threads / rfc / 64999

RFC patchenvironment: move core.trustctime to repo_settings

Subject: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

## tl;dr

5 messages between Feb 15, 2026 and Feb 18, 2026. Diffs are folded; open one to read it.

replies: 4people: 3as markdown or json

Ayush Jha· Feb 15, 2026, 11:23 UTC · lore
The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.

This change continues the effort to move global configuration into struct repo_settings, as discussed in <20260208062949.596-1-kumarayushjha123@gmail.com>.

Move trust_ctime into struct repo_settings so that it is associated with a repository instance.

Add repo_settings_get_trust_ctime() to lazily read the core.trustctime configuration value, defaulting to true.

Update statinfo.c to use the new accessor instead of the global variable.
Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
---
 environment.c   | 5 -----
 environment.h   | 1 -
 repo-settings.c | 7 +++++++
 repo-settings.h | 8 ++++++++
 statinfo.c      | 4 ++--
 5 files changed, 17 insertions(+), 8 deletions(-)
Show changes to 5 files +17 −8

environment.c, environment.h, repo-settings.c, repo-settings.h, statinfo.c

diff --git a/environment.c b/environment.c
index 8ffbf92d50..95bd0db63c 100644
--- a/environment.c
+++ b/environment.c
@@ -41,7 +41,6 @@ static int pack_compression_seen;
 static int zlib_compression_seen;
 
 int trust_executable_bit = 1;
-int trust_ctime = 1;
 int check_stat = 1;
 int has_symlinks = 1;
 int minimum_abbrev = 4, default_abbrev = -1;
@@ -308,10 +307,6 @@ int git_default_core_config(const char *var, const char *value,
 		trust_executable_bit = git_config_bool(var, value);
 		return 0;
 	}
-	if (!strcmp(var, "core.trustctime")) {
-		trust_ctime = git_config_bool(var, value);
-		return 0;
-	}
 	if (!strcmp(var, "core.checkstat")) {
 		if (!value)
 			return config_error_nonbool(var);
diff --git a/environment.h b/environment.h
index 27f657af04..148103ea51 100644
--- a/environment.h
+++ b/environment.h
@@ -145,7 +145,6 @@ extern char *git_work_tree_cfg;
 
 /* Environment bits from configuration mechanism */
 extern int trust_executable_bit;
-extern int trust_ctime;
 extern int check_stat;
 extern int has_symlinks;
 extern int minimum_abbrev, default_abbrev;
diff --git a/repo-settings.c b/repo-settings.c
index 208e09ff17..bb7d983023 100644
--- a/repo-settings.c
+++ b/repo-settings.c
@@ -233,3 +233,10 @@ void repo_settings_reset_shared_repository(struct repository *repo)
 {
 	repo->settings.shared_repository_initialized = 0;
 }
+
+int repo_settings_get_trust_ctime(struct repository *repo)
+{
+	if (repo->settings.trust_ctime < 0)
+		repo_cfg_bool(repo, "core.trustctime", &repo->settings.trust_ctime, 1);
+	return repo->settings.trust_ctime;
+}
diff --git a/repo-settings.h b/repo-settings.h
index cad9c3f0cc..709f86108b 100644
--- a/repo-settings.h
+++ b/repo-settings.h
@@ -70,6 +70,8 @@ struct repo_settings {
 	int max_allowed_tree_depth;
 
 	char *hooks_path;
+
+	int trust_ctime;
 };
 #define REPO_SETTINGS_INIT { \
 	.shared_repository = -1, \
@@ -81,6 +83,7 @@ struct repo_settings {
 	.packed_git_window_size = DEFAULT_PACKED_GIT_WINDOW_SIZE, \
 	.packed_git_limit = DEFAULT_PACKED_GIT_LIMIT, \
 	.max_allowed_tree_depth = DEFAULT_MAX_ALLOWED_TREE_DEPTH, \
+	.trust_ctime = -1, \
 }
 
 void prepare_repo_settings(struct repository *r);
@@ -90,6 +93,11 @@ void repo_settings_clear(struct repository *r);
 enum log_refs_config repo_settings_get_log_all_ref_updates(struct repository *repo);
 /* Read the value for "core.warnAmbiguousRefs". */
 int repo_settings_get_warn_ambiguous_refs(struct repository *repo);
+/* Read and set the value for "core.attributesfile". */
+const char *repo_settings_get_attributes_file(struct repository *repo);
+
+/* Read the value for "core.trustctime". */
+int repo_settings_get_trust_ctime(struct repository *repo);
 /* Read the value for "core.hooksPath". */
 const char *repo_settings_get_hooks_path(struct repository *repo);
 
diff --git a/statinfo.c b/statinfo.c
index 30a164b0e6..ebc8faef27 100644
--- a/statinfo.c
+++ b/statinfo.c
@@ -66,14 +66,14 @@ int match_stat_data(const struct stat_data *sd, struct stat *st)
 
 	if (sd->sd_mtime.sec != (unsigned int)st->st_mtime)
 		changed |= MTIME_CHANGED;
-	if (trust_ctime && check_stat &&
+	if (repo_settings_get_trust_ctime(the_repository) && check_stat &&
 	    sd->sd_ctime.sec != (unsigned int)st->st_ctime)
 		changed |= CTIME_CHANGED;
 
 #ifdef USE_NSEC
 	if (check_stat && sd->sd_mtime.nsec != ST_MTIME_NSEC(*st))
 		changed |= MTIME_CHANGED;
-	if (trust_ctime && check_stat &&
+	if (repo_settings_get_trust_ctime(the_repository) && check_stat &&
 	    sd->sd_ctime.nsec != ST_CTIME_NSEC(*st))
 		changed |= CTIME_CHANGED;
 #endif

-- 
2.53.0.windows.1
Junio C Hamano· Feb 17, 2026, 19:13 UTC · re: Ayush Jha · lore

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

Ayush Jha <kumarayushjha123@gmail.com> writes:
Show 20 quoted lines
> The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
>
> This change continues the effort to move global configuration into struct repo_settings, as discussed in
> <20260208062949.596-1-kumarayushjha123@gmail.com>.
>
> Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
>
> Add repo_settings_get_trust_ctime() to lazily read the
> core.trustctime configuration value, defaulting to true.
>
> Update statinfo.c to use the new accessor instead of the global variable.
>
> Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> ---
>  environment.c   | 5 -----
>  environment.h   | 1 -
>  repo-settings.c | 7 +++++++
>  repo-settings.h | 8 ++++++++
>  statinfo.c      | 4 ++--
>  5 files changed, 17 insertions(+), 8 deletions(-)

Doesn't this regress end-user experience when the configuration variable is misspelled, e.g. "[core] trustctime = bad"? We used to run git_config_bool() from git_config(git_default_condfig) fairly early in the program, and would have died before doing anythihng to give the user a chance to fix the configuration files before going forward.

Now we will run deep into codepath and would not notice the misconfigured core.trustctime until the code happens to ask to compare the filesystem stat data and in-core index stat data.

I think this is a recurring theme, e.g.

https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/ https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/

That other topic Olamide has been working on seems to have settled *not* to lazily load into repo_settings to avoid the problem. Instead it reads and parses at the same places in the code path as before, but into a repo_config_values structure that is associated with the repository in question (which typically is the_repository).

Ayush Jha· Feb 18, 2026, 11:04 UTC · re: Junio C Hamano · lore

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

Hi Junio,

Thank you for the feedback. You are absolutely right that the lazy-loading approach regresses the user experience by delaying detection of configuration errors.

To address this, I propose parsing core.trustctime in prepare_repo_settings() in repo-settings.c. This would ensure the configuration is read eagerly during repository initialization, preserving the historical “fail fast” behavior where invalid boolean values cause an immediate fatal error.

The repo_settings_get_trust_ctime() accessor would then simply return the pre-parsed value from r->settings.trust_ctime.

Does this approach sound reasonable?

Thanks, Ayush

On Wed, Feb 18, 2026 at 12:44 AM Junio C Hamano <gitster@pobox.com> wrote:
Show 46 quoted lines
>
> Ayush Jha <kumarayushjha123@gmail.com> writes:
>
> > The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
> >
> > This change continues the effort to move global configuration into struct repo_settings, as discussed in
> > <20260208062949.596-1-kumarayushjha123@gmail.com>.
> >
> > Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
> >
> > Add repo_settings_get_trust_ctime() to lazily read the
> > core.trustctime configuration value, defaulting to true.
> >
> > Update statinfo.c to use the new accessor instead of the global variable.
> >
> > Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> > ---
> >  environment.c   | 5 -----
> >  environment.h   | 1 -
> >  repo-settings.c | 7 +++++++
> >  repo-settings.h | 8 ++++++++
> >  statinfo.c      | 4 ++--
> >  5 files changed, 17 insertions(+), 8 deletions(-)
>
> Doesn't this regress end-user experience when the configuration
> variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
> run git_config_bool() from git_config(git_default_condfig) fairly
> early in the program, and would have died before doing anythihng to
> give the user a chance to fix the configuration files before going
> forward.
>
> Now we will run deep into codepath and would not notice the
> misconfigured core.trustctime until the code happens to ask to
> compare the filesystem stat data and in-core index stat data.
>
> I think this is a recurring theme, e.g.
>
> https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
> https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/
>
> That other topic Olamide has been working on seems to have settled
> *not* to lazily load into repo_settings to avoid the problem.
> Instead it reads and parses at the same places in the code path as
> before, but into a repo_config_values structure that is associated
> with the repository in question (which typically is the_repository).
>
Bello Olamide· Feb 18, 2026, 11:22 UTC · re: Ayush Jha · lore

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

On Wed, 18 Feb 2026 at 12:04, Ayush Jha <kumarayushjha123@gmail.com> wrote:
Show 68 quoted lines
>
> Hi Junio,
>
> Thank you for the feedback. You are absolutely right that the
> lazy-loading approach regresses the user experience by delaying
> detection of configuration errors.
>
> To address this, I propose parsing core.trustctime in
> prepare_repo_settings() in repo-settings.c. This would ensure the
> configuration is read eagerly during repository initialization,
> preserving the historical “fail fast” behavior where invalid boolean
> values cause an immediate fatal error.
>
> The repo_settings_get_trust_ctime() accessor would then simply return
> the pre-parsed value from r->settings.trust_ctime.
>
> Does this approach sound reasonable?
>
> Thanks,
> Ayush
>
> On Wed, Feb 18, 2026 at 12:44 AM Junio C Hamano <gitster@pobox.com> wrote:
> >
> > Ayush Jha <kumarayushjha123@gmail.com> writes:
> >
> > > The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
> > >
> > > This change continues the effort to move global configuration into struct repo_settings, as discussed in
> > > <20260208062949.596-1-kumarayushjha123@gmail.com>.
> > >
> > > Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
> > >
> > > Add repo_settings_get_trust_ctime() to lazily read the
> > > core.trustctime configuration value, defaulting to true.
> > >
> > > Update statinfo.c to use the new accessor instead of the global variable.
> > >
> > > Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> > > ---
> > >  environment.c   | 5 -----
> > >  environment.h   | 1 -
> > >  repo-settings.c | 7 +++++++
> > >  repo-settings.h | 8 ++++++++
> > >  statinfo.c      | 4 ++--
> > >  5 files changed, 17 insertions(+), 8 deletions(-)
> >
> > Doesn't this regress end-user experience when the configuration
> > variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
> > run git_config_bool() from git_config(git_default_condfig) fairly
> > early in the program, and would have died before doing anythihng to
> > give the user a chance to fix the configuration files before going
> > forward.
> >
> > Now we will run deep into codepath and would not notice the
> > misconfigured core.trustctime until the code happens to ask to
> > compare the filesystem stat data and in-core index stat data.
> >
> > I think this is a recurring theme, e.g.
> >
> > https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
> > https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/
> >
> > That other topic Olamide has been working on seems to have settled
> > *not* to lazily load into repo_settings to avoid the problem.
> > Instead it reads and parses at the same places in the code path as
> > before, but into a repo_config_values structure that is associated
> > with the repository in question (which typically is the_repository).
> >

Hello Ayush Thank you for your interest in this topic.

As Junio pointed out in his response to you, I have submitted patches that settle not to lazily load into repo_settings. but instead to read and parse into the struct repo_config_values structure associated with the repository.

I will continue working to move other repo specific configuration variables in environment.c into this struct once these patches have been accepted. Thanks

Olamide
Ayush Jha· Feb 18, 2026, 11:45 UTC · re: Bello Olamide · lore

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

Hello Olamide,

Thank you for the update. Since you are already working on a more robust pattern (repo_config_values) for this, I will drop my patch to avoid conflicts and duplicated effort.

Best regards, Ayush

On Wed, Feb 18, 2026 at 4:52 PM Bello Olamide <belkid98@gmail.com> wrote:
Show 83 quoted lines
>
> On Wed, 18 Feb 2026 at 12:04, Ayush Jha <kumarayushjha123@gmail.com> wrote:
> >
> > Hi Junio,
> >
> > Thank you for the feedback. You are absolutely right that the
> > lazy-loading approach regresses the user experience by delaying
> > detection of configuration errors.
> >
> > To address this, I propose parsing core.trustctime in
> > prepare_repo_settings() in repo-settings.c. This would ensure the
> > configuration is read eagerly during repository initialization,
> > preserving the historical “fail fast” behavior where invalid boolean
> > values cause an immediate fatal error.
> >
> > The repo_settings_get_trust_ctime() accessor would then simply return
> > the pre-parsed value from r->settings.trust_ctime.
> >
> > Does this approach sound reasonable?
> >
> > Thanks,
> > Ayush
> >
> > On Wed, Feb 18, 2026 at 12:44 AM Junio C Hamano <gitster@pobox.com> wrote:
> > >
> > > Ayush Jha <kumarayushjha123@gmail.com> writes:
> > >
> > > > The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
> > > >
> > > > This change continues the effort to move global configuration into struct repo_settings, as discussed in
> > > > <20260208062949.596-1-kumarayushjha123@gmail.com>.
> > > >
> > > > Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
> > > >
> > > > Add repo_settings_get_trust_ctime() to lazily read the
> > > > core.trustctime configuration value, defaulting to true.
> > > >
> > > > Update statinfo.c to use the new accessor instead of the global variable.
> > > >
> > > > Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> > > > ---
> > > >  environment.c   | 5 -----
> > > >  environment.h   | 1 -
> > > >  repo-settings.c | 7 +++++++
> > > >  repo-settings.h | 8 ++++++++
> > > >  statinfo.c      | 4 ++--
> > > >  5 files changed, 17 insertions(+), 8 deletions(-)
> > >
> > > Doesn't this regress end-user experience when the configuration
> > > variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
> > > run git_config_bool() from git_config(git_default_condfig) fairly
> > > early in the program, and would have died before doing anythihng to
> > > give the user a chance to fix the configuration files before going
> > > forward.
> > >
> > > Now we will run deep into codepath and would not notice the
> > > misconfigured core.trustctime until the code happens to ask to
> > > compare the filesystem stat data and in-core index stat data.
> > >
> > > I think this is a recurring theme, e.g.
> > >
> > > https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
> > > https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/
> > >
> > > That other topic Olamide has been working on seems to have settled
> > > *not* to lazily load into repo_settings to avoid the problem.
> > > Instead it reads and parses at the same places in the code path as
> > > before, but into a repo_config_values structure that is associated
> > > with the repository in question (which typically is the_repository).
> > >
>
> Hello Ayush
> Thank you for your interest in this topic.
>
> As Junio pointed out in his response to you, I have submitted patches that
> settle not to lazily load into repo_settings. but instead to read and parse into
> the struct repo_config_values structure associated with the repository.
>
> I will continue working to move other repo specific configuration variables
> in environment.c into this struct once these patches have been accepted.
> Thanks
>
> Olamide

← back to recent threads