[2/2] tmp-objdir: disable ref updates when replacing the primary odb

Commit Message

Neeraj Singh (WINDOWS-SFS) Dec. 4, 2021, 2:40 a.m. UTC

From: Neeraj Singh <[e-mail]>

When creating a subprocess with a temporary ODB, we set the
GIT_QUARANTINE_ENVIRONMENT env var to tell child Git processes not
to update refs, since the tmp-objdir may go away.

Introduce a similar mechanism for in-process temporary ODBs when
we call tmp_objdir_replace_primary_odb. Now both mechanisms set
the disable_ref_updates flag on the odb, which is queried by
the ref_transaction_prepare function.

Note: This change adds an assumption that the state of
the_repository is relevant for any ref transaction that might
be initiated. Unwinding this assumption should be straightforward
by saving the relevant repository to query in the transaction or
the ref_store.

Peff's test case was invoking ref updates via the cachetextconv
setting. That particular code silently does nothing when a ref
update is forbidden. See the call to notes_cache_put in
fill_textconv where errors are ignored.

Reported-by: Jeff King <[e-mail]>

Signed-off-by: Neeraj Singh <[e-mail]>
Signed-off-by: Junio C Hamano <[e-mail]>
---
 environment.c  | 4 ++++
 object-file.c  | 6 ++++++
 object-store.h | 9 ++++++++-
 refs.c         | 2 +-
 repository.c   | 2 ++
 repository.h   | 1 +
 6 files changed, 22 insertions(+), 2 deletions(-)

Comments

Junio C Hamano Dec. 5, 2021, 6:23 p.m. UTC | #1

"Neeraj Singh via GitGitGadget" <[e-mail]> writes:

>  	/*
>  	 * This object store is ephemeral, so there is no need to fsync.
>  	 */
> -	int will_destroy;
> +	unsigned int will_destroy : 1;

<[e-mail]>
?

(https://github.com/git/git/pull/1076#discussion_r750645345)

Neeraj Singh Dec. 5, 2021, 11:44 p.m. UTC | #2

On Sun, Dec 05, 2021 at 10:23:08AM -0800, Junio C Hamano wrote:
> "Neeraj Singh via GitGitGadget" <[e-mail]> writes:
> 
> >  	/*
> >  	 * This object store is ephemeral, so there is no need to fsync.
> >  	 */
> > -	int will_destroy;
> > +	unsigned int will_destroy : 1;
> 
> <[e-mail]>
> ?
> 
> (https://github.com/git/git/pull/1076#discussion_r750645345)

Thanks for noticing this! I also lost one other change
while splitting this out: we are referencing
the_repository from the refs code, but as of 34224e14d we
should be picking it up from the ref_store. I'll submit
an updated series as soon as it passes CI.

Thanks,
Neeraj

Junio C Hamano Dec. 5, 2021, 11:56 p.m. UTC | #3

Neeraj Singh <[e-mail]> writes:

> On Sun, Dec 05, 2021 at 10:23:08AM -0800, Junio C Hamano wrote:
>> "Neeraj Singh via GitGitGadget" <[e-mail]> writes:
>> 
>> >  	/*
>> >  	 * This object store is ephemeral, so there is no need to fsync.
>> >  	 */
>> > -	int will_destroy;
>> > +	unsigned int will_destroy : 1;
>> 
>> <[e-mail]>
>> ?
>> 
>> (https://github.com/git/git/pull/1076#discussion_r750645345)
>
> Thanks for noticing this! I also lost one other change
> while splitting this out: we are referencing
> the_repository from the refs code, but as of 34224e14d we
> should be picking it up from the ref_store. I'll submit
> an updated series as soon as it passes CI.

No rush.

Reviewers and other project participants would appreciate you more
if you took a deep breath, after seeing a CI success, and gave a
final re-reading of the patches with a critical pair of eyes, before
you send the updated series out.

Thanks.

Neeraj Singh Dec. 6, 2021, 3:10 a.m. UTC | #4

On Sun, Dec 5, 2021 at 3:56 PM Junio C Hamano <[e-mail]> wrote:
>
> Neeraj Singh <[e-mail]> writes:
>
> > On Sun, Dec 05, 2021 at 10:23:08AM -0800, Junio C Hamano wrote:
> >> "Neeraj Singh via GitGitGadget" <[e-mail]> writes:
> >>
> >> >    /*
> >> >     * This object store is ephemeral, so there is no need to fsync.
> >> >     */
> >> > -  int will_destroy;
> >> > +  unsigned int will_destroy : 1;
> >>
> >> <[e-mail]>
> >> ?
> >>
> >> (https://github.com/git/git/pull/1076#discussion_r750645345)
> >
> > Thanks for noticing this! I also lost one other change
> > while splitting this out: we are referencing
> > the_repository from the refs code, but as of 34224e14d we
> > should be picking it up from the ref_store. I'll submit
> > an updated series as soon as it passes CI.
>
> No rush.
>
> Reviewers and other project participants would appreciate you more
> if you took a deep breath, after seeing a CI success, and gave a
> final re-reading of the patches with a critical pair of eyes, before
> you send the updated series out.
>
> Thanks.

Fair enough.  Of course I didn't see your email before I resubmitted.
Thanks for the feedback.

Patch

diff --git a/environment.c b/environment.c
index 342400fcaad..2701dfeeec8 100644
--- a/environment.c
+++ b/environment.c
@@ -169,6 +169,10 @@  void setup_git_env(const char *git_dir)
 	args.graft_file = getenv_safe(&to_free, GRAFT_ENVIRONMENT);
 	args.index_file = getenv_safe(&to_free, INDEX_ENVIRONMENT);
 	args.alternate_db = getenv_safe(&to_free, ALTERNATE_DB_ENVIRONMENT);
+	if (getenv(GIT_QUARANTINE_ENVIRONMENT)) {
+		args.disable_ref_updates = 1;
+	}
+
 	repo_set_gitdir(the_repository, git_dir, &args);
 	strvec_clear(&to_free);
 
diff --git a/object-file.c b/object-file.c
index 0b6a61aeaff..659ef7623ff 100644
--- a/object-file.c
+++ b/object-file.c
@@ -699,6 +699,12 @@  struct object_directory *set_temporary_primary_odb(const char *dir, int will_des
 	 */
 	new_odb = xcalloc(1, sizeof(*new_odb));
 	new_odb->path = xstrdup(dir);
+
+	/*
+	 * Disable ref updates while a temporary odb is active, since
+	 * the objects in the database may roll back.
+	 */
+	new_odb->disable_ref_updates = 1;
 	new_odb->will_destroy = will_destroy;
 	new_odb->next = the_repository->objects->odb;
 	the_repository->objects->odb = new_odb;
diff --git a/object-store.h b/object-store.h
index cb173e69392..9ae9262c340 100644
--- a/object-store.h
+++ b/object-store.h
@@ -27,10 +27,17 @@  struct object_directory {
 	uint32_t loose_objects_subdir_seen[8]; /* 256 bits */
 	struct oidtree *loose_objects_cache;
 
+	/*
+	 * This is a temporary object store created by the tmp_objdir
+	 * facility. Disable ref updates since the objects in the store
+	 * might be discarded on rollback.
+	 */
+	unsigned int disable_ref_updates : 1;
+
 	/*
 	 * This object store is ephemeral, so there is no need to fsync.
 	 */
-	int will_destroy;
+	unsigned int will_destroy : 1;
 
 	/*
 	 * Path to the alternative object store. If this is a relative path,
diff --git a/refs.c b/refs.c
index d7cc0a23a3b..27ec7d1fc64 100644
--- a/refs.c
+++ b/refs.c
@@ -2137,7 +2137,7 @@  int ref_transaction_prepare(struct ref_transaction *transaction,
 		break;
 	}
 
-	if (getenv(GIT_QUARANTINE_ENVIRONMENT)) {
+	if (the_repository->objects->odb->disable_ref_updates) {
 		strbuf_addstr(err,
 			      _("ref updates forbidden inside quarantine environment"));
 		return -1;
diff --git a/repository.c b/repository.c
index c5b90ba93ea..dce8e35ac20 100644
--- a/repository.c
+++ b/repository.c
@@ -80,6 +80,8 @@  void repo_set_gitdir(struct repository *repo,
 	expand_base_dir(&repo->objects->odb->path, o->object_dir,
 			repo->commondir, "objects");
 
+	repo->objects->odb->disable_ref_updates = o->disable_ref_updates;
+
 	free(repo->objects->alternate_db);
 	repo->objects->alternate_db = xstrdup_or_null(o->alternate_db);
 	expand_base_dir(&repo->graft_file, o->graft_file,
diff --git a/repository.h b/repository.h
index a057653981c..7c04e99ac5c 100644
--- a/repository.h
+++ b/repository.h
@@ -158,6 +158,7 @@  struct set_gitdir_args {
 	const char *graft_file;
 	const char *index_file;
 	const char *alternate_db;
+	int disable_ref_updates;
 };
 
 void repo_set_gitdir(struct repository *repo, const char *root,