isomorphic-git 1.37.1 → 1.37.3

package/README.md

@@ -77,7 +77,10 @@ git.clone({ fs, http, dir, url: 'https://github.com/isomorphic-git/lightning-fs'
 ```
 
 If you're using `isomorphic-git` in the browser, you'll need something that emulates the `fs` API.
-The easiest to setup and most performant library is [LightningFS](https://github.com/isomorphic-git/lightning-fs) which is written and maintained by the same author and is part of the `isomorphic-git` suite.
+The easiest to setup and most performant library is [LightningFS](https://github.com/isomorphic-git/lightning-fs) which is written and maintained by the same author and is part of the `isomorphic-git` suite. 
+
+⚠️ LightningFS may apply file operations out of order, which can lead to repository corruption if the process crashes. You can mitigate this by calling `fs.flush()` after Git operations.
+
 If LightningFS doesn't meet your requirements, isomorphic-git should also work with [ZenFS](https://github.com/zen-fs/core) and [Filer](https://github.com/filerjs/filer).
 Instead of `isomorphic-git/http/node` this time import `isomorphic-git/http/web`:
 
@@ -414,6 +417,9 @@ Thanks goes to these wonderful people ([emoji key](https://github.com/kentcdodds
     <td align="center"><a href="https://github.com/Andarist"><img src="https://avatars.githubusercontent.com/u/9800850?v=4?s=60" width="60px;" alt=""/><br /><sub><b>Mateusz Burzyński</b></sub></a><br /><a href="https://github.com/isomorphic-git/isomorphic-git/commits?author=Andarist" title="Code">💻</a> <a href="https://github.com/isomorphic-git/isomorphic-git/commits?author=Andarist" title="Tests">⚠️</a></td>
     <td align="center"><a href="https://github.com/IAmSSH"><img src="https://avatars.githubusercontent.com/u/34162350?v=4?s=60" width="60px;" alt=""/><br /><sub><b>iamssh</b></sub></a><br /><a href="https://github.com/isomorphic-git/isomorphic-git/commits?author=IAmSSH" title="Code">💻</a> <a href="https://github.com/isomorphic-git/isomorphic-git/commits?author=IAmSSH" title="Documentation">📖</a> <a href="https://github.com/isomorphic-git/isomorphic-git/commits?author=IAmSSH" title="Tests">⚠️</a></td>
   </tr>
+  <tr>
+    <td align="center"><a href="https://github.com/N0zoM1z0"><img src="https://avatars.githubusercontent.com/u/161784452?v=4?s=60" width="60px;" alt=""/><br /><sub><b>N0zoM1z0</b></sub></a><br /><a href="#security-N0zoM1z0" title="Security">🛡️</a></td>
+  </tr>
 </table>
 
 <!-- markdownlint-restore -->

package/index.cjs

@@ -3395,6 +3395,40 @@ async function readObjectPacked({
         const packFile = indexFile.replace(/idx$/, 'pack');
         p.pack = fs.read(packFile);
       }
+      const pack = await p.pack;
+
+      // === Packfile Integrity Verification ===
+      // Performance optimization: use _checksumVerified flag to verify only once per packfile
+      if (!p._checksumVerified) {
+        const expectedShaFromIndex = p.packfileSha;
+
+        // 1. Fast Check: Verify packfile trailer matches index record
+        // Use subarray instead of slice to avoid memory copy (zero-copy for large packfiles)
+        const packTrailer = pack.subarray(-20);
+        const packTrailerSha = Array.from(packTrailer)
+          .map(b => b.toString(16).padStart(2, '0'))
+          .join('');
+        if (packTrailerSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile trailer mismatch: expected ${expectedShaFromIndex}, got ${packTrailerSha}. The packfile may be corrupted.`
+          )
+        }
+
+        // 2. Deep Integrity Check: Calculate actual SHA-1 of packfile payload
+        // This ensures true data integrity by verifying the entire packfile content
+        // Use subarray for zero-copy reading of large files
+        const payload = pack.subarray(0, -20);
+        const actualPayloadSha = await shasum(payload);
+        if (actualPayloadSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile payload corrupted: calculated ${actualPayloadSha} but expected ${expectedShaFromIndex}. The packfile may have been tampered with.`
+          )
+        }
+
+        // Mark as verified to prevent performance regression on subsequent reads
+        p._checksumVerified = true;
+      }
+
       const result = await p.read({ oid, getExternalRefDelta });
       result.format = 'content';
       result.source = `objects/pack/${filename.replace(/idx$/, 'pack')}`;
@@ -5167,7 +5201,7 @@ function assertParameter(name, value) {
 /**
  * discoverGitdir
  *
- * When processing git commands on a submodule determine
+ * When processing git commands on a submodule or worktree, determine
  * the actual git directory based on the contents of the .git file.
  *
  * Otherwise (if sent a directory) return that directory as-is.
@@ -5184,6 +5218,11 @@ function assertParameter(name, value) {
  *
  */
 
+// Check if a path is absolute (Unix / or Windows drive letter like C:\ or C:/)
+function isAbsolute(filepath) {
+  return filepath.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(filepath)
+}
+
 async function discoverGitdir({ fsp, dotgit }) {
   assertParameter('fsp', fsp);
   assertParameter('dotgit', dotgit);
@@ -5198,6 +5237,10 @@ async function discoverGitdir({ fsp, dotgit }) {
       ._readFile(dotgit, 'utf8')
       .then(contents => contents.trimRight().substr(8))
       .then(submoduleGitdir => {
+        // Worktrees use absolute gitdir paths; submodules use relative ones.
+        if (isAbsolute(submoduleGitdir)) {
+          return submoduleGitdir
+        }
         const gitdir = join(dirname(dotgit), submoduleGitdir);
         return gitdir
       })
@@ -9261,8 +9304,8 @@ function filterCapabilities(server, client) {
 
 const pkg = {
   name: 'isomorphic-git',
-  version: '1.37.1',
-  agent: 'git/isomorphic-git@1.37.1',
+  version: '1.37.3',
+  agent: 'git/isomorphic-git@1.37.3',
 };
 
 class FIFO {

package/index.js

@@ -3389,6 +3389,40 @@ async function readObjectPacked({
         const packFile = indexFile.replace(/idx$/, 'pack');
         p.pack = fs.read(packFile);
       }
+      const pack = await p.pack;
+
+      // === Packfile Integrity Verification ===
+      // Performance optimization: use _checksumVerified flag to verify only once per packfile
+      if (!p._checksumVerified) {
+        const expectedShaFromIndex = p.packfileSha;
+
+        // 1. Fast Check: Verify packfile trailer matches index record
+        // Use subarray instead of slice to avoid memory copy (zero-copy for large packfiles)
+        const packTrailer = pack.subarray(-20);
+        const packTrailerSha = Array.from(packTrailer)
+          .map(b => b.toString(16).padStart(2, '0'))
+          .join('');
+        if (packTrailerSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile trailer mismatch: expected ${expectedShaFromIndex}, got ${packTrailerSha}. The packfile may be corrupted.`
+          )
+        }
+
+        // 2. Deep Integrity Check: Calculate actual SHA-1 of packfile payload
+        // This ensures true data integrity by verifying the entire packfile content
+        // Use subarray for zero-copy reading of large files
+        const payload = pack.subarray(0, -20);
+        const actualPayloadSha = await shasum(payload);
+        if (actualPayloadSha !== expectedShaFromIndex) {
+          throw new InternalError(
+            `Packfile payload corrupted: calculated ${actualPayloadSha} but expected ${expectedShaFromIndex}. The packfile may have been tampered with.`
+          )
+        }
+
+        // Mark as verified to prevent performance regression on subsequent reads
+        p._checksumVerified = true;
+      }
+
       const result = await p.read({ oid, getExternalRefDelta });
       result.format = 'content';
       result.source = `objects/pack/${filename.replace(/idx$/, 'pack')}`;
@@ -5161,7 +5195,7 @@ function assertParameter(name, value) {
 /**
  * discoverGitdir
  *
- * When processing git commands on a submodule determine
+ * When processing git commands on a submodule or worktree, determine
  * the actual git directory based on the contents of the .git file.
  *
  * Otherwise (if sent a directory) return that directory as-is.
@@ -5178,6 +5212,11 @@ function assertParameter(name, value) {
  *
  */
 
+// Check if a path is absolute (Unix / or Windows drive letter like C:\ or C:/)
+function isAbsolute(filepath) {
+  return filepath.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(filepath)
+}
+
 async function discoverGitdir({ fsp, dotgit }) {
   assertParameter('fsp', fsp);
   assertParameter('dotgit', dotgit);
@@ -5192,6 +5231,10 @@ async function discoverGitdir({ fsp, dotgit }) {
       ._readFile(dotgit, 'utf8')
       .then(contents => contents.trimRight().substr(8))
       .then(submoduleGitdir => {
+        // Worktrees use absolute gitdir paths; submodules use relative ones.
+        if (isAbsolute(submoduleGitdir)) {
+          return submoduleGitdir
+        }
         const gitdir = join(dirname(dotgit), submoduleGitdir);
         return gitdir
       })
@@ -9255,8 +9298,8 @@ function filterCapabilities(server, client) {
 
 const pkg = {
   name: 'isomorphic-git',
-  version: '1.37.1',
-  agent: 'git/isomorphic-git@1.37.1',
+  version: '1.37.3',
+  agent: 'git/isomorphic-git@1.37.3',
 };
 
 class FIFO {