commit-graph: use 'struct object_directory *' everywhere

Hi,

While working on deploying layered commit-graphs at GitHub, I noticed that I was able to trigger the mechanism to prevent merging cross-alternate commit-graph layers in funny ways, like claiming that "./objects" and "objects" were in different directories.

This resulted in removing all of the places in the commit-graph.c code that use 'char *object_dir's with 'struct object_directory *'s instead. This allows us to replace brittle string-based path comparisons with raw pointer comparisons to check whether two commit-graphs belong to the same object store or not.

This has a pleasant side effect in PATCH 5/6 of fixing an uninitialized read as described in [1].

This series became a little bit longer than I was expecting it to be, so here is the high-level structure:

- 1/6 fixes a bug in a test that would cause a subsequent failure if unaddressed.

- 2/6 does the first half of the removal by using 'struct object_directory *'s within the 'commit_graph' structure.

- 4/6 does the second half by removing 'char *object_dir' usage in the 'write_commit_graph_context' structure.

- 5/6 ties 2/6 and 4/6 together by removing all path normalization completely, fixing the uninitialized read bug.

- And 6/6 cleans up.

We've been running a version of this series based on our fork (which is in turn based on 2.24) for a few hours without issue.

Thanks in advance for your review.

[1]: https://lore.kernel.org/git/[email protected]/

Taylor Blau (6):
t5318: don't pass non-object directory to '--object-dir' commit-graph.h: store object directory in 'struct commit_graph' builtin/commit-graph.c: die() with unknown '--object-dir' commit-graph.h: store an odb in 'struct write_commit_graph_context' commit-graph.c: remove path normalization, comparison commit-graph.h: use odb in 'load_commit_graph_one_fd_st'

 Documentation/git-commit-graph.txt |   5 +-
 builtin/commit-graph.c             |  25 ++++--
 builtin/commit.c                   |   3 +-
 builtin/fetch.c                    |   2 +-
 builtin/gc.c                       |   2 +-
 commit-graph.c                     | 135 +++++++++++++++--------------
 commit-graph.h                     |  17 ++--
 t/helper/test-read-graph.c         |   8 +-
 t/t5318-commit-graph.sh            |   4 +-
 9 files changed, 114 insertions(+), 87 deletions(-)

--
2.25.0.dirty

In f237c8b6fe (commit-graph: implement git-commit-graph write, 2018-04-02) the test t5318.3 was introduced to ensure that calling 'git commit-graph write' in a repository with no packfiles does not write any commit-graph file(s).

To exercise more paths in 'builtin/commit-graph.c', this test passes '--object-dir' to 'git commit-graph write', but the given argument refers to the working copy, not the object directory.

Since the commit-graph sub-commands currently swallow these errors, this does not result in a test failure. But, it is only lucky that the test ends with no commit-graphs, since there were none to begin with.

In preparation for a future commit where an '--object-dir' argument that does not match a known object directory will print out a failure, let's fix the test to still use '--object-dir', but pass the correct location to the object store instead of '.'.

---
 t/t5318-commit-graph.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 3f03de6018..0bf98b56ec 100755
@@ -19,8 +19,8 @@ test_expect_success 'verify graph with no graph file' '
 
 test_expect_success 'write graph with no packs' '
 	cd "$TRASH_DIRECTORY/full" &&
-	git commit-graph write --object-dir . &&
-	test_path_is_missing info/commit-graph
+	git commit-graph write --object-dir $objdir &&
+	test_path_is_missing $objdir/info/commit-graph
 '
 
 test_expect_success 'exit with correct error on bad input to --stdin-packs' '

2.25.0.dirty

As of the previous patch, all calls to 'commit-graph.c' functions which perform path normalization (for e.g., 'get_commit_graph_filename()') are of the form 'ctx->odb->path', which is always in normalized form.

Now that there are no callers passing non-normalized paths to these functions, ensure that future callers are bound by the same restrictions by making these functions take a 'struct object_directory *' instead of a 'const char *'. To match, replace all calls with arguments of the form 'ctx->odb->path' with 'ctx->odb' To recover the path, functions that perform path manipulation simply use 'odb->path'.

Further, avoid string comparisons with arguments of the form 'odb->path', and instead prefer raw pointer comparisons, which accomplish the same effect, but are far less brittle.

This has a pleasant side-effect of making these functions much more robust to paths that cannot be normalized by 'normalize_path_copy()', i.e., because they are outside of the current working directory.

For example, prior to this patch, Valgrind reports that the following uninitialized memory read [1]:

  $ ( cd t && GIT_DIR=../.git valgrind git rev-parse HEAD^ )

because 'normalize_path_copy()' can't normalize '../.git' (since it's relative to but above of the current working directory) [2].

By using a 'struct object_directory *' directly, 'get_commit_graph_filename()' does not need to normalize, because all paths are relative to the current working directory since they are always read from the '->path' of an object directory.

[1]: https://lore.kernel.org/git/[email protected].
[2]: The bug here is that 'get_commit_graph_filename()' returns the
result of 'normalize_path_copy()' without checking the return value.

---
 builtin/commit-graph.c     | 11 ++++-----
 commit-graph.c             | 47 +++++++++++++++-----------------------
 commit-graph.h             |  2 +-
 t/helper/test-read-graph.c |  6 ++---
 4 files changed, 28 insertions(+), 38 deletions(-)

index 9b1148a60a..4ab045395e 100644
@@ -46,6 +46,7 @@ static struct object_directory *find_odb_or_die(struct repository *r,
 static int graph_verify(int argc, const char **argv)
 {
 	struct commit_graph *graph = NULL;
+	struct object_directory *odb = NULL;
 	char *graph_name;
 	int open_ok;
 	int fd;

@@ -76,7 +77,8 @@ static int graph_verify(int argc, const char **argv)
 	if (opts.progress)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
-	graph_name = get_commit_graph_filename(opts.obj_dir);
+	odb = find_odb_or_die(the_repository, opts.obj_dir);
+	graph_name = get_commit_graph_filename(odb);
 	open_ok = open_commit_graph(graph_name, &fd, &st);
 	if (!open_ok && errno != ENOENT)
 		die_errno(_("Could not open commit-graph '%s'"), graph_name);

@@ -85,11 +87,8 @@ static int graph_verify(int argc, const char **argv)
 
 	if (open_ok)
 		graph = load_commit_graph_one_fd_st(fd, &st);
-	else {
-		struct object_directory *odb;
-		if ((odb = find_odb_or_die(the_repository, opts.obj_dir)))
-			graph = read_commit_graph_one(the_repository, odb);
-	}
+	else
+		graph = read_commit_graph_one(the_repository, odb);
 
 	/* Return failure if open_ok predicted success */
 	if (!graph)

index 39c0c0e51c..97e2bce313 100644
@@ -12,7 +12,7 @@
 
 struct commit;
 
-char *get_commit_graph_filename(const char *obj_dir);
+char *get_commit_graph_filename(struct object_directory *odb);
 int open_commit_graph(const char *graph_file, int *fd, struct stat *st);
 
 struct object_directory *find_odb(struct repository *r, const char *obj_dir);

index d2884efe0a..2c2f65f06c 100644
@@ -11,12 +11,12 @@ int cmd__read_graph(int argc, const char **argv)
 	int open_ok;
 	int fd;
 	struct stat st;
-	const char *object_dir;
+	struct object_directory *odb;
 
 	setup_git_directory();
-	object_dir = get_object_directory();
+	odb = the_repository->objects->odb;
 
-	graph_name = get_commit_graph_filename(object_dir);
+	graph_name = get_commit_graph_filename(odb);
 
 	open_ok = open_commit_graph(graph_name, &fd, &st);
 	if (!open_ok)

2.25.0.dirty

Apply a similar treatment as in the previous patch to pass a 'struct object_directory *' through the 'load_commit_graph_one_fd_st' initializer, too.

This prevents a potential bug where a pointer comparison is made to a NULL 'g->odb', which would cause the commit-graph machinery to think that a pair of commit-graphs belonged to different alternates when in fact they do not (i.e., in the case of no '--object-dir').

---
 builtin/commit-graph.c     |  2 +-
 commit-graph.c             | 21 ++++++++++-----------
 commit-graph.h             |  3 ++-
 t/helper/test-read-graph.c |  2 +-
 4 files changed, 14 insertions(+), 14 deletions(-)

index 4ab045395e..de321c71ad 100644
@@ -86,7 +86,7 @@ static int graph_verify(int argc, const char **argv)
 	FREE_AND_NULL(graph_name);
 
 	if (open_ok)
-		graph = load_commit_graph_one_fd_st(fd, &st);
+		graph = load_commit_graph_one_fd_st(fd, &st, odb);
 	else
 		graph = read_commit_graph_one(the_repository, odb);
 

index 09316240f0..6d34829f57 100644
@@ -128,7 +128,8 @@ int open_commit_graph(const char *graph_file, int *fd, struct stat *st)
 	return 1;
 }
 
-struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st)
+struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st,
+						 struct object_directory *odb)
 {
 	void *graph_map;
 	size_t graph_size;

@@ -144,7 +145,9 @@ struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st)
 	graph_map = xmmap(NULL, graph_size, PROT_READ, MAP_PRIVATE, fd, 0);
 	ret = parse_commit_graph(graph_map, fd, graph_size);
 
-	if (!ret) {
+	if (ret)
+		ret->odb = odb;
+	else {
 		munmap(graph_map, graph_size);
 		close(fd);
 	}

@@ -319,7 +322,8 @@ struct commit_graph *parse_commit_graph(void *graph_map, int fd,
 	return graph;
 }
 
-static struct commit_graph *load_commit_graph_one(const char *graph_file)
+static struct commit_graph *load_commit_graph_one(const char *graph_file,
+						  struct object_directory *odb)
 {
 
 	struct stat st;

@@ -330,7 +334,7 @@ static struct commit_graph *load_commit_graph_one(const char *graph_file)
 	if (!open_ok)
 		return NULL;
 
-	g = load_commit_graph_one_fd_st(fd, &st);
+	g = load_commit_graph_one_fd_st(fd, &st, odb);
 
 	if (g)
 		g->filename = xstrdup(graph_file);

@@ -342,12 +346,9 @@ static struct commit_graph *load_commit_graph_v1(struct repository *r,
 						 struct object_directory *odb)
 {
 	char *graph_name = get_commit_graph_filename(odb);
-	struct commit_graph *g = load_commit_graph_one(graph_name);
+	struct commit_graph *g = load_commit_graph_one(graph_name, odb);
 	free(graph_name);
 
-	if (g)
-		g->odb = odb;
-
 	return g;
 }
 

@@ -426,13 +427,11 @@ static struct commit_graph *load_commit_graph_chain(struct repository *r,
 		valid = 0;
 		for (odb = r->objects->odb; odb; odb = odb->next) {
 			char *graph_name = get_split_graph_filename(odb, line.buf);
-			struct commit_graph *g = load_commit_graph_one(graph_name);
+			struct commit_graph *g = load_commit_graph_one(graph_name, odb);
 
 			free(graph_name);
 
 			if (g) {
-				g->odb = odb;
-
 				if (add_graph_to_chain(g, graph_chain, oids, i)) {
 					graph_chain = g;
 					valid = 1;

index 97e2bce313..7d9fc9c16a 100644
@@ -63,7 +63,8 @@ struct commit_graph {
 	const unsigned char *chunk_base_graphs;
 };
 
-struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st);
+struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st,
+						 struct object_directory *odb);
 struct commit_graph *read_commit_graph_one(struct repository *r,
 					   struct object_directory *odb);
 struct commit_graph *parse_commit_graph(void *graph_map, int fd,

index 2c2f65f06c..f8a461767c 100644
@@ -22,7 +22,7 @@ int cmd__read_graph(int argc, const char **argv)
 	if (!open_ok)
 		die_errno(_("Could not open commit-graph '%s'"), graph_name);
 
-	graph = load_commit_graph_one_fd_st(fd, &st);
+	graph = load_commit_graph_one_fd_st(fd, &st, odb);
 	if (!graph)
 		return 1;
 

2.25.0.dirty

There are lots of places in 'commit-graph.h' where a function either has (or almost has) a full 'struct object_directory *', accesses '->path', and then throws away the rest of the struct.

This can cause headaches when comparing the locations of object directories across alternates (e.g., in the case of deciding if two commit-graph layers can be merged). These paths are normalized with 'normalize_path_copy()' which mitigates some comparison issues, but not all [1].

Instead of getting rid of the 'struct object_directory *', store that insead of a 'char *odb' in 'struct commit_graph'. Once the 'struct write_commit_graph_context' has an object_directory pointer, too, this will allow calling code to replace these error-prone path comparisons with raw pointer comparisons, thereby circumventing any normalization-related errors. This will be introduced in a subsequent patch.

[1]: In my testing, for example, I can get one side of the commit-graph code to fill object_dir with "./objects" and the other with just "objects".

---
 builtin/commit-graph.c | 13 +++++++---
 builtin/commit.c       |  1 +
 commit-graph.c         | 59 ++++++++++++++++++++++++++++++------------
 commit-graph.h         |  8 ++++--
 4 files changed, 58 insertions(+), 23 deletions(-)

index e0c6fc4bbf..3edac318e8 100644
@@ -76,8 +76,11 @@ static int graph_verify(int argc, const char **argv)
 
 	if (open_ok)
 		graph = load_commit_graph_one_fd_st(fd, &st);
-	 else
-		graph = read_commit_graph_one(the_repository, opts.obj_dir);
+	else {
+		struct object_directory *odb;
+		if ((odb = find_odb(the_repository, opts.obj_dir)))
+			graph = read_commit_graph_one(the_repository, odb);
+	}
 
 	/* Return failure if open_ok predicted success */
 	if (!graph)

@@ -97,6 +100,7 @@ static int graph_write(int argc, const char **argv)
 	struct string_list lines;
 	int result = 0;
 	enum commit_graph_write_flags flags = 0;
+	struct object_directory *odb = NULL;
 
 	static struct option builtin_commit_graph_write_options[] = {
 		OPT_STRING(0, "object-dir", &opts.obj_dir,

@@ -145,9 +149,10 @@ static int graph_write(int argc, const char **argv)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
 	read_replace_refs = 0;
+	odb = find_odb(the_repository, opts.obj_dir);
 
 	if (opts.reachable) {
-		if (write_commit_graph_reachable(opts.obj_dir, flags, &split_opts))
+		if (write_commit_graph_reachable(odb->path, flags, &split_opts))
 			return 1;
 		return 0;
 	}

@@ -169,7 +174,7 @@ static int graph_write(int argc, const char **argv)
 		UNLEAK(buf);
 	}
 
-	if (write_commit_graph(opts.obj_dir,
+	if (write_commit_graph(odb->path,
 			       pack_indexes,
 			       commit_hex,
 			       flags,

index aa1332308a..bd071169d7 100644
@@ -36,6 +36,7 @@
 #include "help.h"
 #include "commit-reach.h"
 #include "commit-graph.h"
+#include "object-store.h"
 
 static const char * const builtin_commit_usage[] = {
 	N_("git commit [<options>] [--] <pathspec>..."),

index 7f5c933fa2..9700a6c7c2 100644
@@ -5,6 +5,7 @@
 #include "repository.h"
 #include "string-list.h"
 #include "cache.h"
+#include "object-store.h"
 
 #define GIT_TEST_COMMIT_GRAPH "GIT_TEST_COMMIT_GRAPH"
 #define GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD "GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD"

@@ -14,6 +15,8 @@ struct commit;
 char *get_commit_graph_filename(const char *obj_dir);
 int open_commit_graph(const char *graph_file, int *fd, struct stat *st);
 
+struct object_directory *find_odb(struct repository *r, const char *obj_dir);
+
 /*
  * Given a commit struct, try to fill the commit struct info, including:
  *  1. tree object

@@ -48,7 +51,7 @@ struct commit_graph {
 	uint32_t num_commits;
 	struct object_id oid;
 	char *filename;
-	const char *obj_dir;
+	struct object_directory *odb;
 
 	uint32_t num_commits_in_base;
 	struct commit_graph *base_graph;

@@ -61,7 +64,8 @@ struct commit_graph {
 };
 
 struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st);
-struct commit_graph *read_commit_graph_one(struct repository *r, const char *obj_dir);
+struct commit_graph *read_commit_graph_one(struct repository *r,
+					   struct object_directory *odb);
 struct commit_graph *parse_commit_graph(void *graph_map, int fd,
 					size_t graph_size);
 

2.25.0.dirty

In a previous patch, the 'char *object_dir' in 'struct commit_graph' was replaced with a 'struct object_directory'. This patch applies the same treatement to 'struct write_commit_graph_context', which is an intermediate step towards getting rid of all path normalization in 'commit-graph.c'.

Instead of taking a 'char *object_dir', functions that construct a 'struct write_commit_graph_context' now take a 'struct object_directory *'. Any code that needs an object directory path use '->path' instead.

This ensures that all calls to functions that perform path normalization are given arguments which do not themselves require normalization. This prepares those functions to drop their normalization entirely, which will occur in the subsequent patch.

---
 builtin/commit-graph.c |  4 ++--
 builtin/commit.c       |  2 +-
 builtin/fetch.c        |  2 +-
 builtin/gc.c           |  2 +-
 commit-graph.c         | 42 ++++++++++++++++--------------------------
 commit-graph.h         |  4 ++--
 6 files changed, 23 insertions(+), 33 deletions(-)

index 93ff90d73b..9b1148a60a 100644
@@ -161,7 +161,7 @@ static int graph_write(int argc, const char **argv)
 	odb = find_odb_or_die(the_repository, opts.obj_dir);
 
 	if (opts.reachable) {
-		if (write_commit_graph_reachable(odb->path, flags, &split_opts))
+		if (write_commit_graph_reachable(odb, flags, &split_opts))
 			return 1;
 		return 0;
 	}

@@ -183,7 +183,7 @@ static int graph_write(int argc, const char **argv)
 		UNLEAK(buf);
 	}
 
-	if (write_commit_graph(odb->path,
+	if (write_commit_graph(odb,
 			       pack_indexes,
 			       commit_hex,
 			       flags,

index bd071169d7..9df3733e96 100644
@@ -1689,7 +1689,7 @@ int cmd_commit(int argc, const char **argv, const char *prefix)
 		      "not exceeded, and then \"git restore --staged :/\" to recover."));
 
 	if (git_env_bool(GIT_TEST_COMMIT_GRAPH, 0) &&
-	    write_commit_graph_reachable(get_object_directory(), 0, NULL))
+	    write_commit_graph_reachable(the_repository->objects->odb, 0, NULL))
 		return 1;
 
 	repo_rerere(the_repository, 0);

index b4c6d921d0..1ce16c96e9 100644
@@ -1870,7 +1870,7 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)
 		if (progress)
 			commit_graph_flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
-		write_commit_graph_reachable(get_object_directory(),
+		write_commit_graph_reachable(the_repository->objects->odb,
 					     commit_graph_flags,
 					     NULL);
 	}

index 3f76bf4aa7..8e0b9cf41b 100644
@@ -686,7 +686,7 @@ int cmd_gc(int argc, const char **argv, const char *prefix)
 
 	prepare_repo_settings(the_repository);
 	if (the_repository->settings.gc_write_commit_graph == 1)
-		write_commit_graph_reachable(get_object_directory(),
+		write_commit_graph_reachable(the_repository->objects->odb,
 					     !quiet && !daemonized ? COMMIT_GRAPH_WRITE_PROGRESS : 0,
 					     NULL);
 

index 9700a6c7c2..39c0c0e51c 100644
@@ -95,10 +95,10 @@ struct split_commit_graph_opts {
  * is not compatible with the commit-graph feature, then the
  * methods will return 0 without writing a commit-graph.
  */
-int write_commit_graph_reachable(const char *obj_dir,
+int write_commit_graph_reachable(struct object_directory *odb,
 				 enum commit_graph_write_flags flags,
 				 const struct split_commit_graph_opts *split_opts);
-int write_commit_graph(const char *obj_dir,
+int write_commit_graph(struct object_directory *odb,
 		       struct string_list *pack_indexes,
 		       struct string_list *commit_hex,
 		       enum commit_graph_write_flags flags,

2.25.0.dirty

The commit-graph sub-commands 'write', 'verify' both take an '--object-dir' argument, which is used to specify the location of an object directory containing commit-graphs.

However, there was no verification that the '--object-dir' argument was an object directory. In the case of an '--object-dir' argument that either (1) doesn't exist, or (2) isn't an object directory, 'git commit-graph ...' would exit silently with status zero.

This can clearly lead to unintended behavior, such as verifying commit-graphs that aren't in a repository's own object store (or one of its alternates), or causing a typo to mask a legitimate commit-graph verification failure.

To remedy this, let's wrap 'find_odb()' with 'find_odb_or_die()' and cause the above such errors to produce an error and non-zero exit code.

---
 Documentation/git-commit-graph.txt |  5 ++++-
 builtin/commit-graph.c             | 13 +++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

index bcd85c1976..28d1fee505 100644
@@ -26,7 +26,10 @@ OPTIONS
 	file. This parameter exists to specify the location of an alternate
 	that only has the objects directory, not a full `.git` directory. The
 	commit-graph file is expected to be in the `<dir>/info` directory and
-	the packfiles are expected to be in `<dir>/pack`.
+	the packfiles are expected to be in `<dir>/pack`. If the directory
+	could not be made into an absolute path, or does not match any known
+	object directory, `git commit-graph ...` will exit with non-zero
+	status.
 
 --[no-]progress::
 	Turn progress on/off explicitly. If neither is specified, progress is

index 3edac318e8..93ff90d73b 100644
@@ -34,6 +34,15 @@ static struct opts_commit_graph {
 	int progress;
 } opts;
 
+static struct object_directory *find_odb_or_die(struct repository *r,
+						const char *obj_dir)
+{
+	struct object_directory *odb = find_odb(r, obj_dir);
+	if (!odb)
+		die(_("could not find object directory matching %s"), obj_dir);
+	return odb;
+}
+
 static int graph_verify(int argc, const char **argv)
 {
 	struct commit_graph *graph = NULL;

@@ -78,7 +87,7 @@ static int graph_verify(int argc, const char **argv)
 		graph = load_commit_graph_one_fd_st(fd, &st);
 	else {
 		struct object_directory *odb;
-		if ((odb = find_odb(the_repository, opts.obj_dir)))
+		if ((odb = find_odb_or_die(the_repository, opts.obj_dir)))
 			graph = read_commit_graph_one(the_repository, odb);
 	}
 

@@ -149,7 +158,7 @@ static int graph_write(int argc, const char **argv)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
 	read_replace_refs = 0;
-	odb = find_odb(the_repository, opts.obj_dir);
+	odb = find_odb_or_die(the_repository, opts.obj_dir);
 
 	if (opts.reachable) {
 		if (write_commit_graph_reachable(odb->path, flags, &split_opts))

2.25.0.dirty

s/insead/instead/

  odb = find_odb(...);
  if (odb)
          ....

I think the right place is actually as a static inside builtin/commit-graph.c, as this is really about handling its weird --object-dir options.

But it can't go there in this patch, because there's a caller in commit-graph.c. In patch 4, we convert write_commit_graph() to take an odb, too, and that call goes away. At that point, we could move it into the builtin as a static.

Ideally we could flip the order of this patch and patch 4, but that doesn't work either: by switching to an odb we lose our path normalization, but if the other side hasn't switched either, then we can't just compare odb pointers. It would be a temporary regression.

So there's a circular dependency between the two patches. I think we ought to do done of:

- move find_odb() to a static as a cleanup on top

- squash those two patches together into a single

- swap the patch order, but have write_commit_graph_ctx store both the "odb" _and_ the normalized copy of the path we do now. That leaves it correct, and then it can be cleaned up in favor of an odb pointer comparison in patch 5, along with the rest of the normalized bits.

I'm OK with any of those. The second two have the added bonus that we could introduce the die() behavior into find_odb() immediately, and explain it (there's another temporary weirdness in this patch where specifying an --object-dir outside of the repository becomes a silent noop, and then the next patch turns it into an error, but that could all be done in a single step when we introduce find_odb()).

Yeah, I believe you are correct (and this is a nice simplification worth doing).

-Peff

With the exception of the patch-ordering discussion in the sub-thread with Martin, this looks good to me.

Patch 3 is a change in user-visible behavior, as it restricts how --object-dir can be used (it must be the main object-dir or an alternate within the repository). I don't _think_ anybody would care, as the semantics of those options seemed kind of ill-defined to me in the first place. But it's worth calling out as a potential risk. I suppose the alternative is to make a one-off fake "struct object_directory" within the process that isn't connected to the repository. But if nobody cares, I'd just as soon avoid that.

One other funny thing with this series: the Date headers of your patches seem out of order. They ordering in your cover letter here is fine and presumably reflects the commit topology:

but the Date headers in order of 1-6 are:

  Date:   Thu, 30 Jan 2020 15:00:43 -0800
  Date:   Thu, 30 Jan 2020 15:00:50 -0800
  Date:   Thu, 30 Jan 2020 15:00:54 -0800
  Date:   Thu, 30 Jan 2020 15:00:52 -0800
  Date:   Thu, 30 Jan 2020 15:00:45 -0800
  Date:   Thu, 30 Jan 2020 15:00:47 -0800

It's like your sending script rewrites the Date header and puts a 2-second bump between each one (which is good, and what git-send-email does), but got fed the patches in the wrong order (perhaps their _original_ date order, if there was clean-up rebasing).

-Peff

I agree. Martin's comment is a good one. I can't find anything else to improve the series.

I think that this change of behavior is fine, especially because if someone writes a commit-graph to an --object-dir that is not an alternate, then that repo will not discover the new commit-graph anyway.

I do like that you state a possible work-around in case someone shows up with a legitimate use case for a non-alternate object-dir.

Thanks,
-Stolee

Thanks for explaining the issue.

... and these ways of addressing it.

Martin

Yup.

Hi Martin,

Thanks for your review! Your comments were all quite helpful, and I applied all of your suggested changes.

Typo. Thanks for noticing. I fixed this in my local copy of this branch.

To be honest, I'm not such a fan of this style myself, but it seemed odd to me to write:

  struct object_directory *odb;
  odb = ...;
  if (odb) {
  }

when we were really only trying to call 'find_odb()' and do something with its result, but only if it was non-NULL. I counted 152 of these assign-if's laying around with:

  $ git grep 'if ((.* =[^=]' | wc -l

but it seems like they are in poor style (as evidenced by your and Junio's response later in the thread). So, I removed this and instead promoted 'odb' to a local variable at the function level, since we do that promotion anyway in a couple of patches later. This reduces the churn, and avoids either an assign-if, or a define/assign/check.

No; this is a stray left over from some development on this branch. I'll remove it.

I'll respond in more complete detail further down in the thread, but the short answer is "yes, this should go in builtin/commit-graph.c".

Thanks, I changed this to remove the 'cmp' check outside of the loop, which I agree is unnecessary.

Thanks,
Taylor

Thanks for describing the problem, and for laying out a few options!

I went with this option, which was to swap patches 2/6 and 4/6, and then squashing 3/6 into what _was_ 4/6 (but is now 2/5).

That all said, I am not sure that I follow the explanation that we need to have 'write_commit_graph_ctx' store the normalized object_dir, since we can use 'odb->path' for this instead. I double checked, and we already do the same loose normalization in 'sha1-file.c:link_alt_odb_entry()', where we remove trailing slashes.

This isn't the exact same normalization strictly speaking. It differs only in that we remove more than one trailing slash if it exists, but this seems acceptable for the 2 patches that this behavior changes lives on for.

I double checked that the 'odb->path' is normalized relative to the $PWD, in which case I think that we can rely on it as a stand-in for 'object_dir', and don't have to store both.

Thanks,
Taylor

Thanks for your review!

And thanks for the ack. I would be somewhat surprised if someone were really relying on this behavior in practice.

Thanks,
Taylor

I was assuming that the normalization in write_commit_graph_ctx was necessary (and I think there are some tests around this), but I admit I didn't actually try it. If it's not failing tests, I'm OK with comparing the non-normalized paths as an intermediate step, since we end up comparing pointers after the final patches.

-Peff

Hi,

Here is a re-roll of the series in this thread to replace string-based path comparison in 'commit-graph.c' code with raw pointer comparison of 'struct object_directory *'s.

The only thing that has changed substantially since v1 is that I swapped the order of patches 2/6 and 4/6. What was patch 3/6 got folded into what is now patch 2/5. This resolves an inconvenience where we had to define a helper function in 'commit-graph.c', when it really belonged in 'builtin/commit-graph.c'.

I took a few other suggestions from Martin in what is now patch 4/5, and noticed a few other small things along the way. A range-diff since v1 is included below.

Thanks as always,
Taylor

Taylor Blau (5):
t5318: don't pass non-object directory to '--object-dir' commit-graph.h: store an odb in 'struct write_commit_graph_context' commit-graph.h: store object directory in 'struct commit_graph' commit-graph.c: remove path normalization, comparison commit-graph.h: use odb in 'load_commit_graph_one_fd_st'

 Documentation/git-commit-graph.txt |   5 +-
 builtin/commit-graph.c             |  34 +++++++--
 builtin/commit.c                   |   2 +-
 builtin/fetch.c                    |   2 +-
 builtin/gc.c                       |   2 +-
 commit-graph.c                     | 115 +++++++++++++----------------
 commit-graph.h                     |  15 ++--
 t/helper/test-read-graph.c         |   8 +-
 t/t5318-commit-graph.sh            |   4 +-
 9 files changed, 100 insertions(+), 87 deletions(-)

Range-diff against v1:

1:  09ba72c85a = 1:  84a8709ad1 t5318: don't pass non-object directory to '--object-dir'
4:  9784a5db3c ! 2:  d9819cfb33 commit-graph.h: store an odb in 'struct write_commit_graph_context'

@@ Metadata
## Commit message ##
commit-graph.h: store an odb in 'struct write_commit_graph_context'

- In a previous patch, the 'char *object_dir' in 'struct commit_graph' was
- replaced with a 'struct object_directory'. This patch applies the same
- treatement to 'struct write_commit_graph_context', which is an
- intermediate step towards getting rid of all path normalization in
- 'commit-graph.c'.
-
- Instead of taking a 'char *object_dir', functions that construct a
- 'struct write_commit_graph_context' now take a 'struct object_directory
- *'. Any code that needs an object directory path use '->path' instead.
-
- This ensures that all calls to functions that perform path normalization
- are given arguments which do not themselves require normalization. This
- prepares those functions to drop their normalization entirely, which
- will occur in the subsequent patch.
+ There are lots of places in 'commit-graph.h' where a function either has
+ (or almost has) a full 'struct object_directory *', accesses '->path',
+ and then throws away the rest of the struct.
+
+ This can cause headaches when comparing the locations of object
+ directories across alternates (e.g., in the case of deciding if two
+ commit-graph layers can be merged). These paths are normalized with
+ 'normalize_path_copy()' which mitigates some comparison issues, but not
+ all [1].
+
+ Replace usage of 'char *object_dir' with 'odb->path' by storing a
+ 'struct object_directory *' in the 'write_commit_graph_context'
+ structure. This is an intermediate step towards getting rid of all path
+ normalization in 'commit-graph.c'.
+
+ Resolving a user-provided '--object-dir' argument now requires that we
+ compare it to the known alternates for equality. Prior to this patch,
+ an unknown '--object-dir' argument would silently exit with status zero.
+
+ This can clearly lead to unintended behavior, such as verifying
+ commit-graphs that aren't in a repository's own object store (or one of
+ its alternates), or causing a typo to mask a legitimate commit-graph
+ verification failure. Make this error non-silent by 'die()'-ing when the
+ given '--object-dir' does not match any known alternate object store.
+
+ [1]: In my testing, for example, I can get one side of the commit-graph
+ code to fill object_dir with "./objects" and the other with just
+ "objects".

+ ## Documentation/git-commit-graph.txt ##
+@@ Documentation/git-commit-graph.txt: OPTIONS
+ file. This parameter exists to specify the location of an alternate
+ that only has the objects directory, not a full .git directory. The
+ commit-graph file is expected to be in the <dir>/info directory and
+- the packfiles are expected to be in <dir>/pack.
++ the packfiles are expected to be in <dir>/pack. If the directory
++ could not be made into an absolute path, or does not match any known
++ object directory, git commit-graph ... will exit with non-zero
++ status.
+
+ --[no-]progress::
+ Turn progress on/off explicitly. If neither is specified, progress is
+
## builtin/commit-graph.c ##
+@@ builtin/commit-graph.c: static struct opts_commit_graph {
+ int progress;
+ } opts;
+
++struct object_directory *find_odb(struct repository *r, const char *obj_dir) ++{
++ struct object_directory *odb;
++ char *obj_dir_real = real_pathdup(obj_dir, 1);
++
++ prepare_alt_odb(r);
++ for (odb = r->objects->odb; odb; odb = odb->next) {
++ if (!strcmp(obj_dir_real, real_path(odb->path)))
++ break;
++ }
++
++ free(obj_dir_real);
++
++ if (!odb)
++ die(_("could not find object directory matching %s"), obj_dir);
++ return odb;
++}
++
+ static int graph_verify(int argc, const char **argv)
+ {
+ struct commit_graph *graph = NULL;
++ struct object_directory *odb = NULL;
+ char *graph_name;
+ int open_ok;
+ int fd;
+@@ builtin/commit-graph.c: static int graph_verify(int argc, const char **argv)
+ if (opts.progress)
+ flags |= COMMIT_GRAPH_WRITE_PROGRESS;
+
+- graph_name = get_commit_graph_filename(opts.obj_dir);
++ odb = find_odb(the_repository, opts.obj_dir);
++ graph_name = get_commit_graph_filename(odb->path);
+ open_ok = open_commit_graph(graph_name, &fd, &st);
+ if (!open_ok && errno != ENOENT)
+ die_errno(_("Could not open commit-graph '%s'"), graph_name);
+@@ builtin/commit-graph.c: static int graph_verify(int argc, const char **argv) +
+ if (open_ok)
+ graph = load_commit_graph_one_fd_st(fd, &st);
+- else
+- graph = read_commit_graph_one(the_repository, opts.obj_dir);
++ else
++ graph = read_commit_graph_one(the_repository, odb->path);
+
+ /* Return failure if open_ok predicted success */
+ if (!graph)
@@ builtin/commit-graph.c: static int graph_write(int argc, const char **argv)
- odb = find_odb_or_die(the_repository, opts.obj_dir);
+ {
+ struct string_list *pack_indexes = NULL;
+ struct string_list *commit_hex = NULL;
++ struct object_directory *odb = NULL;
+ struct string_list lines;
+ int result = 0;
+ enum commit_graph_write_flags flags = 0;
+@@ builtin/commit-graph.c: static int graph_write(int argc, const char **argv)
+ flags |= COMMIT_GRAPH_WRITE_PROGRESS;
+
+ read_replace_refs = 0;
++ odb = find_odb(the_repository, opts.obj_dir);

if (opts.reachable) {
-- if (write_commit_graph_reachable(odb->path, flags, &split_opts))
+- if (write_commit_graph_reachable(opts.obj_dir, flags, &split_opts))
+ if (write_commit_graph_reachable(odb, flags, &split_opts))
return 1;
return 0;
@@ builtin/commit-graph.c: static int graph_write(int argc, const char **argv)
UNLEAK(buf);
}

-- if (write_commit_graph(odb->path,
+- if (write_commit_graph(opts.obj_dir,
+ if (write_commit_graph(odb,
pack_indexes,
commit_hex,
@@ commit-graph.c: static void split_graph_merge_strategy(struct write_commit_graph

while (g && (g->num_commits <= size_mult * num_commits ||
(max_commits && num_commits > max_commits))) {
-- if (strcmp(g->odb->path, ctx->obj_dir))
-+ if (strcmp(g->odb->path, ctx->odb->path))
+- if (strcmp(g->obj_dir, ctx->obj_dir))
++ if (strcmp(g->obj_dir, ctx->odb->path))
break;

num_commits += g->num_commits;
@@ commit-graph.c: static void split_graph_merge_strategy(struct write_commit_graph_context *ctx)
- char *old_graph_name = get_commit_graph_filename(g->odb->path);
+ char *old_graph_name = get_commit_graph_filename(g->obj_dir);

if (!strcmp(g->filename, old_graph_name) &&
-- strcmp(g->odb->path, ctx->obj_dir)) {
-+ strcmp(g->odb->path, ctx->odb->path)) {
+- strcmp(g->obj_dir, ctx->obj_dir)) {
++ strcmp(g->obj_dir, ctx->odb->path)) {
ctx->num_commit_graphs_after = 1; ctx->new_base_graph = NULL;
}
@@ commit-graph.c: int write_commit_graph(const char *obj_dir,
ctx->oids.alloc = split_opts->max_commits;

if (ctx->append) {
-- struct object_directory *odb = find_odb(ctx->r, ctx->obj_dir);
-- prepare_commit_graph_one(ctx->r, odb);
-+ prepare_commit_graph_one(ctx->r, ctx->odb);
+- prepare_commit_graph_one(ctx->r, ctx->obj_dir);
++ prepare_commit_graph_one(ctx->r, ctx->odb->path);
if (ctx->r->objects->commit_graph)
ctx->oids.alloc += ctx->r->objects->commit_graph->num_commits;
}
@@ commit-graph.c: int write_commit_graph(const char *obj_dir,
for (i = 0; i < ctx->num_commit_graphs_after; i++) {

## commit-graph.h ##
+@@
+ #include "repository.h"
+ #include "string-list.h"
+ #include "cache.h"
++#include "object-store.h"
+
+ #define GIT_TEST_COMMIT_GRAPH "GIT_TEST_COMMIT_GRAPH"
+ #define GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD "GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD" @@ commit-graph.h: struct split_commit_graph_opts {
* is not compatible with the commit-graph feature, then the
* methods will return 0 without writing a commit-graph.
2: 328884f5f6 ! 3: 5fd5cfca6e commit-graph.h: store object directory in 'struct commit_graph'

    @@ Metadata
      ## Commit message ##
         commit-graph.h: store object directory in 'struct commit_graph'

    -    There are lots of places in 'commit-graph.h' where a function either has
    -    (or almost has) a full 'struct object_directory *', accesses '->path',
    -    and then throws away the rest of the struct.
    +    In a previous patch, the 'char *object_dir' in 'struct commit_graph' was
    +    replaced with a 'struct object_directory'. This patch applies the same
    +    treatment to 'struct commit_graph', which is another intermediate step
    +    towards getting rid of all path normalization in 'commit-graph.c'.

    -    This can cause headaches when comparing the locations of object
    -    directories across alternates (e.g., in the case of deciding if two
    -    commit-graph layers can be merged). These paths are normalized with
    -    'normalize_path_copy()' which mitigates some comparison issues, but not
    -    all [1].
    +    Instead of taking a 'char *object_dir', functions that construct a
    +    'struct commit_graph' now take a 'struct object_directory *'. Any code
    +    that needs an object directory path use '->path' instead.

    -    Instead of getting rid of the 'struct object_directory *', store that
    -    insead of a 'char *odb' in 'struct commit_graph'. Once the 'struct
    -    write_commit_graph_context' has an object_directory pointer, too, this
    -    will allow calling code to replace these error-prone path comparisons
    -    with raw pointer comparisons, thereby circumventing any
    -    normalization-related errors. This will be introduced in a subsequent
    -    patch.
    -
    -    [1]: In my testing, for example, I can get one side of the commit-graph
    -    code to fill object_dir with "./objects" and the other with just
    -    "objects".
    +    This ensures that all calls to functions that perform path normalization
    +    are given arguments which do not themselves require normalization. This
    +    prepares those functions to drop their normalization entirely, which
    +    will occur in the subsequent patch.

         Signed-off-by: Taylor Blau <[email protected]>

      ## builtin/commit-graph.c ##
     @@ builtin/commit-graph.c: static int graph_verify(int argc, const char **argv)
    -
      	if (open_ok)
      		graph = load_commit_graph_one_fd_st(fd, &st);
    --	 else
    --		graph = read_commit_graph_one(the_repository, opts.obj_dir);
    -+	else {
    -+		struct object_directory *odb;
    -+		if ((odb = find_odb(the_repository, opts.obj_dir)))
    -+			graph = read_commit_graph_one(the_repository, odb);
    -+	}
    + 	else
    +-		graph = read_commit_graph_one(the_repository, odb->path);
    ++		graph = read_commit_graph_one(the_repository, odb);

      	/* Return failure if open_ok predicted success */
      	if (!graph)
    -@@ builtin/commit-graph.c: static int graph_write(int argc, const char **argv)
    - 	struct string_list lines;
    - 	int result = 0;
    - 	enum commit_graph_write_flags flags = 0;
    -+	struct object_directory *odb = NULL;
    -
    - 	static struct option builtin_commit_graph_write_options[] = {
    - 		OPT_STRING(0, "object-dir", &opts.obj_dir,
    -@@ builtin/commit-graph.c: static int graph_write(int argc, const char **argv)
    - 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
    -
    - 	read_replace_refs = 0;
    -+	odb = find_odb(the_repository, opts.obj_dir);
    -
    - 	if (opts.reachable) {
    --		if (write_commit_graph_reachable(opts.obj_dir, flags, &split_opts))
    -+		if (write_commit_graph_reachable(odb->path, flags, &split_opts))
    - 			return 1;
    - 		return 0;
    - 	}
    -@@ builtin/commit-graph.c: static int graph_write(int argc, const char **argv)
    - 		UNLEAK(buf);
    - 	}
    -
    --	if (write_commit_graph(opts.obj_dir,
    -+	if (write_commit_graph(odb->path,
    - 			       pack_indexes,
    - 			       commit_hex,
    - 			       flags,
    -
    - ## builtin/commit.c ##
    -@@
    - #include "help.h"
    - #include "commit-reach.h"
    - #include "commit-graph.h"
    -+#include "object-store.h"
    -
    - static const char * const builtin_commit_usage[] = {
    - 	N_("git commit [<options>] [--] <pathspec>..."),

      ## commit-graph.c ##
    -@@ commit-graph.c: static uint8_t oid_version(void)
    - 	return 1;
    - }
    -
    -+struct object_directory *find_odb(struct repository *r, const char *obj_dir)
    -+{
    -+	struct object_directory *odb;
    -+	char *obj_dir_real = real_pathdup(obj_dir, 1);
    -+	int cmp = -1;
    -+
    -+	prepare_alt_odb(r);
    -+	for (odb = r->objects->odb; odb; odb = odb->next) {
    -+		cmp = strcmp(obj_dir_real, real_path(odb->path));
    -+		if (!cmp)
    -+			break;
    -+	}
    -+
    -+	free(obj_dir_real);
    -+
    -+	if (cmp)
    -+		odb = NULL;
    -+	return odb;
    -+}
    -+
    - static struct commit_graph *alloc_commit_graph(void)
    - {
    - 	struct commit_graph *g = xcalloc(1, sizeof(*g));
     @@ commit-graph.c: static struct commit_graph *load_commit_graph_one(const char *graph_file)
      	return g;
      }
    @@ commit-graph.c: static void split_graph_merge_strategy(struct write_commit_graph

      	while (g && (g->num_commits <= size_mult * num_commits ||
      		    (max_commits && num_commits > max_commits))) {
    --		if (strcmp(g->obj_dir, ctx->obj_dir))
    -+		if (strcmp(g->odb->path, ctx->obj_dir))
    +-		if (strcmp(g->obj_dir, ctx->odb->path))
    ++		if (strcmp(g->odb->path, ctx->odb->path))
      			break;

      		num_commits += g->num_commits;
    @@ commit-graph.c: static void split_graph_merge_strategy(struct write_commit_graph
     +		char *old_graph_name = get_commit_graph_filename(g->odb->path);

      		if (!strcmp(g->filename, old_graph_name) &&
    --		    strcmp(g->obj_dir, ctx->obj_dir)) {
    -+		    strcmp(g->odb->path, ctx->obj_dir)) {
    +-		    strcmp(g->obj_dir, ctx->odb->path)) {
    ++		    strcmp(g->odb->path, ctx->odb->path)) {
      			ctx->num_commit_graphs_after = 1;
      			ctx->new_base_graph = NULL;
      		}
    -@@ commit-graph.c: int write_commit_graph(const char *obj_dir,
    +@@ commit-graph.c: int write_commit_graph(struct object_directory *odb,
      		ctx->oids.alloc = split_opts->max_commits;

      	if (ctx->append) {
    --		prepare_commit_graph_one(ctx->r, ctx->obj_dir);
    -+		struct object_directory *odb = find_odb(ctx->r, ctx->obj_dir);
    -+		prepare_commit_graph_one(ctx->r, odb);
    +-		prepare_commit_graph_one(ctx->r, ctx->odb->path);
    ++		prepare_commit_graph_one(ctx->r, ctx->odb);
      		if (ctx->r->objects->commit_graph)
      			ctx->oids.alloc += ctx->r->objects->commit_graph->num_commits;
      	}

      ## commit-graph.h ##
    -@@
    - #include "repository.h"
    - #include "string-list.h"
    - #include "cache.h"
    -+#include "object-store.h"
    -
    - #define GIT_TEST_COMMIT_GRAPH "GIT_TEST_COMMIT_GRAPH"
    - #define GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD "GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD"
    -@@ commit-graph.h: struct commit;
    - char *get_commit_graph_filename(const char *obj_dir);
    - int open_commit_graph(const char *graph_file, int *fd, struct stat *st);
    -
    -+struct object_directory *find_odb(struct repository *r, const char *obj_dir);
    -+
    - /*
    -  * Given a commit struct, try to fill the commit struct info, including:
    -  *  1. tree object
     @@ commit-graph.h: struct commit_graph {
      	uint32_t num_commits;
      	struct object_id oid;
3:  ce884d7742 < -:  ---------- builtin/commit-graph.c: die() with unknown '--object-dir'
5:  c9b2ba46ab ! 4:  f14e95aa7e commit-graph.c: remove path normalization, comparison
    @@ Commit message
         Signed-off-by: Taylor Blau <[email protected]>

      ## builtin/commit-graph.c ##
    -@@ builtin/commit-graph.c: static struct object_directory *find_odb_or_die(struct repository *r,
    - static int graph_verify(int argc, const char **argv)
    - {
    - 	struct commit_graph *graph = NULL;
    -+	struct object_directory *odb = NULL;
    - 	char *graph_name;
    - 	int open_ok;
    - 	int fd;
     @@ builtin/commit-graph.c: static int graph_verify(int argc, const char **argv)
    - 	if (opts.progress)
      		flags |= COMMIT_GRAPH_WRITE_PROGRESS;

    --	graph_name = get_commit_graph_filename(opts.obj_dir);
    -+	odb = find_odb_or_die(the_repository, opts.obj_dir);
    + 	odb = find_odb(the_repository, opts.obj_dir);
    +-	graph_name = get_commit_graph_filename(odb->path);
     +	graph_name = get_commit_graph_filename(odb);
      	open_ok = open_commit_graph(graph_name, &fd, &st);
      	if (!open_ok && errno != ENOENT)
      		die_errno(_("Could not open commit-graph '%s'"), graph_name);
    -@@ builtin/commit-graph.c: static int graph_verify(int argc, const char **argv)
    -
    - 	if (open_ok)
    - 		graph = load_commit_graph_one_fd_st(fd, &st);
    --	else {
    --		struct object_directory *odb;
    --		if ((odb = find_odb_or_die(the_repository, opts.obj_dir)))
    --			graph = read_commit_graph_one(the_repository, odb);
    --	}
    -+	else
    -+		graph = read_commit_graph_one(the_repository, odb);
    -
    - 	/* Return failure if open_ok predicted success */
    - 	if (!graph)

      ## commit-graph.c ##
     @@
    @@ commit-graph.h
     +char *get_commit_graph_filename(struct object_directory *odb);
      int open_commit_graph(const char *graph_file, int *fd, struct stat *st);

    - struct object_directory *find_odb(struct repository *r, const char *obj_dir);
    + /*

      ## t/helper/test-read-graph.c ##
     @@ t/helper/test-read-graph.c: int cmd__read_graph(int argc, const char **argv)

6: e70483f771 = 5: aa12b7378b commit-graph.h: use odb in 'load_commit_graph_one_fd_st' --
2.25.0.119.gaa12b7378b

In f237c8b6fe (commit-graph: implement git-commit-graph write, 2018-04-02) the test t5318.3 was introduced to ensure that calling 'git commit-graph write' in a repository with no packfiles does not write any commit-graph file(s).

To exercise more paths in 'builtin/commit-graph.c', this test passes '--object-dir' to 'git commit-graph write', but the given argument refers to the working copy, not the object directory.

Since the commit-graph sub-commands currently swallow these errors, this does not result in a test failure. But, it is only lucky that the test ends with no commit-graphs, since there were none to begin with.

In preparation for a future commit where an '--object-dir' argument that does not match a known object directory will print out a failure, let's fix the test to still use '--object-dir', but pass the correct location to the object store instead of '.'.

---
 t/t5318-commit-graph.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 3f03de6018..0bf98b56ec 100755
@@ -19,8 +19,8 @@ test_expect_success 'verify graph with no graph file' '
 
 test_expect_success 'write graph with no packs' '
 	cd "$TRASH_DIRECTORY/full" &&
-	git commit-graph write --object-dir . &&
-	test_path_is_missing info/commit-graph
+	git commit-graph write --object-dir $objdir &&
+	test_path_is_missing $objdir/info/commit-graph
 '
 
 test_expect_success 'exit with correct error on bad input to --stdin-packs' '

2.25.0.119.gaa12b7378b

There are lots of places in 'commit-graph.h' where a function either has (or almost has) a full 'struct object_directory *', accesses '->path', and then throws away the rest of the struct.

This can cause headaches when comparing the locations of object directories across alternates (e.g., in the case of deciding if two commit-graph layers can be merged). These paths are normalized with 'normalize_path_copy()' which mitigates some comparison issues, but not all [1].

Replace usage of 'char *object_dir' with 'odb->path' by storing a 'struct object_directory *' in the 'write_commit_graph_context' structure. This is an intermediate step towards getting rid of all path normalization in 'commit-graph.c'.

Resolving a user-provided '--object-dir' argument now requires that we compare it to the known alternates for equality. Prior to this patch, an unknown '--object-dir' argument would silently exit with status zero.

This can clearly lead to unintended behavior, such as verifying commit-graphs that aren't in a repository's own object store (or one of its alternates), or causing a typo to mask a legitimate commit-graph verification failure. Make this error non-silent by 'die()'-ing when the given '--object-dir' does not match any known alternate object store.

[1]: In my testing, for example, I can get one side of the commit-graph code to fill object_dir with "./objects" and the other with just "objects".

---
 Documentation/git-commit-graph.txt |  5 +++-
 builtin/commit-graph.c             | 32 +++++++++++++++++++----
 builtin/commit.c                   |  2 +-
 builtin/fetch.c                    |  2 +-
 builtin/gc.c                       |  2 +-
 commit-graph.c                     | 41 ++++++++++++------------------
 commit-graph.h                     |  5 ++--
 7 files changed, 53 insertions(+), 36 deletions(-)

index bcd85c1976..28d1fee505 100644
@@ -26,7 +26,10 @@ OPTIONS
 	file. This parameter exists to specify the location of an alternate
 	that only has the objects directory, not a full `.git` directory. The
 	commit-graph file is expected to be in the `<dir>/info` directory and
-	the packfiles are expected to be in `<dir>/pack`.
+	the packfiles are expected to be in `<dir>/pack`. If the directory
+	could not be made into an absolute path, or does not match any known
+	object directory, `git commit-graph ...` will exit with non-zero
+	status.
 
 --[no-]progress::
 	Turn progress on/off explicitly. If neither is specified, progress is

index e0c6fc4bbf..31b57e4e1d 100644
@@ -34,9 +34,28 @@ static struct opts_commit_graph {
 	int progress;
 } opts;
 
+struct object_directory *find_odb(struct repository *r, const char *obj_dir)
+{
+	struct object_directory *odb;
+	char *obj_dir_real = real_pathdup(obj_dir, 1);
+
+	prepare_alt_odb(r);
+	for (odb = r->objects->odb; odb; odb = odb->next) {
+		if (!strcmp(obj_dir_real, real_path(odb->path)))
+			break;
+	}
+
+	free(obj_dir_real);
+
+	if (!odb)
+		die(_("could not find object directory matching %s"), obj_dir);
+	return odb;
+}
+
 static int graph_verify(int argc, const char **argv)
 {
 	struct commit_graph *graph = NULL;
+	struct object_directory *odb = NULL;
 	char *graph_name;
 	int open_ok;
 	int fd;

@@ -67,7 +86,8 @@ static int graph_verify(int argc, const char **argv)
 	if (opts.progress)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
-	graph_name = get_commit_graph_filename(opts.obj_dir);
+	odb = find_odb(the_repository, opts.obj_dir);
+	graph_name = get_commit_graph_filename(odb->path);
 	open_ok = open_commit_graph(graph_name, &fd, &st);
 	if (!open_ok && errno != ENOENT)
 		die_errno(_("Could not open commit-graph '%s'"), graph_name);

@@ -76,8 +96,8 @@ static int graph_verify(int argc, const char **argv)
 
 	if (open_ok)
 		graph = load_commit_graph_one_fd_st(fd, &st);
-	 else
-		graph = read_commit_graph_one(the_repository, opts.obj_dir);
+	else
+		graph = read_commit_graph_one(the_repository, odb->path);
 
 	/* Return failure if open_ok predicted success */
 	if (!graph)

@@ -94,6 +114,7 @@ static int graph_write(int argc, const char **argv)
 {
 	struct string_list *pack_indexes = NULL;
 	struct string_list *commit_hex = NULL;
+	struct object_directory *odb = NULL;
 	struct string_list lines;
 	int result = 0;
 	enum commit_graph_write_flags flags = 0;

@@ -145,9 +166,10 @@ static int graph_write(int argc, const char **argv)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
 	read_replace_refs = 0;
+	odb = find_odb(the_repository, opts.obj_dir);
 
 	if (opts.reachable) {
-		if (write_commit_graph_reachable(opts.obj_dir, flags, &split_opts))
+		if (write_commit_graph_reachable(odb, flags, &split_opts))
 			return 1;
 		return 0;
 	}

@@ -169,7 +191,7 @@ static int graph_write(int argc, const char **argv)
 		UNLEAK(buf);
 	}
 
-	if (write_commit_graph(opts.obj_dir,
+	if (write_commit_graph(odb,
 			       pack_indexes,
 			       commit_hex,
 			       flags,

index 646e84547d..9e124aaa7b 100644
@@ -1689,7 +1689,7 @@ int cmd_commit(int argc, const char **argv, const char *prefix)
 		      "not exceeded, and then \"git restore --staged :/\" to recover."));
 
 	if (git_env_bool(GIT_TEST_COMMIT_GRAPH, 0) &&
-	    write_commit_graph_reachable(get_object_directory(), 0, NULL))
+	    write_commit_graph_reachable(the_repository->objects->odb, 0, NULL))
 		return 1;
 
 	repo_rerere(the_repository, 0);

index b4c6d921d0..1ce16c96e9 100644
@@ -1870,7 +1870,7 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)
 		if (progress)
 			commit_graph_flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
-		write_commit_graph_reachable(get_object_directory(),
+		write_commit_graph_reachable(the_repository->objects->odb,
 					     commit_graph_flags,
 					     NULL);
 	}

index 3f76bf4aa7..8e0b9cf41b 100644
@@ -686,7 +686,7 @@ int cmd_gc(int argc, const char **argv, const char *prefix)
 
 	prepare_repo_settings(the_repository);
 	if (the_repository->settings.gc_write_commit_graph == 1)
-		write_commit_graph_reachable(get_object_directory(),
+		write_commit_graph_reachable(the_repository->objects->odb,
 					     !quiet && !daemonized ? COMMIT_GRAPH_WRITE_PROGRESS : 0,
 					     NULL);
 

index 7f5c933fa2..2a6251bd3d 100644
@@ -5,6 +5,7 @@
 #include "repository.h"
 #include "string-list.h"
 #include "cache.h"
+#include "object-store.h"
 
 #define GIT_TEST_COMMIT_GRAPH "GIT_TEST_COMMIT_GRAPH"
 #define GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD "GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD"

@@ -91,10 +92,10 @@ struct split_commit_graph_opts {
  * is not compatible with the commit-graph feature, then the
  * methods will return 0 without writing a commit-graph.
  */
-int write_commit_graph_reachable(const char *obj_dir,
+int write_commit_graph_reachable(struct object_directory *odb,
 				 enum commit_graph_write_flags flags,
 				 const struct split_commit_graph_opts *split_opts);
-int write_commit_graph(const char *obj_dir,
+int write_commit_graph(struct object_directory *odb,
 		       struct string_list *pack_indexes,
 		       struct string_list *commit_hex,
 		       enum commit_graph_write_flags flags,

2.25.0.119.gaa12b7378b

As of the previous patch, all calls to 'commit-graph.c' functions which perform path normalization (for e.g., 'get_commit_graph_filename()') are of the form 'ctx->odb->path', which is always in normalized form.

Now that there are no callers passing non-normalized paths to these functions, ensure that future callers are bound by the same restrictions by making these functions take a 'struct object_directory *' instead of a 'const char *'. To match, replace all calls with arguments of the form 'ctx->odb->path' with 'ctx->odb' To recover the path, functions that perform path manipulation simply use 'odb->path'.

Further, avoid string comparisons with arguments of the form 'odb->path', and instead prefer raw pointer comparisons, which accomplish the same effect, but are far less brittle.

This has a pleasant side-effect of making these functions much more robust to paths that cannot be normalized by 'normalize_path_copy()', i.e., because they are outside of the current working directory.

For example, prior to this patch, Valgrind reports that the following uninitialized memory read [1]:

  $ ( cd t && GIT_DIR=../.git valgrind git rev-parse HEAD^ )

because 'normalize_path_copy()' can't normalize '../.git' (since it's relative to but above of the current working directory) [2].

By using a 'struct object_directory *' directly, 'get_commit_graph_filename()' does not need to normalize, because all paths are relative to the current working directory since they are always read from the '->path' of an object directory.

[1]: https://lore.kernel.org/git/[email protected].
[2]: The bug here is that 'get_commit_graph_filename()' returns the
result of 'normalize_path_copy()' without checking the return value.

---
 builtin/commit-graph.c     |  2 +-
 commit-graph.c             | 47 +++++++++++++++-----------------------
 commit-graph.h             |  2 +-
 t/helper/test-read-graph.c |  6 ++---
 4 files changed, 24 insertions(+), 33 deletions(-)

index 3501d9077b..b16eba2a7a 100644
@@ -87,7 +87,7 @@ static int graph_verify(int argc, const char **argv)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
 	odb = find_odb(the_repository, opts.obj_dir);
-	graph_name = get_commit_graph_filename(odb->path);
+	graph_name = get_commit_graph_filename(odb);
 	open_ok = open_commit_graph(graph_name, &fd, &st);
 	if (!open_ok && errno != ENOENT)
 		die_errno(_("Could not open commit-graph '%s'"), graph_name);

index 2448134378..5a690723b0 100644
@@ -12,7 +12,7 @@
 
 struct commit;
 
-char *get_commit_graph_filename(const char *obj_dir);
+char *get_commit_graph_filename(struct object_directory *odb);
 int open_commit_graph(const char *graph_file, int *fd, struct stat *st);
 
 /*

index d2884efe0a..2c2f65f06c 100644
@@ -11,12 +11,12 @@ int cmd__read_graph(int argc, const char **argv)
 	int open_ok;
 	int fd;
 	struct stat st;
-	const char *object_dir;
+	struct object_directory *odb;
 
 	setup_git_directory();
-	object_dir = get_object_directory();
+	odb = the_repository->objects->odb;
 
-	graph_name = get_commit_graph_filename(object_dir);
+	graph_name = get_commit_graph_filename(odb);
 
 	open_ok = open_commit_graph(graph_name, &fd, &st);
 	if (!open_ok)

2.25.0.119.gaa12b7378b

Apply a similar treatment as in the previous patch to pass a 'struct object_directory *' through the 'load_commit_graph_one_fd_st' initializer, too.

This prevents a potential bug where a pointer comparison is made to a NULL 'g->odb', which would cause the commit-graph machinery to think that a pair of commit-graphs belonged to different alternates when in fact they do not (i.e., in the case of no '--object-dir').

---
 builtin/commit-graph.c     |  2 +-
 commit-graph.c             | 21 ++++++++++-----------
 commit-graph.h             |  3 ++-
 t/helper/test-read-graph.c |  2 +-
 4 files changed, 14 insertions(+), 14 deletions(-)

index b16eba2a7a..dd6ab84be8 100644
@@ -95,7 +95,7 @@ static int graph_verify(int argc, const char **argv)
 	FREE_AND_NULL(graph_name);
 
 	if (open_ok)
-		graph = load_commit_graph_one_fd_st(fd, &st);
+		graph = load_commit_graph_one_fd_st(fd, &st, odb);
 	else
 		graph = read_commit_graph_one(the_repository, odb);
 

index 49541760b5..656dd647d5 100644
@@ -108,7 +108,8 @@ int open_commit_graph(const char *graph_file, int *fd, struct stat *st)
 	return 1;
 }
 
-struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st)
+struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st,
+						 struct object_directory *odb)
 {
 	void *graph_map;
 	size_t graph_size;

@@ -124,7 +125,9 @@ struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st)
 	graph_map = xmmap(NULL, graph_size, PROT_READ, MAP_PRIVATE, fd, 0);
 	ret = parse_commit_graph(graph_map, fd, graph_size);
 
-	if (!ret) {
+	if (ret)
+		ret->odb = odb;
+	else {
 		munmap(graph_map, graph_size);
 		close(fd);
 	}

@@ -299,7 +302,8 @@ struct commit_graph *parse_commit_graph(void *graph_map, int fd,
 	return graph;
 }
 
-static struct commit_graph *load_commit_graph_one(const char *graph_file)
+static struct commit_graph *load_commit_graph_one(const char *graph_file,
+						  struct object_directory *odb)
 {
 
 	struct stat st;

@@ -310,7 +314,7 @@ static struct commit_graph *load_commit_graph_one(const char *graph_file)
 	if (!open_ok)
 		return NULL;
 
-	g = load_commit_graph_one_fd_st(fd, &st);
+	g = load_commit_graph_one_fd_st(fd, &st, odb);
 
 	if (g)
 		g->filename = xstrdup(graph_file);

@@ -322,12 +326,9 @@ static struct commit_graph *load_commit_graph_v1(struct repository *r,
 						 struct object_directory *odb)
 {
 	char *graph_name = get_commit_graph_filename(odb);
-	struct commit_graph *g = load_commit_graph_one(graph_name);
+	struct commit_graph *g = load_commit_graph_one(graph_name, odb);
 	free(graph_name);
 
-	if (g)
-		g->odb = odb;
-
 	return g;
 }
 

@@ -406,13 +407,11 @@ static struct commit_graph *load_commit_graph_chain(struct repository *r,
 		valid = 0;
 		for (odb = r->objects->odb; odb; odb = odb->next) {
 			char *graph_name = get_split_graph_filename(odb, line.buf);
-			struct commit_graph *g = load_commit_graph_one(graph_name);
+			struct commit_graph *g = load_commit_graph_one(graph_name, odb);
 
 			free(graph_name);
 
 			if (g) {
-				g->odb = odb;
-
 				if (add_graph_to_chain(g, graph_chain, oids, i)) {
 					graph_chain = g;
 					valid = 1;

index 5a690723b0..e87a6f6360 100644
@@ -61,7 +61,8 @@ struct commit_graph {
 	const unsigned char *chunk_base_graphs;
 };
 
-struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st);
+struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st,
+						 struct object_directory *odb);
 struct commit_graph *read_commit_graph_one(struct repository *r,
 					   struct object_directory *odb);
 struct commit_graph *parse_commit_graph(void *graph_map, int fd,

index 2c2f65f06c..f8a461767c 100644
@@ -22,7 +22,7 @@ int cmd__read_graph(int argc, const char **argv)
 	if (!open_ok)
 		die_errno(_("Could not open commit-graph '%s'"), graph_name);
 
-	graph = load_commit_graph_one_fd_st(fd, &st);
+	graph = load_commit_graph_one_fd_st(fd, &st, odb);
 	if (!graph)
 		return 1;
 

2.25.0.119.gaa12b7378b

In a previous patch, the 'char *object_dir' in 'struct commit_graph' was replaced with a 'struct object_directory'. This patch applies the same treatment to 'struct commit_graph', which is another intermediate step towards getting rid of all path normalization in 'commit-graph.c'.

Instead of taking a 'char *object_dir', functions that construct a 'struct commit_graph' now take a 'struct object_directory *'. Any code that needs an object directory path use '->path' instead.

This ensures that all calls to functions that perform path normalization are given arguments which do not themselves require normalization. This prepares those functions to drop their normalization entirely, which will occur in the subsequent patch.

---
 builtin/commit-graph.c |  2 +-
 commit-graph.c         | 38 +++++++++++++++++++++-----------------
 commit-graph.h         |  5 +++--
 3 files changed, 25 insertions(+), 20 deletions(-)

index 31b57e4e1d..3501d9077b 100644
@@ -97,7 +97,7 @@ static int graph_verify(int argc, const char **argv)
 	if (open_ok)
 		graph = load_commit_graph_one_fd_st(fd, &st);
 	else
-		graph = read_commit_graph_one(the_repository, odb->path);
+		graph = read_commit_graph_one(the_repository, odb);
 
 	/* Return failure if open_ok predicted success */
 	if (!graph)

index cbfeece112..3af4a721ee 100644
@@ -327,14 +327,15 @@ static struct commit_graph *load_commit_graph_one(const char *graph_file)
 	return g;
 }
 
-static struct commit_graph *load_commit_graph_v1(struct repository *r, const char *obj_dir)
+static struct commit_graph *load_commit_graph_v1(struct repository *r,
+						 struct object_directory *odb)
 {
-	char *graph_name = get_commit_graph_filename(obj_dir);
+	char *graph_name = get_commit_graph_filename(odb->path);
 	struct commit_graph *g = load_commit_graph_one(graph_name);
 	free(graph_name);
 
 	if (g)
-		g->obj_dir = obj_dir;
+		g->odb = odb;
 
 	return g;
 }

@@ -372,14 +373,15 @@ static int add_graph_to_chain(struct commit_graph *g,
 	return 1;
 }
 
-static struct commit_graph *load_commit_graph_chain(struct repository *r, const char *obj_dir)
+static struct commit_graph *load_commit_graph_chain(struct repository *r,
+						    struct object_directory *odb)
 {
 	struct commit_graph *graph_chain = NULL;
 	struct strbuf line = STRBUF_INIT;
 	struct stat st;
 	struct object_id *oids;
 	int i = 0, valid = 1, count;
-	char *chain_name = get_chain_filename(obj_dir);
+	char *chain_name = get_chain_filename(odb->path);
 	FILE *fp;
 	int stat_res;
 

@@ -418,7 +420,7 @@ static struct commit_graph *load_commit_graph_chain(struct repository *r, const
 			free(graph_name);
 
 			if (g) {
-				g->obj_dir = odb->path;
+				g->odb = odb;
 
 				if (add_graph_to_chain(g, graph_chain, oids, i)) {
 					graph_chain = g;

@@ -442,23 +444,25 @@ static struct commit_graph *load_commit_graph_chain(struct repository *r, const
 	return graph_chain;
 }
 
-struct commit_graph *read_commit_graph_one(struct repository *r, const char *obj_dir)
+struct commit_graph *read_commit_graph_one(struct repository *r,
+					   struct object_directory *odb)
 {
-	struct commit_graph *g = load_commit_graph_v1(r, obj_dir);
+	struct commit_graph *g = load_commit_graph_v1(r, odb);
 
 	if (!g)
-		g = load_commit_graph_chain(r, obj_dir);
+		g = load_commit_graph_chain(r, odb);
 
 	return g;
 }
 
-static void prepare_commit_graph_one(struct repository *r, const char *obj_dir)
+static void prepare_commit_graph_one(struct repository *r,
+				     struct object_directory *odb)
 {
 
 	if (r->objects->commit_graph)
 		return;
 
-	r->objects->commit_graph = read_commit_graph_one(r, obj_dir);
+	r->objects->commit_graph = read_commit_graph_one(r, odb);
 }
 
 /*

@@ -505,7 +509,7 @@ static int prepare_commit_graph(struct repository *r)
 	for (odb = r->objects->odb;
 	     !r->objects->commit_graph && odb;
 	     odb = odb->next)
-		prepare_commit_graph_one(r, odb->path);
+		prepare_commit_graph_one(r, odb);
 	return !!r->objects->commit_graph;
 }
 

@@ -1470,7 +1474,7 @@ static int write_commit_graph_file(struct write_commit_graph_context *ctx)
 
 	if (ctx->split && ctx->base_graph_name && ctx->num_commit_graphs_after > 1) {
 		char *new_base_hash = xstrdup(oid_to_hex(&ctx->new_base_graph->oid));
-		char *new_base_name = get_split_graph_filename(ctx->new_base_graph->obj_dir, new_base_hash);
+		char *new_base_name = get_split_graph_filename(ctx->new_base_graph->odb->path, new_base_hash);
 
 		free(ctx->commit_graph_filenames_after[ctx->num_commit_graphs_after - 2]);
 		free(ctx->commit_graph_hash_after[ctx->num_commit_graphs_after - 2]);

@@ -1553,7 +1557,7 @@ static void split_graph_merge_strategy(struct write_commit_graph_context *ctx)
 
 	while (g && (g->num_commits <= size_mult * num_commits ||
 		    (max_commits && num_commits > max_commits))) {
-		if (strcmp(g->obj_dir, ctx->odb->path))
+		if (strcmp(g->odb->path, ctx->odb->path))
 			break;
 
 		num_commits += g->num_commits;

@@ -1565,10 +1569,10 @@ static void split_graph_merge_strategy(struct write_commit_graph_context *ctx)
 	ctx->new_base_graph = g;
 
 	if (ctx->num_commit_graphs_after == 2) {
-		char *old_graph_name = get_commit_graph_filename(g->obj_dir);
+		char *old_graph_name = get_commit_graph_filename(g->odb->path);
 
 		if (!strcmp(g->filename, old_graph_name) &&
-		    strcmp(g->obj_dir, ctx->odb->path)) {
+		    strcmp(g->odb->path, ctx->odb->path)) {
 			ctx->num_commit_graphs_after = 1;
 			ctx->new_base_graph = NULL;
 		}

@@ -1816,7 +1820,7 @@ int write_commit_graph(struct object_directory *odb,
 		ctx->oids.alloc = split_opts->max_commits;
 
 	if (ctx->append) {
-		prepare_commit_graph_one(ctx->r, ctx->odb->path);
+		prepare_commit_graph_one(ctx->r, ctx->odb);
 		if (ctx->r->objects->commit_graph)
 			ctx->oids.alloc += ctx->r->objects->commit_graph->num_commits;
 	}

index 2a6251bd3d..2448134378 100644
@@ -49,7 +49,7 @@ struct commit_graph {
 	uint32_t num_commits;
 	struct object_id oid;
 	char *filename;
-	const char *obj_dir;
+	struct object_directory *odb;
 
 	uint32_t num_commits_in_base;
 	struct commit_graph *base_graph;

@@ -62,7 +62,8 @@ struct commit_graph {
 };
 
 struct commit_graph *load_commit_graph_one_fd_st(int fd, struct stat *st);
-struct commit_graph *read_commit_graph_one(struct repository *r, const char *obj_dir);
+struct commit_graph *read_commit_graph_one(struct repository *r,
+					   struct object_directory *odb);
 struct commit_graph *parse_commit_graph(void *graph_map, int fd,
 					size_t graph_size);
 

2.25.0.119.gaa12b7378b

Whoops. In v2, this patch introduces 'find_odb()' as a function in 'builtin/commit-graph.c', but does not declare it static. This causes breakage in gcc with '-Wmissing-prototypes'. Here is a correct version of the patch that does not cause such breakage.

-- 8< --

Subject: [PATCH v2 2/5] commit-graph.h: store an odb in 'struct

There are lots of places in 'commit-graph.h' where a function either has (or almost has) a full 'struct object_directory *', accesses '->path', and then throws away the rest of the struct.

This can cause headaches when comparing the locations of object directories across alternates (e.g., in the case of deciding if two commit-graph layers can be merged). These paths are normalized with 'normalize_path_copy()' which mitigates some comparison issues, but not all [1].

Replace usage of 'char *object_dir' with 'odb->path' by storing a 'struct object_directory *' in the 'write_commit_graph_context' structure. This is an intermediate step towards getting rid of all path normalization in 'commit-graph.c'.

Resolving a user-provided '--object-dir' argument now requires that we compare it to the known alternates for equality. Prior to this patch, an unknown '--object-dir' argument would silently exit with status zero.

This can clearly lead to unintended behavior, such as verifying commit-graphs that aren't in a repository's own object store (or one of its alternates), or causing a typo to mask a legitimate commit-graph verification failure. Make this error non-silent by 'die()'-ing when the given '--object-dir' does not match any known alternate object store.

[1]: In my testing, for example, I can get one side of the commit-graph code to fill object_dir with "./objects" and the other with just "objects".

---
 Documentation/git-commit-graph.txt |  5 +++-
 builtin/commit-graph.c             | 33 ++++++++++++++++++++----
 builtin/commit.c                   |  2 +-
 builtin/fetch.c                    |  2 +-
 builtin/gc.c                       |  2 +-
 commit-graph.c                     | 41 ++++++++++++------------------
 commit-graph.h                     |  5 ++--
 7 files changed, 54 insertions(+), 36 deletions(-)

index bcd85c1976..28d1fee505 100644
@@ -26,7 +26,10 @@ OPTIONS
 	file. This parameter exists to specify the location of an alternate
 	that only has the objects directory, not a full `.git` directory. The
 	commit-graph file is expected to be in the `<dir>/info` directory and
-	the packfiles are expected to be in `<dir>/pack`.
+	the packfiles are expected to be in `<dir>/pack`. If the directory
+	could not be made into an absolute path, or does not match any known
+	object directory, `git commit-graph ...` will exit with non-zero
+	status.
 
 --[no-]progress::
 	Turn progress on/off explicitly. If neither is specified, progress is

index e0c6fc4bbf..20a3d31b76 100644
@@ -34,9 +34,29 @@ static struct opts_commit_graph {
 	int progress;
 } opts;
 
+static struct object_directory *find_odb(struct repository *r,
+					 const char *obj_dir)
+{
+	struct object_directory *odb;
+	char *obj_dir_real = real_pathdup(obj_dir, 1);
+
+	prepare_alt_odb(r);
+	for (odb = r->objects->odb; odb; odb = odb->next) {
+		if (!strcmp(obj_dir_real, real_path(odb->path)))
+			break;
+	}
+
+	free(obj_dir_real);
+
+	if (!odb)
+		die(_("could not find object directory matching %s"), obj_dir);
+	return odb;
+}
+
 static int graph_verify(int argc, const char **argv)
 {
 	struct commit_graph *graph = NULL;
+	struct object_directory *odb = NULL;
 	char *graph_name;
 	int open_ok;
 	int fd;

@@ -67,7 +87,8 @@ static int graph_verify(int argc, const char **argv)
 	if (opts.progress)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
-	graph_name = get_commit_graph_filename(opts.obj_dir);
+	odb = find_odb(the_repository, opts.obj_dir);
+	graph_name = get_commit_graph_filename(odb->path);
 	open_ok = open_commit_graph(graph_name, &fd, &st);
 	if (!open_ok && errno != ENOENT)
 		die_errno(_("Could not open commit-graph '%s'"), graph_name);

@@ -76,8 +97,8 @@ static int graph_verify(int argc, const char **argv)
 
 	if (open_ok)
 		graph = load_commit_graph_one_fd_st(fd, &st);
-	 else
-		graph = read_commit_graph_one(the_repository, opts.obj_dir);
+	else
+		graph = read_commit_graph_one(the_repository, odb->path);
 
 	/* Return failure if open_ok predicted success */
 	if (!graph)

@@ -94,6 +115,7 @@ static int graph_write(int argc, const char **argv)
 {
 	struct string_list *pack_indexes = NULL;
 	struct string_list *commit_hex = NULL;
+	struct object_directory *odb = NULL;
 	struct string_list lines;
 	int result = 0;
 	enum commit_graph_write_flags flags = 0;

@@ -145,9 +167,10 @@ static int graph_write(int argc, const char **argv)
 		flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
 	read_replace_refs = 0;
+	odb = find_odb(the_repository, opts.obj_dir);
 
 	if (opts.reachable) {
-		if (write_commit_graph_reachable(opts.obj_dir, flags, &split_opts))
+		if (write_commit_graph_reachable(odb, flags, &split_opts))
 			return 1;
 		return 0;
 	}

@@ -169,7 +192,7 @@ static int graph_write(int argc, const char **argv)
 		UNLEAK(buf);
 	}
 
-	if (write_commit_graph(opts.obj_dir,
+	if (write_commit_graph(odb,
 			       pack_indexes,
 			       commit_hex,
 			       flags,

index 646e84547d..9e124aaa7b 100644
@@ -1689,7 +1689,7 @@ int cmd_commit(int argc, const char **argv, const char *prefix)
 		      "not exceeded, and then \"git restore --staged :/\" to recover."));
 
 	if (git_env_bool(GIT_TEST_COMMIT_GRAPH, 0) &&
-	    write_commit_graph_reachable(get_object_directory(), 0, NULL))
+	    write_commit_graph_reachable(the_repository->objects->odb, 0, NULL))
 		return 1;
 
 	repo_rerere(the_repository, 0);

index b4c6d921d0..1ce16c96e9 100644
@@ -1870,7 +1870,7 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)
 		if (progress)
 			commit_graph_flags |= COMMIT_GRAPH_WRITE_PROGRESS;
 
-		write_commit_graph_reachable(get_object_directory(),
+		write_commit_graph_reachable(the_repository->objects->odb,
 					     commit_graph_flags,
 					     NULL);
 	}

index 3f76bf4aa7..8e0b9cf41b 100644
@@ -686,7 +686,7 @@ int cmd_gc(int argc, const char **argv, const char *prefix)
 
 	prepare_repo_settings(the_repository);
 	if (the_repository->settings.gc_write_commit_graph == 1)
-		write_commit_graph_reachable(get_object_directory(),
+		write_commit_graph_reachable(the_repository->objects->odb,
 					     !quiet && !daemonized ? COMMIT_GRAPH_WRITE_PROGRESS : 0,
 					     NULL);
 

index 7f5c933fa2..2a6251bd3d 100644
@@ -5,6 +5,7 @@
 #include "repository.h"
 #include "string-list.h"
 #include "cache.h"
+#include "object-store.h"
 
 #define GIT_TEST_COMMIT_GRAPH "GIT_TEST_COMMIT_GRAPH"
 #define GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD "GIT_TEST_COMMIT_GRAPH_DIE_ON_LOAD"

@@ -91,10 +92,10 @@ struct split_commit_graph_opts {
  * is not compatible with the commit-graph feature, then the
  * methods will return 0 without writing a commit-graph.
  */
-int write_commit_graph_reachable(const char *obj_dir,
+int write_commit_graph_reachable(struct object_directory *odb,
 				 enum commit_graph_write_flags flags,
 				 const struct split_commit_graph_opts *split_opts);
-int write_commit_graph(const char *obj_dir,
+int write_commit_graph(struct object_directory *odb,
 		       struct string_list *pack_indexes,
 		       struct string_list *commit_hex,
 		       enum commit_graph_write_flags flags,

--
2.25.0.119.gaa12b7378b

What happened to the rest of the line ;-)?

Heh. Your email made me chuckle since this wasn't the first time I've been asked about this today ;-). I manually yanked the 'Subject:' line, but not the continuation below it.

I'd be happy to re-send a version of this patch to fix this, but if you don't mind slicing it up, that works too.

Thanks,
Taylor

Noneedtoresend. Thanks.

Thanks, I read over this and the new layout looks quite good.

-Peff