Re: [PATCH v4 2/4] core.fsync: introduce granular fsync control

From: Junio C Hamano <gitster@pobox.com>
Date: Mar 9, 2022, 20:03 UTC
Message-ID: <xmqqpmmuki68.fsf@gitster.g>
In-Reply-To: <YiiuqK/tCnQOXrSV@ncase>

Patrick Steinhardt <ps@pks.im> writes:

Show 12 quoted lines

>> If the user cares about fsynching loose object files in the right
>> way, we shouldn't leave loose ref files not following the safe
>> safety level, regardless of how this new core.fsync knobs would look
>> like.
>> 
>> I think we three are in agreement on that.
>
> Is there anything I can specifically do to help out with this topic? We
> have again hit data loss in production because we don't sync loose refs
> to disk before renaming them into place, so I'd really love to sort out
> this issue somehow so that I can revive my patch series which fixes the
> known repository corruption [1].

How about doing a series to unconditionally sync loose ref creation and modification?

Alternatively, we could link it to the existing configuration to control synching of object files.

I do not think core.fsyncObjectFiles having "object" in its name is a good reason not to think those who set it to true only care about the loose object files and nothing else. It is more sensible to consider that those who set it to true cares about the repository integrity more than those who set it to false, I would think.

But that (i.e. doing it conditionally and choose which knob to use) is one extra thing that needs justification, so starting from unconditional fsync_or_die() may be the best way to ease it in.