mirror of
https://github.com/git/git
synced 2024-11-05 18:59:29 +00:00
968f12fdac
The original point of the GIT_REF_PARANOIA flag was to include broken
refs in iterations, so that possibly-destructive operations would not
silently ignore them (and would generally instead try to operate on the
oids and fail when the objects could not be accessed).
We already turned this on by default for some dangerous operations, like
"repack -ad" (where missing a reachability tip would mean dropping the
associated history). But it was not on for general use, even though it
could easily result in the spreading of corruption (e.g., imagine
cloning a repository which simply omits some of its refs because
their objects are missing; the result quietly succeeds even though you
did not clone everything!).
This patch turns on GIT_REF_PARANOIA by default. So a clone as mentioned
above would actually fail (upload-pack tells us about the broken ref,
and when we ask for the objects, pack-objects fails to deliver them).
This may be inconvenient when working with a corrupted repository, but:
- we are better off to err on the side of complaining about
corruption, and then provide mechanisms for explicitly loosening
safety.
- this is only one type of corruption anyway. If we are missing any
other objects in the history that _aren't_ ref tips, then we'd
behave similarly (happily show the ref, but then barf when we
started traversing).
We retain the GIT_REF_PARANOIA variable, but simply default it to "1"
instead of "0". That gives the user an escape hatch for loosening this
when working with a corrupt repository. It won't work across a remote
connection to upload-pack (because we can't necessarily set environment
variables on the remote), but there the client has other options (e.g.,
choosing which refs to fetch).
As a bonus, this also makes ref iteration faster in general (because we
don't have to call has_object_file() for each ref), though probably not
noticeably so in the general case. In a repo with a million refs, it
shaved a few hundred milliseconds off of upload-pack's advertisement;
that's noticeable, but most repos are not nearly that large.
The possible downside here is that any operation which iterates refs but
doesn't ever open their objects may now quietly claim to have X when the
object is corrupted (e.g., "git rev-list new-branch --not --all" will
treat a broken ref as uninteresting). But again, that's not really any
different than corruption below the ref level. We might have
refs/heads/old-branch as non-corrupt, but we are not actively checking
that we have the entire reachable history. Or the pointed-to object
could even be corrupted on-disk (but our "do we have it" check would
still succeed). In that sense, this is merely bringing ref-corruption in
line with general object corruption.
One alternative implementation would be to actually check for broken
refs, and then _immediately die_ if we see any. That would cause the
"rev-list --not --all" case above to abort immediately. But in many ways
that's the worst of all worlds:
- it still spends time looking up the objects an extra time
- it still doesn't catch corruption below the ref level
- it's even more inconvenient; with the current implementation of
GIT_REF_PARANOIA for something like upload-pack, we can make
the advertisement and let the client choose a non-broken piece of
history. If we bail as soon as we see a broken ref, they cannot even
see the advertisement.
The test changes here show some of the fallout. A non-destructive "git
repack -adk" now fails by default (but we can override it). Deleting a
broken ref now actually tells the hooks the correct "before" state,
rather than a confusing null oid.
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Tan <jonathantanmy@google.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
139 lines
4.3 KiB
Bash
Executable file
139 lines
4.3 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
test_description='
|
|
Test pruning of repositories with minor corruptions. The goal
|
|
here is that we should always be erring on the side of safety. So
|
|
if we see, for example, a ref with a bogus name, it is OK either to
|
|
bail out or to proceed using it as a reachable tip, but it is _not_
|
|
OK to proceed as if it did not exist. Otherwise we might silently
|
|
delete objects that cannot be recovered.
|
|
|
|
Note that we do assert command failure in these cases, because that is
|
|
what currently happens. If that changes, these tests should be revisited.
|
|
'
|
|
GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
|
|
export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
|
|
|
|
. ./test-lib.sh
|
|
|
|
test_expect_success 'disable reflogs' '
|
|
git config core.logallrefupdates false &&
|
|
git reflog expire --expire=all --all
|
|
'
|
|
|
|
create_bogus_ref () {
|
|
test_when_finished 'rm -f .git/refs/heads/bogus..name' &&
|
|
echo $bogus >.git/refs/heads/bogus..name
|
|
}
|
|
|
|
test_expect_success 'create history reachable only from a bogus-named ref' '
|
|
test_tick && git commit --allow-empty -m main &&
|
|
base=$(git rev-parse HEAD) &&
|
|
test_tick && git commit --allow-empty -m bogus &&
|
|
bogus=$(git rev-parse HEAD) &&
|
|
git cat-file commit $bogus >saved &&
|
|
git reset --hard HEAD^
|
|
'
|
|
|
|
test_expect_success 'pruning does not drop bogus object' '
|
|
test_when_finished "git hash-object -w -t commit saved" &&
|
|
create_bogus_ref &&
|
|
test_must_fail git prune --expire=now &&
|
|
git cat-file -e $bogus
|
|
'
|
|
|
|
test_expect_success 'put bogus object into pack' '
|
|
git tag reachable $bogus &&
|
|
git repack -ad &&
|
|
git tag -d reachable &&
|
|
git cat-file -e $bogus
|
|
'
|
|
|
|
test_expect_success 'non-destructive repack bails on bogus ref' '
|
|
create_bogus_ref &&
|
|
test_must_fail git repack -adk
|
|
'
|
|
|
|
test_expect_success 'GIT_REF_PARANOIA=0 overrides safety' '
|
|
create_bogus_ref &&
|
|
GIT_REF_PARANOIA=0 git repack -adk
|
|
'
|
|
|
|
|
|
test_expect_success 'destructive repack keeps packed object' '
|
|
create_bogus_ref &&
|
|
test_must_fail git repack -Ad --unpack-unreachable=now &&
|
|
git cat-file -e $bogus &&
|
|
test_must_fail git repack -ad &&
|
|
git cat-file -e $bogus
|
|
'
|
|
|
|
test_expect_success 'destructive repack not confused by dangling symref' '
|
|
test_when_finished "git symbolic-ref -d refs/heads/dangling" &&
|
|
git symbolic-ref refs/heads/dangling refs/heads/does-not-exist &&
|
|
git repack -ad &&
|
|
test_must_fail git cat-file -e $bogus
|
|
'
|
|
|
|
# We create two new objects here, "one" and "two". Our
|
|
# main branch points to "two", which is deleted,
|
|
# corrupting the repository. But we'd like to make sure
|
|
# that the otherwise unreachable "one" is not pruned
|
|
# (since it is the user's best bet for recovering
|
|
# from the corruption).
|
|
#
|
|
# Note that we also point HEAD somewhere besides "two",
|
|
# as we want to make sure we test the case where we
|
|
# pick up the reference to "two" by iterating the refs,
|
|
# not by resolving HEAD.
|
|
test_expect_success 'create history with missing tip commit' '
|
|
test_tick && git commit --allow-empty -m one &&
|
|
recoverable=$(git rev-parse HEAD) &&
|
|
git cat-file commit $recoverable >saved &&
|
|
test_tick && git commit --allow-empty -m two &&
|
|
missing=$(git rev-parse HEAD) &&
|
|
git checkout --detach $base &&
|
|
rm .git/objects/$(echo $missing | sed "s,..,&/,") &&
|
|
test_must_fail git cat-file -e $missing
|
|
'
|
|
|
|
test_expect_success 'pruning with a corrupted tip does not drop history' '
|
|
test_when_finished "git hash-object -w -t commit saved" &&
|
|
test_must_fail git prune --expire=now &&
|
|
git cat-file -e $recoverable
|
|
'
|
|
|
|
test_expect_success 'pack-refs does not silently delete broken loose ref' '
|
|
git pack-refs --all --prune &&
|
|
echo $missing >expect &&
|
|
git rev-parse refs/heads/main >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
# we do not want to count on running pack-refs to
|
|
# actually pack it, as it is perfectly reasonable to
|
|
# skip processing a broken ref
|
|
test_expect_success 'create packed-refs file with broken ref' '
|
|
rm -f .git/refs/heads/main &&
|
|
cat >.git/packed-refs <<-EOF &&
|
|
$missing refs/heads/main
|
|
$recoverable refs/heads/other
|
|
EOF
|
|
echo $missing >expect &&
|
|
git rev-parse refs/heads/main >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success 'pack-refs does not silently delete broken packed ref' '
|
|
git pack-refs --all --prune &&
|
|
git rev-parse refs/heads/main >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success 'pack-refs does not drop broken refs during deletion' '
|
|
git update-ref -d refs/heads/other &&
|
|
git rev-parse refs/heads/main >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_done
|