Re: Feature-request: git-bundle --quiet

From: Jeff King <peff@peff.net>
Date: Aug 12, 2019, 16:08 UTC
Message-ID: <20190812160834.GA25388@sigill.intra.peff.net>
In-Reply-To: <CADMWQoP3tH7-e+3FCYkB7b7nf8v-HBQ1toDoje8G_hvD_LaDZw@mail.gmail.com>

On Mon, Aug 12, 2019 at 12:15:19PM +0200, Jacob Vosmaer wrote:

Show 9 quoted lines

> This is a tangent, but relevant: how do we feel about the fact that
> 'git bundle create' does not perform CRC32 checks when copying data
> out of an existing packfile?
> 
> See https://github.com/git/git/blob/v2.22.0/builtin/pack-objects.c#L2614-L2622 .
> 
> I understand the rationale of "skip CRC32 when serving a fetch",
> although I have no clue how much we gain from skipping it. But "pack
> to stdout means fetch" isn't quite accurate, as it includes bundles.

I don't recall it being discussed in the past. I think you could argue either way:

  - a bundle is just another form of object transfer, like a fetch, and
    so we don't need to be careful about bitrot. The receiver would
    notice it when it indexes the pack (as opposed to an on-disk repack,
    where we'll immediately delete the old copy, and really want to make
    sure we haven't just lost data).

  - because a bundle isn't interactive like a regular fetch, any bit
    errors may not be seen until much later when somebody reads the. At
    that point it may not be possible to go back to the original repo
    (in the extreme case of using a bundle as a backup, it may have been
    deleted entirely!).

Depending on the cost of those checks (and I really doubt they are all _that_ expensive), it might make sense for bundles to err on the conservative side and do them. And if they are expensive, it should perhaps be made an option for people who know they are planning to store the bundle for a long time without reading it[1].

I agree that linking "skip CRC32" to "pack to stdout" is a bit hacky. It should be easy to add a new --check-crc32 option which defaults to "!pack_to_stdout" if not specified.

-Peff

[1] Of course bitrot in the original packfile is just one place this can
    go wrong. Depending how paranoid you want to be, it might be worth
    reading back the result before considering it a valid backup. That
    would catch some software bugs, as well as any bit corruption on the
    writing side. Doing a full index-pack is the most robust way there,
    but it's quite expensive. Just checking the SHA1 of the packfile
    itself would give pretty good protection against write errors,
    though you'd definitely want to couple it with CRC32 checks on the
    source (since Git would otherwise include the bad bits in its SHA1
    checksum).