thuban 0.2.0 → 0.3.0

data/lib/thuban/index_writer.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Thuban
+  class Index
+    WRITABLE_MODES = [0o100644, 0o100755, 0o120000, 0o160000].freeze
+    ENTRY_DEPENDENT_EXTENSIONS = %w[TREE EOIE IEOT].freeze
+
+    def write
+      lock_path = path + ".lock"
+      FileUtils.mkdir_p(File.dirname(path))
+      file = File.open(lock_path, File::WRONLY | File::CREAT | File::EXCL | File::BINARY, 0o644)
+      owns_lock = true
+      file.write(self.class.encode(entries, extensions: extensions, version: version))
+      file.flush
+      file.fsync
+      file.close
+      File.rename(lock_path, path)
+      owns_lock = false
+      self
+    rescue Errno::EEXIST
+      raise IOError, "Git index is locked: #{lock_path}"
+    ensure
+      file&.close unless file&.closed?
+      File.unlink(lock_path) if owns_lock && File.exist?(lock_path)
+    end
+
+    def stage(path, oid, mode, stat: nil)
+      validate_entry(path, oid, mode)
+      entry = Entry.new(path: path, oid: oid, mode: mode, stage: 0, flags: 0, extended_flags: 0,
+        **stat_fields(stat))
+      entries.reject! { |current| current.path == path }
+      entries << entry
+      entries.sort_by! { |current| [current.path.b, current.stage] }
+      invalidate_entry_extensions
+      entry
+    end
+
+    def unstage(path)
+      validate_path(path)
+      removed = entries.select { |entry| entry.path == path && entry.stage.zero? }
+      entries.reject! { |entry| entry.path == path && entry.stage.zero? }
+      invalidate_entry_extensions unless removed.empty?
+      removed
+    end
+
+    def remove(path)
+      validate_path(path)
+      removed = entries.select { |entry| entry.path == path }
+      entries.reject! { |entry| entry.path == path }
+      invalidate_entry_extensions unless removed.empty?
+      removed
+    end
+
+    def conflicts = entries.select { |entry| !entry.stage.zero? }
+
+    def resolve(path, oid, mode)
+      validate_path(path)
+      raise ArgumentError, "path has no index conflict: #{path}" unless entries.any? { |entry| entry.path == path && !entry.stage.zero? }
+
+      stage(path, oid, mode)
+    end
+
+    private
+
+    def validate_entry(path, oid, mode)
+      validate_path(path)
+      raise ArgumentError, "expected a full SHA-1 object id" unless /\A[0-9a-f]{40}\z/.match?(oid.to_s)
+      raise ArgumentError, "invalid index mode" unless WRITABLE_MODES.include?(mode)
+    end
+
+    def validate_path(path)
+      safe = path.is_a?(String) && !path.empty? && !path.include?("\0") && !path.include?("\\") && !path.start_with?("/") &&
+        !path.split("/").any? { |part| ["", ".", ".."].include?(part) || part.casecmp?(".git") }
+      raise ArgumentError, "unsafe index path" unless safe
+    end
+
+    def stat_fields(stat)
+      return {size: 0, mtime: 0, mtime_nsec: 0, ctime: 0, ctime_nsec: 0, dev: 0, ino: 0, uid: 0, gid: 0} unless stat
+
+      mtime = stat_value(stat, :mtime)
+      ctime = stat_value(stat, :ctime)
+      {size: stat_value(stat, :size).to_i, mtime: mtime.to_i, mtime_nsec: mtime.respond_to?(:nsec) ? mtime.nsec : 0,
+       ctime: ctime.to_i, ctime_nsec: ctime.respond_to?(:nsec) ? ctime.nsec : 0, dev: stat_value(stat, :dev).to_i,
+       ino: stat_value(stat, :ino).to_i, uid: stat_value(stat, :uid).to_i, gid: stat_value(stat, :gid).to_i}
+    end
+
+    def stat_value(stat, name)
+      stat.respond_to?(name) ? stat.public_send(name) : stat.fetch(name, 0)
+    end
+
+    def invalidate_entry_extensions
+      extensions.reject! { |extension| ENTRY_DEPENDENT_EXTENSIONS.include?(extension.byteslice(0, 4)) }
+    end
+  end
+end

data/lib/thuban/object_writer.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module Thuban
+  class ObjectDatabase
+    TYPES = %w[blob tree commit tag].freeze
+
+    def exist?(oid)
+      validate_oid(oid)
+      loose = File.join(directory, oid[0, 2], oid[2..])
+      raise ArgumentError, "unsafe loose object path" if File.symlink?(loose)
+      if File.file?(loose)
+        validate_object_directory(File.dirname(loose))
+        return true
+      end
+      return true if packs.any? { |pack| pack.include?(oid) }
+
+      @packs = nil
+      packs.any? { |pack| pack.include?(oid) }
+    end
+
+    def write(type, data) = write_loose(type, data)
+
+    def write_loose(type, data)
+      raise ArgumentError, "invalid Git object type" unless TYPES.include?(type)
+      raise TypeError, "object data must be a String" unless data.is_a?(String)
+
+      raw = "#{type} #{data.bytesize}\0".b + data.b
+      oid = Digest::SHA1.hexdigest(raw)
+      return oid if exist?(oid)
+
+      target = File.join(directory, oid[0, 2], oid[2..])
+      object_directory = File.dirname(target)
+      raise ArgumentError, "unsafe loose object directory" if File.symlink?(object_directory)
+      FileUtils.mkdir_p(object_directory)
+      validate_object_directory(object_directory)
+      Tempfile.create([".thuban-object-", ".tmp"], File.dirname(target)) do |file|
+        file.binmode
+        file.chmod(0o444)
+        file.write(Zlib::Deflate.deflate(raw))
+        file.flush
+        file.fsync
+        file.close
+        File.rename(file.path, target) unless File.exist?(target)
+      end
+      oid
+    end
+
+    private
+
+    def validate_oid(oid)
+      raise ArgumentError, "expected a full SHA-1 object id" unless /\A[0-9a-f]{40}\z/.match?(oid.to_s)
+    end
+
+    def validate_object_directory(path)
+      root = File.realpath(directory)
+      raise ArgumentError, "unsafe loose object directory" if File.symlink?(path) || !File.realpath(path).start_with?(root + File::SEPARATOR)
+    end
+  end
+
+  class Repository
+    TREE_MODES = [0o040000, 0o100644, 0o100755, 0o120000, 0o160000].freeze
+
+    def write_blob(content) = odb.write("blob", content)
+
+    def write_tree(entries)
+      seen = {}
+      records = entries.map do |entry|
+        name = entry.path
+        raise ArgumentError, "unsafe tree entry" unless name.is_a?(String) && !name.empty? && !name.include?("/") && !name.include?("\0") && ![".", ".."].include?(name) && !name.casecmp?(".git")
+        raise ArgumentError, "duplicate tree entry: #{name}" if seen[name.b]
+        raise ArgumentError, "invalid tree mode" unless TREE_MODES.include?(entry.mode)
+        raise ArgumentError, "expected a full SHA-1 object id" unless /\A[0-9a-f]{40}\z/.match?(entry.oid.to_s)
+
+        unless entry.mode == 0o160000
+          expected = entry.mode == 0o040000 ? "tree" : "blob"
+          type, = odb.read(entry.oid)
+          raise ArgumentError, "tree entry mode does not match object" unless type == expected
+        end
+
+        seen[name.b] = true
+        [name.b + (entry.mode == 0o040000 ? "/" : ""), "#{entry.mode.to_s(8)} #{name}\0".b + [entry.oid].pack("H*")]
+      end
+      odb.write("tree", records.sort_by(&:first).map(&:last).join)
+    end
+
+    def write_commit(tree:, parents: [], author:, committer: nil, message:)
+      validate_object_type(tree, "tree")
+      parents.each { |oid| validate_object_type(oid, "commit") }
+      raise ArgumentError, "duplicate commit parent" unless parents.uniq.length == parents.length
+      raise TypeError, "message must be a String" unless message.is_a?(String)
+      raise ArgumentError, "commit message contains NUL" if message.include?("\0")
+
+      author_line = format_signature(author)
+      committer_line = committer ? format_signature(committer) : author_line
+      body = +"tree #{tree}\n"
+      parents.each { |oid| body << "parent #{oid}\n" }
+      body << "author #{author_line}\ncommitter #{committer_line}\n\n#{message}"
+      body << "\n" unless body.end_with?("\n")
+      odb.write("commit", body)
+    end
+
+    private
+
+    def validate_object_type(oid, expected)
+      raise ArgumentError, "expected a full SHA-1 object id" unless /\A[0-9a-f]{40}\z/.match?(oid.to_s)
+      type, = odb.read(oid)
+      raise ArgumentError, "expected #{expected} object" unless type == expected
+    end
+
+    def format_signature(signature)
+      raise TypeError, "expected Thuban::Signature" unless signature.is_a?(Signature)
+      raise TypeError, "signature name and email must be Strings" unless signature.name.is_a?(String) && signature.email.is_a?(String)
+      name, email = signature.name, signature.email
+      raise ArgumentError, "invalid signature name" if name.empty? || name.match?(/[\x00-\x1f\x7f<>]/)
+      raise ArgumentError, "invalid signature email" if email.empty? || email.match?(/[\x00-\x1f\x7f<>]/)
+
+      time = signature.time || Time.now
+      timestamp = begin
+        time.respond_to?(:to_time) ? time.to_time.to_i : Integer(time)
+      rescue ArgumentError, TypeError
+        raise ArgumentError, "invalid signature time"
+      end
+      offset = signature.offset
+      offset = time.utc_offset if offset.nil? && time.respond_to?(:utc_offset)
+      offset ||= 0
+      zone = if offset.is_a?(Integer)
+        raise ArgumentError, "invalid signature offset" if offset.abs > 86_340
+        sign = offset.negative? ? "-" : "+"
+        minutes = offset.abs / 60
+        format("%s%02d%02d", sign, minutes / 60, minutes % 60)
+      else
+        offset.to_s
+      end
+      raise ArgumentError, "invalid signature offset" unless /\A[+-](?:[01]\d|2[0-3])[0-5]\d\z/.match?(zone)
+
+      "#{name} <#{email}> #{timestamp} #{zone}"
+    end
+  end
+end

data/lib/thuban/pack_writer.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Thuban
+  class Pack
+    TYPE_CODES = TYPES.invert.freeze
+
+    def self.write(io, objects)
+      raise TypeError, "pack output must respond to write" unless io.respond_to?(:write)
+
+      raise TypeError, "objects must be enumerable" unless objects.respond_to?(:each)
+
+      entries = objects.to_a
+      raise ArgumentError, "too many pack objects" if entries.length > 0xffffffff
+      entries.each do |entry|
+        valid = entry.is_a?(Array) && entry.length == 2 && TYPE_CODES.key?(entry[0]) && entry[1].is_a?(String)
+        raise ArgumentError, "objects must be [type, data] pairs" unless valid
+        raise ArgumentError, "pack object too large" if entry[1].bytesize > MAX_OBJECT_SIZE
+      end
+
+      digest = Digest::SHA1.new
+      sink = lambda do |bytes|
+        write_all(io, bytes)
+        digest.update(bytes)
+      end
+      sink.call("PACK".b + [2, entries.length].pack("N2"))
+      entries.each_with_index do |(type, data), index|
+        sink.call(encode_object_header(TYPE_CODES.fetch(type), data.bytesize))
+        deflater = Zlib::Deflate.new
+        begin
+          offset = 0
+          while offset < data.bytesize
+            chunk = data.byteslice(offset, 65_536)
+            compressed = deflater.deflate(chunk)
+            sink.call(compressed) unless compressed.empty?
+            offset += chunk.bytesize
+          end
+          compressed = deflater.finish
+          sink.call(compressed) unless compressed.empty?
+        ensure
+          deflater.close
+        end
+        yield index + 1, entries.length if block_given?
+      end
+      checksum = digest.digest
+      write_all(io, checksum)
+      checksum.unpack1("H*")
+    end
+
+    def self.encode_object_header(type, size)
+      first = (type << 4) | (size & 0x0f)
+      size >>= 4
+      bytes = []
+      while size.positive?
+        bytes << (first | 0x80)
+        first = size & 0x7f
+        size >>= 7
+      end
+      bytes << first
+      bytes.pack("C*")
+    end
+    private_class_method :encode_object_header
+
+    def self.write_all(io, bytes)
+      offset = 0
+      while offset < bytes.bytesize
+        remaining = bytes.bytesize - offset
+        written = io.write(bytes.byteslice(offset, remaining))
+        valid = written.is_a?(Integer) && written.positive? && written <= remaining
+        raise IOError, "pack output stopped accepting bytes" unless valid
+
+        offset += written
+      end
+    end
+    private_class_method :write_all
+  end
+end

data/lib/thuban/ref_lock_error.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Thuban
+  class RefLockError < StandardError
+  end
+end

data/lib/thuban/ref_store.rb

@@ -0,0 +1,270 @@
+# frozen_string_literal: true
+
+module Thuban
+  class RefStore
+    ZERO_OID = "0" * 40
+
+    def initialize(repository)
+      @repository = repository
+    end
+
+    def update(name, new_oid, old_oid: :any, message: nil)
+      validate_ref(name)
+      validate_oid(new_oid)
+      raise ArgumentError, "Git object not found: #{new_oid}" unless repository.odb.exist?(new_oid)
+
+      target = dereference(name)
+      identity = repository.send(:format_signature, reflog_signature)
+      action = message.to_s.gsub(/[\x00-\x1f]/, " ")
+      [target, name].uniq.each { |reference| prepare_storage_path(log_path(reference)) }
+      paths = [ref_path(target)]
+      paths << ref_path(name) if target != name
+      with_locks(paths) do |locks|
+        raise RefLockError, "symbolic reference changed: #{name}" unless dereference(name) == target
+        current = repository.resolve(target)
+        verify_old_oid(name, current, old_oid)
+        rollback = yield current if block_given?
+        logs = [target, name].uniq.map { |reference| log_path(reference) }
+        log_sizes = logs.to_h { |path| [path, File.file?(path) ? File.size(path) : nil] }
+        begin
+          file = locks.fetch(ref_path(target))
+          file.write("#{new_oid}\n")
+          sync(file)
+          append_reflog(target, current, new_oid, identity, action)
+          append_reflog(name, current, new_oid, identity, action) if target != name
+          File.rename(file.path, ref_path(target))
+          locks.delete(ref_path(target))
+        rescue StandardError
+          restore_reflogs(log_sizes)
+          rollback.call if rollback.respond_to?(:call)
+          raise
+        end
+      end
+      new_oid
+    end
+
+    def delete(name, old_oid: :any)
+      validate_ref(name, head: false)
+      paths = [ref_path(name)]
+      packed_path = File.join(repository.common_dir, "packed-refs")
+      paths << packed_path if File.file?(packed_path)
+      prepare_storage_path(log_path(name))
+      deleted = nil
+      with_locks(paths) do |locks|
+        current = repository.resolve(name)
+        verify_old_oid(name, current, old_oid)
+        raise RefLockError, "reference does not exist: #{name}" unless current
+        deleted = current
+        locks.delete(packed_path) if locks[packed_path] && rewrite_packed_refs(locks[packed_path], packed_path, name)
+        File.unlink(ref_path(name)) if File.file?(ref_path(name)) || File.symlink?(ref_path(name))
+        File.unlink(log_path(name)) if File.file?(log_path(name))
+      end
+      deleted
+    end
+
+    def symbolic(name, target)
+      validate_ref(name)
+      validate_ref(target, head: false)
+      path = ref_path(name)
+      with_locks([path]) do |locks|
+        file = locks.fetch(path)
+        file.write("ref: #{target}\n")
+        sync(file)
+        File.rename(file.path, path)
+        locks.delete(path)
+      end
+      target
+    end
+
+    def reflog(name)
+      name = "refs/heads/#{name}" unless name == "HEAD" || name.start_with?("refs/")
+      validate_ref(name)
+      path = log_path(name)
+      return [] unless File.file?(path)
+      validate_storage_path(path)
+      File.readlines(path, chomp: true, encoding: Encoding::BINARY)
+    end
+
+    private
+
+    attr_reader :repository
+
+    def validate_ref(name, head: true)
+      return if head && name == "HEAD"
+      invalid = !name.is_a?(String) || !name.start_with?("refs/") || name.end_with?("/", ".") ||
+        name.include?("..") || name.include?("@{") || name.match?(/[\x00-\x20\x7f~^:?*\[\\]/) ||
+        name.split("/").any? { |part| part.empty? || part.start_with?(".") || part.downcase.end_with?(".lock") }
+      raise ArgumentError, "invalid Git reference" if invalid
+    end
+
+    def validate_oid(oid)
+      raise ArgumentError, "expected a full SHA-1 object id" unless /\A[0-9a-f]{40}\z/.match?(oid.to_s)
+    end
+
+    def dereference(name)
+      seen = []
+      loop do
+        raise CorruptObject, "cyclic symbolic reference" if seen.include?(name) || seen.length > 32
+        seen << name
+        path = ref_path(name)
+        raise ArgumentError, "unsafe Git metadata path" if File.symlink?(path)
+        return name unless File.file?(path)
+        value = File.read(path).strip
+        return name unless value.start_with?("ref: ")
+        name = value.delete_prefix("ref: ")
+        validate_ref(name, head: false)
+      end
+    end
+
+    def ref_path(name) = File.join(name == "HEAD" ? repository.git_dir : repository.common_dir, name)
+    def log_path(name) = File.join(name == "HEAD" ? repository.git_dir : repository.common_dir, "logs", name)
+
+    def with_locks(paths)
+      locks = {}
+      paths.uniq.sort.each do |path|
+        prepare_storage_path(path)
+        file = File.open(path + ".lock", File::WRONLY | File::CREAT | File::EXCL | File::BINARY, 0o644)
+        locks[path] = file
+      end
+      yield locks
+    rescue Errno::EEXIST => error
+      raise RefLockError, "reference is locked: #{error.message}"
+    ensure
+      locks&.each_value do |file|
+        file.close unless file.closed?
+        File.unlink(file.path) if File.exist?(file.path)
+      end
+    end
+
+    def verify_old_oid(name, current, expected)
+      return if expected == :any || current == expected
+      raise RefLockError, "reference changed: #{name}"
+    end
+
+    def sync(file)
+      file.flush
+      file.fsync
+      file.close
+    end
+
+    def append_reflog(name, old_oid, new_oid, identity, action)
+      path = log_path(name)
+      prepare_storage_path(path)
+      File.open(path, File::WRONLY | File::CREAT | File::APPEND | File::BINARY, 0o644) do |file|
+        file.write("#{old_oid || ZERO_OID} #{new_oid} #{identity}\t#{action}\n")
+        file.flush
+        file.fsync
+      end
+    end
+
+    def restore_reflogs(sizes)
+      sizes.each do |path, size|
+        if size
+          File.truncate(path, size)
+        elsif File.file?(path)
+          File.unlink(path)
+        end
+      end
+    end
+
+    def reflog_signature
+      Signature.new(name: ENV["GIT_COMMITTER_NAME"] || config_value("name") || ENV["USER"] || "unknown",
+        email: ENV["GIT_COMMITTER_EMAIL"] || config_value("email") || "unknown@localhost", time: Time.now)
+    end
+
+    def validate_storage_path(path)
+      root = storage_root(path)
+      relative = path.delete_prefix(root).delete_prefix(File::SEPARATOR)
+      cursor = root
+      relative.split(File::SEPARATOR).each do |part|
+        cursor = File.join(cursor, part)
+        raise ArgumentError, "unsafe Git metadata path" if File.symlink?(cursor)
+      end
+      parent = File.realpath(File.dirname(path))
+      real_root = File.realpath(root)
+      return if parent == real_root || parent.start_with?(real_root + File::SEPARATOR)
+
+      raise ArgumentError, "unsafe Git metadata path"
+    end
+
+    def prepare_storage_path(path)
+      root = storage_root(path)
+      relative = File.dirname(path).delete_prefix(root).delete_prefix(File::SEPARATOR)
+      cursor = root
+      relative.split(File::SEPARATOR).each do |part|
+        cursor = File.join(cursor, part)
+        raise ArgumentError, "unsafe Git metadata path" if File.symlink?(cursor)
+        begin
+          Dir.mkdir(cursor)
+        rescue Errno::EEXIST
+          raise ArgumentError, "unsafe Git metadata path" unless File.directory?(cursor) && !File.symlink?(cursor)
+        end
+      end
+      validate_storage_path(path)
+    end
+
+    def storage_root(path)
+      root = [repository.git_dir, repository.common_dir].uniq.sort_by { |candidate| -candidate.length }
+        .find { |candidate| path == candidate || path.start_with?(candidate + File::SEPARATOR) }
+      raise ArgumentError, "unsafe Git metadata path" unless root
+
+      root
+    end
+
+    def config_value(key)
+      section = nil
+      File.foreach(File.join(repository.common_dir, "config"), encoding: "UTF-8") do |line|
+        stripped = line.strip
+        if (section_match = stripped.match(/\A\[\s*([^\s\]"]+)/))
+          section = section_match[1].downcase
+        elsif section == "user" && (value_match = stripped.match(/\A#{key}\s*=\s*(.*)\z/i))
+          return value_match[1].strip.delete_prefix("\"").delete_suffix("\"")
+        end
+      end
+      nil
+    rescue Errno::ENOENT, Errno::EACCES
+      nil
+    end
+
+    def rewrite_packed_refs(file, path, name)
+      lines = File.readlines(path, mode: "rb")
+      kept = []
+      removing = false
+      lines.each do |line|
+        if line.start_with?("^")
+          kept << line unless removing
+          removing = false
+        else
+          removing = line.split(" ", 2)[1]&.strip == name
+          kept << line unless removing
+        end
+      end
+      return unless kept.length != lines.length
+
+      file.write(kept.join)
+      sync(file)
+      File.rename(file.path, path)
+    end
+  end
+
+  class Repository
+    def update_ref(name, new_oid, old_oid: :any, message: nil) = RefStore.new(self).update(name, new_oid, old_oid: old_oid, message: message)
+    def delete_ref(name, old_oid: :any) = RefStore.new(self).delete(name, old_oid: old_oid)
+
+    def create_branch(name, oid)
+      raise ArgumentError, "invalid branch name" if name.to_s.start_with?("-")
+      validate_object_type(oid, "commit")
+      update_ref("refs/heads/#{name}", oid, old_oid: nil, message: "branch: Created")
+      name
+    end
+
+    def delete_branch(name)
+      raise ArgumentError, "cannot delete the current branch" if branch == name
+      delete_ref("refs/heads/#{name}")
+      name
+    end
+
+    def symbolic_ref(name, target) = RefStore.new(self).symbolic(name, target)
+    def reflog(name) = RefStore.new(self).reflog(name)
+  end
+end

data/lib/thuban/signature.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Thuban
+  Signature = Struct.new(:name, :email, :time, :offset, keyword_init: true)
+end