to fall back to alternate
packs or loose objects.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:35 -08:00
Nicolas Pitre
09ded04b7e make unpack_object_header() non fatal
It is possible to have pack corruption in the object header.  Currently
unpack_object_header() simply die() on them instead of letting the caller
deal with that gracefully.

So let's have unpack_object_header() return an error instead, and find
a better name for unpack_object_header_gently() in that context.  All
callers of unpack_object_header() are ready for it.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:34 -08:00
Nicolas Pitre
d8f325563d better validation on delta base object offsets
In one case, it was possible to have a bad offset equal to 0 effectively
pointing a delta onto itself and crashing git after too many recursions.
In the other cases, a negative offset could result due to off_t being
signed.  Catch those.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:34 -08:00
Nicolas Pitre
0e8189e270 close another possibility for propagating pack corruption
Abstract
--------

With index v2 we have a per object CRC to allow quick and safe reuse of
pack data when repacking.  This, however, doesn't currently prevent a
stealth corruption from being propagated into a new pack when _not_
reusing pack data as demonstrated by the modification to t5302 included
here.

The Context
-----------

The Git database is all checksummed with SHA1 hashes.  Any kind of
corruption can be confirmed by verifying this per object hash against
corresponding data.  However this can be costly to perform systematically
and therefore this check is often not performed at run time when
accessing the object database.

First, the loose object format is entirely compressed with zlib which
already provide a CRC verification of its own when inflating data.  Any
disk corruption would be caught already in this case.

Then, packed objects are also compressed with zlib but only for their
actual payload.  The object headers and delta base references are not
deflated for obvious performance reasons, however this leave them
vulnerable to potentially undetected disk corruptions.  Object types
are often validated against the expected type when they're requested,
and deflated size must always match the size recorded in the object header,
so those cases are pretty much covered as well.

Where corruptions could go unnoticed is in the delta base reference.
Of course, in the OBJ_REF_DELTA case,  the odds for a SHA1 reference to
get corrupted so it actually matches the SHA1 of another object with the
same size (the delta header stores the expected size of the base object
to apply against) are virtually zero.  In the OBJ_OFS_DELTA case, the
reference is a pack offset which would have to match the start boundary
of a different base object but still with the same size, and although this
is relatively much more "probable" than in the OBJ_REF_DELTA case, the
probability is also about zero in absolute terms.  Still, the possibility
exists as demonstrated in t5302 and is certainly greater than a SHA1
collision, especially in the OBJ_OFS_DELTA case which is now the default
when repacking.

Again, repacking by reusing existing pack data is OK since the per object
CRC provided by index v2 guards against any such corruptions. What t5302
failed to test is a full repack in such case.

The Solution
------------

As unlikely as this kind of stealth corruption can be in practice, it
certainly isn't acceptable to propagate it into a freshly created pack.
But, because this is so unlikely, we don't want to pay the run time cost
associated with extra validation checks all the time either.  Furthermore,
consequences of such corruption in anything but repacking should be rather
visible, and even if it could be quite unpleasant, it still has far less
severe consequences than actively creating bad packs.

So the best compromize is to check packed object CRC when unpacking
objects, and only during the compression/writing phase of a repack, and
only when not streaming the result.  The cost of this is minimal (less
than 1% CPU time), and visible only with a full repack.

Someone with a stats background could provide an objective evaluation of
this, but I suspect that it's bad RAM that has more potential for data
corruptions at this point, even in those cases where this extra check
is not performed.  Still, it is best to prevent a known hole for
corruption when recreating object data into a new pack.

What about the streamed pack case?  Well, any client receiving a pack
must always consider that pack as untrusty and perform full validation
anyway, hence no such stealth corruption could be propagated to remote
repositoryes already.  It is therefore worthless doing local validation
in that case.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 15:22:15 -08:00
Junio C Hamano
02893a8503 Update draft 1.6.0.4 release notes
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-02 14:35:41 -08:00
Junio C Hamano
f6276b788f Merge branch 'js/maint-fetch-update-head' into maint
* js/maint-fetch-update-head:
  pull: allow "git pull origin $something:$current_branch" into an unborn branch
  Fix fetch/pull when run without --update-head-ok
2008-11-02 13:37:16 -08:00