Commit Graph

82258 Commits (e441b15732ae6bb2b79eeb94afbf9ef3a7bb6c41)

Author SHA1 Message Date
Junio C Hamano e441b15732 Merge branch 'en/no-amend-during-conflicts' into jch
Teach 'am', 'revert', and 'rebase' that running 'commit --amend' or a
partial 'commit <paths>' makes no sense during operations that stop
and return control to the user to resolve conflicts left in the
working tree, just like 'cherry-pick' and 'merge' do.

* en/no-amend-during-conflicts:
  commit: refuse partial commits during conflict resolution
  commit: refuse to amend during conflict resolution
  commit: reword the empty-commit rebase amend error
  commit: allow a partial commit when a rebase pick becomes empty
  commit: clarify FROM_REBASE_PICK and is_from_rebase() names
2026-09-02 13:20:50 -07:00
Junio C Hamano 75d2a4d8f1 Merge branch 'ps/odb-pluggable-fsck' into jch
The consistency checks for the object database (fsck) have been
decoupled from the generic builtin implementation and moved into the
backend-specific object source layers, making them pluggable for
different object storage formats.

* ps/odb-pluggable-fsck:
  builtin/fsck: move loose object verification into the loose source
  builtin/fsck: move multi-pack index verification into the packed source
  builtin/fsck: move bitmap verification into the packed source
  builtin/fsck: move reverse index verification into the packed source
  builtin/fsck: move packfile verification into the packed source
  odb: provide infrastructure for pluggable fsck checks
  builtin/fsck: don't check alternates with "--no-full"
  builtin/fsck: de-globalize option handling
  builtin/fsck: merge `fsck_obj_buffer()` and `fsck_obj()`
  builtin/fsck: use `fsck_obj_buffer()` when checking loose objects
2026-09-02 13:20:50 -07:00
Junio C Hamano 1a8da1dda5 Merge branch 'ps/odb-alternates-at-creation' into jch
The setup of alternates has been deferred to object database
creation time during clone, which drops the unused ad-hoc alternate
writing API, simplifying the object database backend interface.

* ps/odb-alternates-at-creation:
  odb/source: remove the ability to write alternates
  builtin/clone: write alternates via `odb_create_on_disk()`
  odb/source: support writing alternates when creating the database
  builtin/clone: move setup of alternates for non-shared local clones
  builtin/clone: move setup of alternates for shared local clones
  builtin/clone: refactor handling of "--reference{,-if-able}"
  builtin/clone: move around `setup_reference()`
  builtin/clone: defer setup of the object database
2026-09-02 13:20:50 -07:00
Junio C Hamano 6ca5ea5903 Merge branch 'dw/config-read-both-global' into jch
The git config --global read operations have been updated to respect
both $HOME/.gitconfig and $XDG_CONFIG_HOME/git/config, fixing an
inconsistency where only the former was read when both configuration
files are present.

* dw/config-read-both-global:
  config: read global scope via config_sequence
  config: let sequence require a successful file
  path: use forward slashes in XDG config on Windows
2026-09-02 13:20:50 -07:00
Junio C Hamano 7ee6d641fa Merge branch 'vv/branch-recurse-no-start-ref' into jch
The --recurse-submodules option in 'git branch' has been fixed to
avoid a crash when the start point is not a reference (e.g., a raw
object ID).  The creation path now skips setting up tracking and
properly forwards the absent tracking name to the submodule helper.

* vv/branch-recurse-no-start-ref:
  branch: allow recursion with no tracking name
  branch: do not track a start point with no ref
2026-09-02 13:20:49 -07:00
Junio C Hamano bf4fce8654 Merge branch 'as/utimensat-utimes' into jch
The codebase has been updated to use the newer utimensat() POSIX
function instead of the obsolescent utime(), allowing
high-precision timestamps while preserving fallback compatibility.

* as/utimensat-utimes:
  compat/posix: drop legacy <utime.h> header and shims
  treewide: use utimensat(2) instead of legacy utime(3p)
  compat/posix: introduce utimensat(2) wrapper
2026-09-02 13:20:49 -07:00
Junio C Hamano 2fcaaa1585 Merge branch 'ap/http-preserve-wwwauth-redirect' into jch
When an HTTP request triggers a redirect and the target yields an
authentication challenge, the WWW-Authenticate headers received
during the redirect are now explicitly preserved across the
credential URL update, fixing an issue where they were incorrectly
cleared.

* ap/http-preserve-wwwauth-redirect:
  http: preserve wwwauth_headers across redirects
2026-09-02 13:20:49 -07:00
Junio C Hamano 7df2bc6f11 Merge branch 'js/mingw-build-updates' into jch
A collection of patches from Git for Windows has been upstreamed,
mostly focusing on simplifying and robustifying build configurations
for MinGW/MSYS2, dropping obsolete compatibility options, and allowing
the main 'git.exe' to be used directly without the extra wrapper
process on Windows.

* js/mingw-build-updates:
  mingw: allow `git.exe` to be used instead of the "Git wrapper"
  mingw: ensure valid CTYPE
  mingw: always define `ETC_*` for MSYS2 environments
  windows: skip linking `git-<command>` for built-ins
  mingw: rely on MSYS2's metadata instead of hard-coding it
  mingw: only enable the MSYS2-specific stuff when compiling in MSYS2
  mingw: set the prefix and HOST_CPU as per MSYS2's settings
  mingw: avoid over-specifying `--pic-executable`
  mingw: only use -Wl,--large-address-aware for 32-bit builds
  mingw: drop the -D_USE_32BIT_TIME_T option
  mingw: stop hard-coding `CC = gcc`
  mingw: include the Python parts in the build
2026-09-02 13:20:49 -07:00
Junio C Hamano 89009a6f16 Merge branch 'hn/checkout-m-autostash-refine' into jch
The autostash fallback in 'git checkout -m' has been refined to only
retry when there are local changes.  Additionally, a blank line now
visually separates autostash conflict advice from the subsequent
branch-switch message.

* hn/checkout-m-autostash-refine:
  checkout: separate autostash conflict advice from branch-switch message
  stash: reserve exit status 1 for conflicts
2026-09-02 13:20:48 -07:00
Junio C Hamano f6fa08a315 Merge branch 'cl/regexec-macos-leak' into jch
A compatibility workaround has been introduced for macOS to address
a memory leak in the system regex engine when it encounters invalid
multibyte sequences.  The workaround segments the input buffer at
invalid byte boundaries and searches each valid segment separately
using regexec(), avoiding the leaking path.

* cl/regexec-macos-leak:
  SQUASH???
  regexec: work around macOS TRE leak on invalid UTF-8
2026-09-02 13:20:48 -07:00
Junio C Hamano eba289e7f6 Merge branch 'ij/subtree-reject-v2-config' into jch
The shell script implementation of 'git subtree' has been updated to
check for the presence of the configuration file of the new Rust
implementation, preventing users from accidentally running the old
script on repositories already managed by the new tool.

* ij/subtree-reject-v2-config:
  git-subtree: Bail out if we find output from Rust rewrite (test)
  git-subtree: Bail out if we find output from Rust rewrite
2026-09-02 13:20:48 -07:00
Junio C Hamano 2357280184 Merge branch 'hk/typofix' into jch
Various spelling mistakes in comments and test descriptions have
been corrected.

* hk/typofix:
  versioncmp: fix typo in versioncmp.c, t/t0022-crlf-rename.sh
2026-09-02 13:20:48 -07:00
Junio C Hamano 4746e1b0cb Merge branch 'kh/doc-datamodel' into jch
The gitdatamodel documentation page has been linked from a handful
of key documentaiton pages.

* kh/doc-datamodel:
  doc: datamodel: link to the glossary
  doc: glossary: link four of the terms to gitdatamodel(7)
  doc: git: link to the gitdatamodel(7) tutorial
  doc: git: list gitdatamodel(7) as a concept guide
2026-09-02 13:20:47 -07:00
Junio C Hamano 63acd77889 Merge branch 'en/midx-missing-pack-fallback' into jch
The object lookup machinery has been taught to gracefully recover
when a multi-pack-index points to an owning pack that was removed
during a concurrent geometric repack, and 'git replay' has been
fixed to not segfault when reading such missing objects.

* en/midx-missing-pack-fallback:
  packfile: recover when a multi-pack-index names a removed pack
  mktree: do not use OBJECT_INFO_QUICK when checking objects
  mktree: plug per-tree leak in --batch mode
  replay: fail gracefully when a merge input is unreadable
2026-09-02 13:20:47 -07:00
Junio C Hamano 5d913529f5 Merge branch 'ns/ref-symref-additional-tests' into jch
A few tests for the reference handling subsystem have been added to
exercise the handling of forbidden characters and symbolic references.

* ns/ref-symref-additional-tests:
  t1402: test forbidden characters in refnames
  t1401: check symbolic-ref failure and --quiet silence on a non-symbolic ref
2026-09-02 13:20:47 -07:00
Junio C Hamano 7b9b3c20cb Merge branch 'mm/lib-httpd-cgi-safe' into jch
CGI helper scripts used by HTTP-related test scripts have been updated
to use atomic filesystem operations, preventing race conditions when
Apache handles concurrent requests.

* mm/lib-httpd-cgi-safe:
  t/lib-httpd: document writing concurrency-safe CGI helpers
  t/lib-httpd: make http-429 first-request check atomic
  t/lib-httpd: fix apply-one-time-script race under concurrent requests
2026-09-02 13:20:47 -07:00
Junio C Hamano 398654cda0 Merge branch 'dk/use-nsec-runtime' into jch
The build-time knob 'USE_NSEC' for nanosecond stat precision has been
converted to a runtime configuration 'core.useNanosec', allowing
distributions to bundle one binary that adapts to filesystem
capabilities dynamically.

* dk/use-nsec-runtime:
  core: convert build-time USE_NSEC into runtime core.useNanosec
  environment: align repo_config_values_init with struct declaration
  meson: expose knob for xmlto relative links in manuals
2026-09-02 13:20:47 -07:00
Junio C Hamano 1d518bf7a8 Merge branch 'ps/ci-depends-on-ruby' into jch
The CI job that builds the documentation failed because it lacked
the 'gem' command. The 'asciidoc' package apparently stopped pulling
in the 'ruby' package as a transitive dependency.  The CI script has
been updated to explicitly install 'ruby'.

* ps/ci-depends-on-ruby:
  ci: fix missing Ruby dependency in "documentation" job
2026-09-02 13:20:46 -07:00
Junio C Hamano 24c65d4050 Merge branch 'jk/rev-info-argv-to-free' into jch
The memory ownership of argv elements passed to the revision
machinery has been made more robust by keeping logically "freed"
elements alive until the rev_info struct is released, preventing
use-after-free bugs when options store references to them.

* jk/rev-info-argv-to-free:
  revision: simplify mark_argv_for_free() callers
  revision: hang on to "freed" argv elements
2026-09-02 13:20:46 -07:00
Junio C Hamano 7f386692f7 Merge branch 'rs/worktree-add-basename-fixes' into jch
The string extraction logic for the branch name and worktree name
from the given path in 'git worktree add' has been corrected and
simplified to avoid out-of-bounds reads and improper handling of
trailing slashes.

* rs/worktree-add-basename-fixes:
  worktree add: let worktree_basename() return string copy
  worktree add: trim slashes when deriving branch name from path
  worktree add: reject separator-only path
  worktree add: don't read out of bounds in worktree_basename()
2026-09-02 13:20:46 -07:00
Junio C Hamano 9defc44bbf Merge branch 'hn/ci-cancel-stale-pr-runs' into jch
GitHub Actions CI workflow runs triggered by pull requests have
been configured to cancel older runs when a new push is made to the
same pull request.

* hn/ci-cancel-stale-pr-runs:
  ci: cancel stale pull request workflow runs
2026-09-02 13:20:46 -07:00
Junio C Hamano f3363dac7d Merge branch 'tc/replay-linearize' into jch
The 'git replay' command has been taught the '--linearize' option to
drop merge commits and linearize the replayed history, mimicking 'git
rebase --no-rebase-merges'.

* tc/replay-linearize:
  replay: offer an option to linearize the commit topology
  replay: resolve the replay base outside pick_regular_commit()
  replay: add helper to put entry into replayed_commits
2026-09-02 13:20:46 -07:00
Junio C Hamano bab8d1de03 ### match next 2026-09-02 13:20:45 -07:00
Junio C Hamano e0a77396c2 Merge branch 'yn/worktree-repair-relative' into jch
The git worktree repair command failed to rewrite the .git file of
a working tree from a relative path to an absolute path when the
command was run in the working tree itself. The
read_gitfile_gently() function was modified to also return whether
the path originally recorded in the file was absolute, and this new
capability is used to correctly detect such mismatches.

* yn/worktree-repair-relative:
  worktree repair: detect relative path in .git file correctly
2026-09-02 13:20:45 -07:00
Junio C Hamano 9011553b6b Merge branch 'll/zsh-complete-git-potty-options' into jch
The zsh completion script (in 'contrib/') has been updated to
correctly locate the Git command after global options like '-C' by
properly skipping them, similar to how the bash completion does.

* ll/zsh-complete-git-potty-options:
  completion: zsh: support completion after "git -C <path>"
2026-09-02 13:20:45 -07:00
Junio C Hamano 214da47070 Merge branch 'gr/add-e-use-apply-api' into jch
The application of the edited patch in 'git add -e' has been
refactored to use the internal apply API directly, avoiding the need
to spawn a 'git apply' subprocess.

* gr/add-e-use-apply-api:
  builtin/add.c: replace run_command() with direct apply_all_patches() call
2026-09-02 13:20:45 -07:00
Junio C Hamano 490cade8b2 Merge branch 'jc/you-still-use-that' into jch
The instructions for deprecated commands emitted by
you_still_use_that() have been reworded to clarify that the removal
decision is final and to provide more assertive guidance on finding
a replacement.

* jc/you-still-use-that:
  you_still_use_that(): reword the instructions
2026-09-02 13:20:45 -07:00
Junio C Hamano f0965cb83a Merge branch 'yn/worktree-ambiguous-remote-advice' into jch
'git worktree add' did not prevent DWIM behavior when '-b' or '-B' was
specified, which has been corrected.

* yn/worktree-ambiguous-remote-advice:
  worktree add: treat multiple matches with --guess-remote as an error
  worktree add: improve message for ambiguous remote branch name
  checkout: improve message for ambiguous remote branch name
  checkout: extract function to display advice for ambiguous remotes
2026-09-02 13:20:45 -07:00
Junio C Hamano b1cff97880 Merge branch 'kn/reftable-optimize-reloading' into jch
The reftable code has been optimized to avoid an unnecessary
stat/reload of the stack when an addition already holds the
list_file lock, reducing the number of newfstatat syscalls from
linear to constant when writing refs.

* kn/reftable-optimize-reloading:
  reftable/stack: avoid reloading the stack when already locked
  reftable/stack: move list lock to `struct reftable_stack`
  reftable/stack: rename reftable_stack_new_addition()
  reftable/stack: remove `REFTABLE_STACK_NEW_ADDITION_RELOAD`
2026-09-02 13:20:44 -07:00
Harald Nordgren ff7d12a553 checkout: separate autostash conflict advice from branch-switch message
"git checkout -m" stashes the user's local changes when it cannot
perform the checkout, and then applies the stash.  When applying the
stash results in conflicts, the advice on how to deal with them is
printed directly on top of the branch-switch message ("Switched to
branch ..."), making the two hard to tell apart.  Print a blank line
in between so that the advice and the branch-switch message are
visually distinct.

apply_autostash_ref() reports whether applying the stash resulted in
conflicts via its enum stash_apply_result return value, so only print
the blank line in the conflicted case.

Signed-off-by: Harald Nordgren <haraldnordgren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-02 12:22:42 -07:00
Harald Nordgren 89b514c7a4 stash: reserve exit status 1 for conflicts
"git stash apply", "pop" and "branch" exit with status 1 both when
applying the stash entry resulted in conflicts and when they fail for
other reasons, so callers cannot tell the two apart.

Follow the convention of "git merge-tree" and the merge strategies,
which exit with status 1 to indicate conflicts and with a different
non-zero status for errors: those subcommands now exit with status 1
only when applying the stash entry resulted in conflicts, in which
case the stash entry is left in place, and exit with status 128, the
status die() uses, when they fail for other reasons.  Document the
exit statuses.

cmd_stash() used to collapse the return values of the subcommand
implementations to a boolean.  It now maps negative values, which
signal a failure, to 128 and passes everything else through as-is.
The only implementations that return a positive value are "apply",
"pop" and "branch", which return the value of do_apply_stash():
"apply" returns it directly, and "pop" and "branch" drop the stash
entry, via do_drop_stash(), which always returns 0, only when the
application succeeded.  The positive value is always 1, as
do_apply_stash() only returns a positive value when the three-way
merge was unclean.

Make the convention explicit by introducing enum stash_apply_result
with the values STASH_APPLY_CLEAN, STASH_APPLY_CONFLICT and
STASH_APPLY_ERROR, and use it for the in-process autostash helpers,
too.  They spawn "git stash apply" and can now tell conflicts apart
from other failures, e.g. a crash or death by signal of the child,
which map to exit statuses above 1.  Since we know the stash entry
was saved, tell users so in the error message instead of leaving them
wondering what happened to their stashed changes.

Signed-off-by: Harald Nordgren <haraldnordgren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-02 12:22:42 -07:00
Junio C Hamano 3cb9185f65 The 22nd batch
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-02 09:21:59 -07:00
Junio C Hamano 6163a7066e Merge branch 'jc/rerere-doc-typofix'
A missing preposition in the rerere technical documentation has been
fixed.

* jc/rerere-doc-typofix:
  rerere: technical documentation typofix
2026-09-02 09:21:59 -07:00
Junio C Hamano 61d89f5acf Merge branch 'ty/repository-fetch-if-missing'
The global variable 'fetch_if_missing' has been moved to a member in
'struct repository', continuing the libification process and
allowing per-repository control (such as for submodules).

* ty/repository-fetch-if-missing:
  repository: move fetch_if_missing into struct repository
2026-09-02 09:21:59 -07:00
Elijah Newren cc499d40e5 commit: refuse partial commits during conflict resolution
Similar to the previous commit, just as `git commit --amend` is a
foot-gun during conflict resolution, so is a partial commit (`git commit
<paths>`).  Recording a conflict resolution is about capturing the state
of the entire tree on top of HEAD, not a subset of paths.  For many years
we have rejected partial commits in the middle of
  - a merge
  - a cherry-pick

but, just like amending, this was never extended to the other operations
that can also leave conflicts to resolve:
  - an `am` operation
  - a revert
  - a rebase that stopped for conflict resolution

Reuse sequencer_ongoing_operation(), introduced for the analogous
`--amend` check, to detect these and refuse the partial commit.  A rebase
that stopped because a pick became empty is not conflict resolution and,
as an earlier patch established, is deliberately left permitted.

Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 21:24:33 -07:00
Elijah Newren 6257588252 commit: refuse to amend during conflict resolution
Running `git commit --amend` during conflict resolution is an ugly
foot-gun.  For many years, we have rejected amending during conflict
resolution in the middle of
  - a merge
  - a cherry-pick
However, this was never extended to other operations that can also
produce conflicts:
  - an `am` operation
  - a revert
  - a rebase

Extend it to handle these other cases now.

Extending to `am`, revert, and the apply backend of rebase are fairly
straightforward.  However, with the merge backend of rebase we have to
be more careful, since it powers interactive rebases and
  - the interactive machinery internally uses `git commit --amend` for
    `squash` and `reword` directives
  - users are expected to `git commit --amend` after hitting an `edit`
    or `break` directive
So, we need to be careful with rebase to only reject amending when doing
conflict resolution.

A few files under the rebase-merge/ directory provide us the necessary
information:

  - stopped-sha is written only when the rebase stops and hands control
    back to the user, so its presence marks a genuine stop -- as opposed
    to the sequencer's own internal `git commit --amend` while applying
    a squash, fixup, or reword, during which no stopped-sha exists.

  - amend is written only when the rebase stops with HEAD already
    pointing at the commit the user is meant to amend: a clean `edit`,
    or a fast-forward `reword`.  Its absence at a stop therefore means
    the commit did not apply, so HEAD is the previously-applied commit
    rather than the one being rebased -- exactly the case we refuse.

So for the merge backend we die when stopped-sha exists and amend does
not.  This covers a plain conflicted pick as well as a conflicted `edit`
(both leave HEAD on the previously-applied commit), while still allowing
a clean `edit` or `reword` stop and a `break` stop (no stopped-sha).
stopped-sha is unlinked at the start of the resume loop, so a resumed
squash's internal amend is unaffected.

Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 21:24:33 -07:00
Elijah Newren a3837282fe commit: reword the empty-commit rebase amend error
When a rebase applies a commit that becomes empty, it stops and asks the
user to decide whether to keep it or drop it.  HEAD still points at the
previously-applied commit at that point, so amending is refused, with:

    You are in the middle of a rebase -- cannot amend.

That message would suggest that amending is not allowed during an 'edit'
or 'break' stop, which is misleading, plus it lacks the specificity that
might help the user know why their particular case is a problem: the
commit they intended to amend became empty and was dropped, so amending
would affect the wrong commit.  Reword the error accordingly.

Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 21:24:33 -07:00
Elijah Newren d692305326 commit: allow a partial commit when a rebase pick becomes empty
For years, we disallowed partial commits during merges or cherry-picks.
In commit 430b75f720 (commit: give correct advice for empty commit
during a rebase, 2019-12-06) it was noted that the "cannot do a partial
commit during a cherry-pick" message was also printed when rebasing a
commit that became empty, and rather than drop the check in that case,
that commit opted to make the message print the actual operation that
was in progress.

Since a commit that has become empty comes without conflicts, a new
partial commit poses no problems; remove the error in that case.

Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 21:24:33 -07:00
Elijah Newren aef843026b commit: clarify FROM_REBASE_PICK and is_from_rebase() names
Commit 430b75f720 (commit: give correct advice for empty commit during
a rebase, 2019-12-06) introduced a FROM_REBASE_PICK enum value and an
is_from_rebase() function.  Those names failed to convey that they were
specifically about hitting a commit that becomes empty when rebasing.
Clarify their names now.

While at it, change `whence == FROM_REBASE_NOW_EMPTY` to use
`is_from_rebase_now_empty(whence)`.

Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 21:24:33 -07:00
Patrick Steinhardt 691dc53e2a ci: fix missing Ruby dependency in "documentation" job
Our "documentation" job has recently stopped working with the following
error:

  + sudo gem install --version 1.5.8 asciidoctor
  + gem install --version 1.5.8 asciidoctor
  ./ci/install-dependencies.sh: 23: gem: not found

The root cause of this is that we never explicitly install Ruby, and
consequently gem(1) isn't explicitly pulled in, either. This used to
work alright because we transitively pulled in Ruby via asciidoc. But
due to an update it seems that we stopped pulling in the transitive
dependency, and consequently we don't have gem(1) available anymore.

Fix this by explicitly installing Ruby.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 12:19:59 -07:00
Jeff King 0e96176af4 revision: simplify mark_argv_for_free() callers
You do not want to mark an argv element for freeing unless the caller
has given us the free_removed_argv_elements flag. Originally we just
called free() in this case, so each caller checked the flag itself. Now
that we mark them via a helper function, we can push the check down into
the helper. This saves a little bit of duplicated code, but also
hopefully makes the result conceptually simpler.

Every caller but one was already checking this flag. The exception is
setup_revisions_from_strvec(), but it always sets the flag explicitly
(since its whole purpose is managing argv memory). So even though it was
not checking the flag, doing so is OK (it will always be set).

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 11:04:18 -07:00
Jeff King 66f4856110 revision: hang on to "freed" argv elements
In setup_revisions() we rewrite the incoming argv array, losing
references to the strings it contains. For a synthetic argv array
constructed from heap strings, that traditionally meant we leaked those
allocated strings.

We fixed the leak in cd43948798 (revision: manage memory ownership of
argv in setup_revisions(), 2025-09-19). Now callers can tell the
revision code that argv entries are allocated and should be freed, which
it will do before overwriting them.

But this introduced a new bug! The overwritten entries go away as soon
as option parsing is finished, but a few options may actually create new
references to those strings. And once we free the strings, those stale
references become use-after-free bugs. For example, running:

  git stash show --src-prefix=foo/

demonstrates the problem:

  1. The stash command generates its own synthetic argv (because it has
     to treat the stash specifiers specially) which it then passes to
     setup_revisions().

  2. Parsing will create a reference to the partial string "foo/" in
     revs.diffopt.a_prefix.

  3. When setup_revisions() finishes, we rewrite argv to throw away
     parsed strings. This frees the entry holding "--src-prefix=foo",
     at which point we have a dangling reference in revs.diffopt.

  4. We generate an actual diff, accessing garbage memory via
     revs.diffopt.a_prefix. The output is usually garbled, but ASan also
     detects this reliably.

One obvious fix here is to allocate new strings when we pull data out of
the argv array. But doing so is error prone (every string option must
remember to do it or risk a subtle bug), and creates more questions
about memory ownership (e.g., some callers assign string literals
directly to a_prefix, and we would not want to free those).

Instead we can fix this centrally by delaying the free() calls. We'll
collect any "freed" strings in a new array, hold on to it for the life
of the rev_info struct, and then release it at the end. We can easily
use a strvec for this, since it handles growth and cleanup for us.

This fixes the prefix case above (which is now tested in t3903), and
should fix any other stray cases. Though I could not find any; we use
OPT_STRING only in the prefix diff options, and very few revision opts
store strings. Those that do (like --format and --encoding) already make
a copy of the string. They do not need for us to hold on to the memory
longer, but it does not hurt them if we do.

One may note that combined with cd43948798 we have approached a simpler
solution in a roundabout way. We are still hacking up argv, but now
carefully constructing a parallel argv of old strings we've overwritten
(and will eventually free). In an alternate universe, we could instead
leave the original argv pristine and return a new reduced-size argv.
This is conceptually simpler, though it does mean that every caller must
free that new argv array itself (not the entries). That's not something
they traditionally had to do, so it would mean tweaking every caller.

So even though the combination of this cd43948798 and this patch is a
little convoluted, it should make things just work (no leaks and no
use-after-free) without modifying any callers.

Reported-by: Nicolas Le Cam <niko.lecam@gmail.com>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 11:03:56 -07:00
D. Ben Knoble cadda675f5 core: convert build-time USE_NSEC into runtime core.useNanosec
Racy Git problems persist today, manifesting themselves in the
performance of commands like "git diff" in new worktrees [1]. We have
long had a build knob "USE_NSEC" to tell Git to use in-core nanosecond
precision when available, which mitigates most if not all racy issues,
but most builds we know about don't use it. In part, that's because
someone distributing Git can't safely enable it at compile-time if they
don't know exactly what platforms their distribution will be used on.

[1]: https://lore.kernel.org/git/CALnO6CADMJSixqYvL1Yo8qKX5rWhKQ+2OoSEuPUh-yoeK9TseQ@mail.gmail.com

These days, most platforms are likely to be safe for the USE_NSEC code.
Regardless, we want to give users the ability to benefit from it. This
requires exposing the compile-time gated code as a runtime option.

In addition, update the Racy Git documentation and other mentions of
USE_NSEC in the code.

Due to the conversion from #ifdef to runtime check, using the flag
"--ignore-space-change" may be particularly helpful when viewing changes
from this patch.

Signed-off-by: D. Ben Knoble <ben.knoble@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 10:33:28 -07:00
Michael Montalbo c2a48fdcb5 t/lib-httpd: document writing concurrency-safe CGI helpers
Update t/lib-httpd.sh to document the fixes applied to
apply-one-time-script.sh and http-429.sh for future developers working
on helper scripts. Add concrete examples of patterns and anti-patterns
that should be considered when handling state management.

Signed-off-by: Michael Montalbo <mmontalbo@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 09:02:53 -07:00
Michael Montalbo b86132120d t/lib-httpd: make http-429 first-request check atomic
http-429.sh is a helper for testing retry logic. It uses "test -f" to
check for the existence of a state file and later uses "touch" or
"rm -f" on that file to determine if it should return a 429. This method
of managing state can fail if the helper script is invoked concurrently.
However, this failure does not currently manifest itself since the
helper is invoked sequentially.

As a preventive measure, fix the state management logic so it relies on
an atomic mkdir operation to mark that a 429 was returned. When
$retry_after is "permanent", always return 429 now that we do not rely
on a state file that is "touch"ed and "rm"ed to indicate when to respond
with a 429.

Signed-off-by: Michael Montalbo <mmontalbo@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 09:02:53 -07:00
Michael Montalbo 5945464690 t/lib-httpd: fix apply-one-time-script race under concurrent requests
apply-one-time-script.sh is a test helper that executes a
"one-time-script" responsible for modifying the response normally
returned by git-http-backend. apply-one-time-script.sh should run
"one-time-script" once and return a modified response once. However,
sometimes a race between multiple concurrent requests causes
apply-one-time-script.sh to misbehave and return multiple modified
responses or an empty response that results in:

  fatal: ... The requested URL returned error: 500
  fatal: could not fetch <oid> from promisor remote

This can be seen in the flaky failure of t5616.47 on the macOS CI
runners.

Fix the logic that checks if "one-time-script" has returned its modified
response by chaining "rm one-time-script" with its execution. This
ensures a racing script does not also have the opportunity to execute
"one-time-script".

Add t/t5567-one-time-script.sh to verify the race is fixed. Implement a
stub "git-http-backend" that intentionally invokes a concurrent request,
and check that only one modified response is returned without error.

Signed-off-by: Michael Montalbo <mmontalbo@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-09-01 09:02:53 -07:00
D. Ben Knoble 6e7334e109 environment: align repo_config_values_init with struct declaration
The order of assignments in repo_config_values_init is chaotic and hard
to follow, especially with the definition of 'struct repo_config_values'
to ensure all members are initialized. As new members will be added in
the future, make it easier to validate changes by aligning the two.

Refactor assignment order with no behavioral changes.

Signed-off-by: D. Ben Knoble <ben.knoble@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-08-31 13:48:43 -07:00
D. Ben Knoble 9404f6a645 meson: expose knob for xmlto relative links in manuals
Makefile-based builds have had this knob for most of the project's life,
since a479a564dc (Documentation/Makefile: allow
man.base.url.for.relative.link to be set from Make, 2009-12-03).

Meson, however, hard-codes the equivalent of $prefix/$mandir, which is
not really where all the HTML docs are stored in most distro builds.
Plus, this value is missing a trailing slash, so links come out broken,
like this in git.1:

        1. Git User’s Manual
           /usr/share/manuser-manual.html

Of course we can do better:

1. Change the default to match Make: use file://$(htmldir)/ (with
   trailing slash!) to form a local URL pointing at the HTML docs. This
   is safe because all current uses of link:<relative> point at HTML
   docs:

      git grep 'link:[[:alnum:]]' Documentation | grep -ve html -e http

   produces only a single result (Documentation/howto/howto-index.sh)
   which can be ignored. Since nothing else [*] in the normal build sets
   MAN_BASE_URL, this seems like the right default.

2. Provide a configurable knob, just like the Makefile, so distributions
   that build with Meson (like Gentoo) can decide where to make the
   links if they need to. Those that set htmldir probably won't need to
   tweak this any further, though.

[*]: Well, Git's todo branch has a script dodoc.sh to build and archive
     docs for kernel.org; these docs are pulled by Homebrew
     installations, for example. It sets MAN_BASE_URL to "git_htmldocs",
     so the equivalent note on macOS + Homebrew is

        1. Git User’s Manual
           git-htmldocs/user-manual.html

     which is not functional either, but that's a problem for
     downstream. In any case, users can recover the right path with
     "git --html-path".

Signed-off-by: D. Ben Knoble <ben.knoble@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-08-31 13:48:43 -07:00
Hardik Kumar c486c1df72 versioncmp: fix typo in versioncmp.c, t/t0022-crlf-rename.sh
The patch fixes two typos in two places.
versioncmp.c:           "fractionnal" -> "fractional"
t/t0022-crlf-rename.sh: "similiarity" -> "similarity"

No functional changes, only update a comment and a test_description.

Signed-off-by: Hardik Kumar <hardikxk@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-08-31 13:47:04 -07:00
Harald Nordgren a251b1bd21 ci: cancel stale pull request workflow runs
The CI workflow groups all runs by commit hash using
`group: ${{ github.sha }}`.  This means every push to a pull
request starts a separate workflow run, and all workflows
triggered by the same commit share the same concurrency group.

With this change, pull request runs are grouped by pull request
number instead of commit hash, and runs superseded by a newer
push are canceled.  The concurrency group becomes
`${{ github.workflow }}-${{ github.event.pull_request.number ||
github.sha }}` and `cancel-in-progress` is set to true for
pull request events.

For pull request events, the group is `<workflow>-<pull-request-number>`
(e.g., "main-workflow-42").  If you push a new commit to an
existing pull request before the CI working on it finishes, the
new request will be placed in the same group and cancel the
currently running run.

For non-pull-request events, the group is `${{ github.workflow }}-${{
github.sha }}` and `cancel-in-progress` defaults to false, so
there is no regression in behavior.

Note that the previous configuration used `group: ${{ github.sha }}`,
which meant all workflows sharing the same commit hash were in the
same group.  The new configuration includes the workflow name in
the group, so each workflow has its own concurrency group per
commit/PR.

Signed-off-by: Harald Nordgren <haraldnordgren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2026-08-31 11:05:35 -07:00