view tests/test-audit-path.t @ 35121:66c5a8cf2868

lfs: import the Facebook git-lfs client extension

The purpose of this is the same as the built-in largefiles extension- to handle
huge files outside of the normal storage system, generally to keep the amount of
data cloned to a lower amount.  There are several benefits of implementing the
git-lfs protocol, instead of using the largefiles extension:

  - Bitbucket and Github support (and probably wider support in 3rd party
    hosting sites in general). [1][2]

  - The number of hg internals monkey patched are several orders of magnitude
    lower, so it will be easier to reason about and maintain.  Future commands
    will likely just work, without requiring various wrappers.

  - The "standin" files are only written to the filelog, not the disk.  That
    should avoid weird edge cases where the largefile and standin files get out
    of sync. [3]  It also avoids the occasional printing of the "hidden" standin
    file in various messages.

  - Filesets like size() will work, even if the file isn't present.  (It always
    says 41 bytes for largefiles, whether present or not.)

The only place that I see where largefiles comes out on top is that it works
with `hg serve` for simple sharing, without external infrastructure.  Getting
lfs-test-server working was a hassle, and took awhile to figure out.  Maybe we
can do something to make it work in the future.

Long term, I expect that this will be highly preferred over largefiles.  But if
we are to recommend this to largefile users, there are some UI issues to
bikeshed.  Until they are resolved, I've marked this experimental, and am not
putting a pointer to this in the largefiles help.  The (non exhaustive) list of
issues I've seen so far are:

  - It isn't sufficient to just enable the largefiles extension- you have to
    explicitly add a file with --large before it will pay attention to the
    configured sizes and patterns on future adds.  The justification being that
    once you use it, you're stuck with it.  I've seen people confused by this,
    and haven't liked it myself.  But it's also saved me a few times.  Should we
    do something like have a specific enabling config setting that must be set
    in the local repo config, so that enabling this extension in the user or
    system hgrc doesn't silently start storing lfs files?

  - The largefiles extension adds a repo requirement when the first largefile is
    committed, so that the extension must always be enabled in the future.  This
    extension is not doing that, and since I only enabled it locally to avoid
    infecting other repos, I got a cryptic error about missing flag processors
    when I cloned.  Is there no repo requirement due to shallow/narrow clone
    considerations (or other future advanced things)?

  - In the (small amount of) reading I've done about the git implementation, it
    seems that the files and sizes are stored in a tracked .gitattributes file.
    I think a tracked file for this would be extremely useful for consistency
    across developers, but this kind of touches on the tracked hgrc file
    proposal a few months back.

  - The git client can specify file patterns, not just sizes.

  - The largefiles extension has a cache directory in the local repo, but also a
    system wide one.  We should probably implement a system wide cache too, so
    that multiple clones don't have to refetch the files from the server.

  - Jun mentioned other missing features, like SSH authentication, gc, etc.

The code corresponds to c0492b73c7ef in hg-experimental. [4]  The only tweaks
are to load the extension in the tests with 'lfs=' instead of
'lfs=$TESTDIR/../hgext3rd/lfs', change the import in the *.py test to hgext
(from hgext3rd), add the 'testedwith' declaration, and mark it experimental for
now.  The infinite-push, p4fastimport, and remotefilelog tests were left behind.

The devel-warnings for unregistered config options are not corrected yet, nor
are the import check warnings.

[1] https://www.mercurial-scm.org/pipermail/mercurial/2017-November/050699.html
[2] https://bitbucket.org/site/master/issues/3843/largefiles-support-bb-3903
[3] https://bz.mercurial-scm.org/show_bug.cgi?id=5738
[4] https://bitbucket.org/facebook/hg-experimental

  $ hg init

audit of .hg

  $ hg add .hg/00changelog.i
  abort: path contains illegal component: .hg/00changelog.i (glob)
  [255]

#if symlink

Symlinks

  $ mkdir a
  $ echo a > a/a
  $ hg ci -Ama
  adding a/a
  $ ln -s a b
  $ echo b > a/b
  $ hg add b/b
  abort: path 'b/b' traverses symbolic link 'b' (glob)
  [255]
  $ hg add b

should still fail - maybe

  $ hg add b/b
  abort: path 'b/b' traverses symbolic link 'b' (glob)
  [255]

  $ hg commit -m 'add symlink b'


Test symlink traversing when accessing history:
-----------------------------------------------

(build a changeset where the path exists as a directory)

  $ hg up 0
  0 files updated, 0 files merged, 1 files removed, 0 files unresolved
  $ mkdir b
  $ echo c > b/a
  $ hg add b/a
  $ hg ci -m 'add directory b'
  created new head

Test that hg cat does not do anything wrong the working copy has 'b' as directory

  $ hg cat b/a
  c
  $ hg cat -r "desc(directory)" b/a
  c
  $ hg cat -r "desc(symlink)" b/a
  b/a: no such file in rev bc151a1f53bd
  [1]

Test that hg cat does not do anything wrong the working copy has 'b' as a symlink (issue4749)

  $ hg up 'desc(symlink)'
  1 files updated, 0 files merged, 1 files removed, 0 files unresolved
  $ hg cat b/a
  b/a: no such file in rev bc151a1f53bd
  [1]
  $ hg cat -r "desc(directory)" b/a
  c
  $ hg cat -r "desc(symlink)" b/a
  b/a: no such file in rev bc151a1f53bd
  [1]

#endif


unbundle tampered bundle

  $ hg init target
  $ cd target
  $ hg unbundle "$TESTDIR/bundles/tampered.hg"
  adding changesets
  adding manifests
  adding file changes
  added 5 changesets with 6 changes to 6 files (+4 heads)
  new changesets b7da9bf6b037:fc1393d727bc
  (run 'hg heads' to see heads, 'hg merge' to merge)

attack .hg/test

  $ hg manifest -r0
  .hg/test
  $ hg update -Cr0
  abort: path contains illegal component: .hg/test (glob)
  [255]

attack foo/.hg/test

  $ hg manifest -r1
  foo/.hg/test
  $ hg update -Cr1
  abort: path 'foo/.hg/test' is inside nested repo 'foo' (glob)
  [255]

attack back/test where back symlinks to ..

  $ hg manifest -r2
  back
  back/test
#if symlink
  $ hg update -Cr2
  abort: path 'back/test' traverses symbolic link 'back'
  [255]
#else
('back' will be a file and cause some other system specific error)
  $ hg update -Cr2
  back: is both a file and a directory
  abort: * (glob)
  [255]
#endif

attack ../test

  $ hg manifest -r3
  ../test
  $ mkdir ../test
  $ echo data > ../test/file
  $ hg update -Cr3
  abort: path contains illegal component: ../test (glob)
  [255]
  $ cat ../test/file
  data

attack /tmp/test

  $ hg manifest -r4
  /tmp/test
  $ hg update -Cr4
  abort: path contains illegal component: /tmp/test (glob)
  [255]

  $ cd ..

Test symlink traversal on merge:
--------------------------------

#if symlink

set up symlink hell

  $ mkdir merge-symlink-out
  $ hg init merge-symlink
  $ cd merge-symlink
  $ touch base
  $ hg commit -qAm base
  $ ln -s ../merge-symlink-out a
  $ hg commit -qAm 'symlink a -> ../merge-symlink-out'
  $ hg up -q 0
  $ mkdir a
  $ touch a/poisoned
  $ hg commit -qAm 'file a/poisoned'
  $ hg log -G -T '{rev}: {desc}\n'
  @  2: file a/poisoned
  |
  | o  1: symlink a -> ../merge-symlink-out
  |/
  o  0: base
  

try trivial merge

  $ hg up -qC 1
  $ hg merge 2
  abort: path 'a/poisoned' traverses symbolic link 'a'
  [255]

try rebase onto other revision: cache of audited paths should be discarded,
and the rebase should fail (issue5628)

  $ hg up -qC 2
  $ hg rebase -s 2 -d 1 --config extensions.rebase=
  rebasing 2:e73c21d6b244 "file a/poisoned" (tip)
  abort: path 'a/poisoned' traverses symbolic link 'a'
  [255]
  $ ls ../merge-symlink-out

  $ cd ..

Test symlink traversal on update:
---------------------------------

  $ mkdir update-symlink-out
  $ hg init update-symlink
  $ cd update-symlink
  $ ln -s ../update-symlink-out a
  $ hg commit -qAm 'symlink a -> ../update-symlink-out'
  $ hg rm a
  $ mkdir a && touch a/b
  $ hg ci -qAm 'file a/b' a/b
  $ hg up -qC 0
  $ hg rm a
  $ mkdir a && touch a/c
  $ hg ci -qAm 'rm a, file a/c'
  $ hg log -G -T '{rev}: {desc}\n'
  @  2: rm a, file a/c
  |
  | o  1: file a/b
  |/
  o  0: symlink a -> ../update-symlink-out
  

try linear update where symlink already exists:

  $ hg up -qC 0
  $ hg up 1
  abort: path 'a/b' traverses symbolic link 'a'
  [255]

try linear update including symlinked directory and its content: paths are
audited first by calculateupdates(), where no symlink is created so both
'a' and 'a/b' are taken as good paths. still applyupdates() should fail.

  $ hg up -qC null
  $ hg up 1
  abort: path 'a/b' traverses symbolic link 'a'
  [255]
  $ ls ../update-symlink-out

try branch update replacing directory with symlink, and its content: the
path 'a' is audited as a directory first, which should be audited again as
a symlink.

  $ rm -f a
  $ hg up -qC 2
  $ hg up 1
  abort: path 'a/b' traverses symbolic link 'a'
  [255]
  $ ls ../update-symlink-out

  $ cd ..

#endif