Byron/gitoxide v0.36.0

v0.36.0 - use this if you `gix clone` a lot

on GitHub

This release contains fixes relevant to the safety of checkouts:

• GHSA-7w47-3wg8-547c
• https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9

New Features

• checkout respects options for core.protectHFS and core.protectNTFS.
  This also adds gitoxide.core.protectWindows as a way to enforce
  additional restrictions that are usually only available on Windows.

  Note that core.protectNFS is always enabled by default, just like
  it is in Git.

Bug Fixes

• more robustness in the face of a trampling-herd of threads loading a single index.
  The motivating example is here: praetorian-inc/noseyparker#179

  Previously, it was possible for a trampling herd of threads to consolidate the
  disk state. Most of them would be 'needs-init' threads which could notice that
  the initialization already happened, and just use that.

  But a thread might be late for the party and somehow manages to not get any
  newly loaded index, and thus tries to consolidate with what's on disk again.
  Then it would again determine no change, and return nothing, causing the caller
  to abort and not find objects it should find because it wouldn't see the index
  that it should have seen.

  The reason the thread got into this mess is that the 'is-load-ongoing' flagging
  was racy itself, so it would not wait for ongoing loads and just conclude nothing
  happened. An extra delay (by yielding) now assures it either seees the loading state
  and waits for it, sees the newly loaded indices.

  Note that this issue can be reproduced with:

  './target/release/gix -r repo-with-one-pack -t10 --trace odb stats --extra-header-lookup'
  

Commit Statistics

• 6 commits contributed to the release over the course of 10 calendar days.
• 38 days passed between releases.
• 2 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details