index-pack: check .gitmodules files with --strict

Now that the internal fsck code has all of the plumbing we
need, we can start checking incoming .gitmodules files.
Naively, it seems like we would just need to add a call to
fsck_finish() after we've processed all of the objects. And
that would be enough to cover the initial test included
here. But there are two extra bits:

1. We currently don't bother calling fsck_object() at all
for blobs, since it has traditionally been a noop. We'd
actually catch these blobs in fsck_finish() at the end,
but it's more efficient to check them when we already
have the object loaded in memory.

2. The second pass done by fsck_finish() needs to access
the objects, but we're actually indexing the pack in
this process. In theory we could give the fsck code a
special callback for accessing the in-pack data, but
it's actually quite tricky:

a. We don't have an internal efficient index mapping
oids to packfile offsets. We only generate it on
the fly as part of writing out the .idx file.

b. We'd still have to reconstruct deltas, which means
we'd basically have to replicate all of the
reading logic in packfile.c.

Instead, let's avoid running fsck_finish() until after
we've written out the .idx file, and then just add it
to our internal packed_git list.

This does mean that the objects are "in the repository"
before we finish our fsck checks. But unpack-objects
already exhibits this same behavior, and it's an
acceptable tradeoff here for the same reason: the
quarantine mechanism means that pushes will be
fully protected.

In addition to a basic push test in t7415, we add a sneaky
pack that reverses the usual object order in the pack,
requiring that index-pack access the tree and blob during
the "finish" step.

This already works for unpack-objects (since it will have
written out loose objects), but we'll check it with this
sneaky pack for good measure.

Signed-off-by: Jeff King <peff@peff.net>

diff --git a/builtin/index-pack.c b/builtin/index-pack.c
index d15b24eebb0e025e538b5db825077fe6f7b50317..7b2f7c04703f5eff8a1eda06ae59c0d22a8a1ab5 100644 (file)
--- a/builtin/index-pack.c
+++ b/builtin/index-pack.c
@@ -836,6 +836,9 @@ static void sha1_object(const void *data, struct object_entry *obj_entry,
                                blob->object.flags |= FLAG_CHECKED;
                        else
                                die(_("invalid blob object %s"), oid_to_hex(oid));
                                blob->object.flags |= FLAG_CHECKED;
                        else
                                die(_("invalid blob object %s"), oid_to_hex(oid));

+                       if (do_fsck_object &&
+                           fsck_object(&blob->object, (void *)data, size, &fsck_options))
+                               die(_("fsck error in packed object"));

                } else {
                        struct object *obj;
                        int eaten;
                } else {
                        struct object *obj;
                        int eaten;


@@ -1477,6 +1480,9 @@ static void final(const char *final_pack_name, const char *curr_pack_name,
        } else
                chmod(final_index_name, 0444);
 
        } else
                chmod(final_index_name, 0444);
 

+       if (do_fsck_object)
+               add_packed_git(final_index_name, strlen(final_index_name), 0);
+

        if (!from_stdin) {
                printf("%s\n", sha1_to_hex(hash));
        } else {
        if (!from_stdin) {
                printf("%s\n", sha1_to_hex(hash));
        } else {


@@ -1818,6 +1824,10 @@ int cmd_index_pack(int argc, const char **argv, const char *prefix)
                      pack_hash);
        else
                close(input_fd);
                      pack_hash);
        else
                close(input_fd);

+
+       if (do_fsck_object && fsck_finish(&fsck_options))
+               die(_("fsck error in pack objects"));
+

        free(objects);
        strbuf_release(&index_name_buf);
        if (pack_name == NULL)
        free(objects);
        strbuf_release(&index_name_buf);
        if (pack_name == NULL)

diff --git a/t/lib-pack.sh b/t/lib-pack.sh
index 75098465716512a3373e64d51a5cdf848e9f1101..4674899b30871f55894750b61b66020f0d16a646 100644 (file)
--- a/t/lib-pack.sh
+++ b/t/lib-pack.sh
@@ -79,6 +79,18 @@ pack_obj () {
                ;;
        esac
 
                ;;
        esac
 

+       # If it's not a delta, we can convince pack-objects to generate a pack
+       # with just our entry, and then strip off the header (12 bytes) and
+       # trailer (20 bytes).
+       if test -z "$2"
+       then
+               echo "$1" | git pack-objects --stdout >pack_obj.tmp &&
+               size=$(wc -c <pack_obj.tmp) &&
+               dd if=pack_obj.tmp bs=1 count=$((size - 20 - 12)) skip=12 &&
+               rm -f pack_obj.tmp
+               return
+       fi
+

        echo >&2 "BUG: don't know how to print $1${2:+ (from $2)}"
        return 1
 }
        echo >&2 "BUG: don't know how to print $1${2:+ (from $2)}"
        return 1
 }

diff --git a/t/t7415-submodule-names.sh b/t/t7415-submodule-names.sh
index 7fdf5d68bd4ee9b3b57a601047cb4c7e1b3f790f..51361c9e2d36cd6b0bfbca61fc399ffa80be7c35 100755 (executable)
--- a/t/t7415-submodule-names.sh
+++ b/t/t7415-submodule-names.sh
@@ -6,6 +6,7 @@ Exercise the name-checking function on a variety of names, and then give a
 real-world setup that confirms we catch this in practice.
 '
 . ./test-lib.sh
 real-world setup that confirms we catch this in practice.
 '
 . ./test-lib.sh

+. "$TEST_DIRECTORY"/lib-pack.sh

 
 test_expect_success 'check names' '
        cat >expect <<-\EOF &&
 
 test_expect_success 'check names' '
        cat >expect <<-\EOF &&


@@ -84,4 +85,41 @@ test_expect_success 'transfer.fsckObjects detects evil superproject (unpack)' '
        test_must_fail git push dst.git HEAD
 '
 
        test_must_fail git push dst.git HEAD
 '
 

+test_expect_success 'transfer.fsckObjects detects evil superproject (index)' '
+       rm -rf dst.git &&
+       git init --bare dst.git &&
+       git -C dst.git config transfer.fsckObjects true &&
+       git -C dst.git config transfer.unpackLimit 1 &&
+       test_must_fail git push dst.git HEAD
+'
+
+# Normally our packs contain commits followed by trees followed by blobs. This
+# reverses the order, which requires backtracking to find the context of a
+# blob. We'll start with a fresh gitmodules-only tree to make it simpler.
+test_expect_success 'create oddly ordered pack' '
+       git checkout --orphan odd &&
+       git rm -rf --cached . &&
+       git add .gitmodules &&
+       git commit -m odd &&
+       {
+               pack_header 3 &&
+               pack_obj $(git rev-parse HEAD:.gitmodules) &&
+               pack_obj $(git rev-parse HEAD^{tree}) &&
+               pack_obj $(git rev-parse HEAD)
+       } >odd.pack &&
+       pack_trailer odd.pack
+'
+
+test_expect_success 'transfer.fsckObjects handles odd pack (unpack)' '
+       rm -rf dst.git &&
+       git init --bare dst.git &&
+       test_must_fail git -C dst.git unpack-objects --strict <odd.pack
+'
+
+test_expect_success 'transfer.fsckObjects handles odd pack (index)' '
+       rm -rf dst.git &&
+       git init --bare dst.git &&
+       test_must_fail git -C dst.git index-pack --strict --stdin <odd.pack
+'
+

 test_done
 test_done