fix: make local recovery fail closed
This commit is contained in:
@@ -77,53 +77,174 @@ worktree bytes.
|
||||
From WSL2, Git Bash, macOS, or Linux:
|
||||
|
||||
```sh
|
||||
git status --short
|
||||
git config --local core.autocrlf false
|
||||
git add --renormalize .
|
||||
git diff --cached --check
|
||||
git diff --cached
|
||||
set -euo pipefail
|
||||
|
||||
abort_repair() { printf 'CRLF repair stopped: %s\n' "$1" >&2; exit 1; }
|
||||
validate_index_export() {
|
||||
git ls-files -s -z | while IFS= read -r -d '' entry; do
|
||||
metadata="${entry%%$'\t'*}"
|
||||
path="${entry#*$'\t'}"
|
||||
mode="${metadata%% *}"
|
||||
[[ "$path" != "$entry" ]] || exit 1
|
||||
case "$mode" in
|
||||
100644|100755) [[ -f "$REPAIR_DIR/$path" && ! -L "$REPAIR_DIR/$path" ]] || exit 1 ;;
|
||||
120000) [[ -L "$REPAIR_DIR/$path" ]] && readlink "$REPAIR_DIR/$path" >/dev/null || exit 1 ;;
|
||||
*) printf 'Unsupported Git mode %s: %s\n' "$mode" "$path" >&2; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
validate_worktree_modes() {
|
||||
git ls-files -s -z | while IFS= read -r -d '' entry; do
|
||||
metadata="${entry%%$'\t'*}"
|
||||
path="${entry#*$'\t'}"
|
||||
mode="${metadata%% *}"
|
||||
case "$mode" in
|
||||
100644|100755) [[ -f "$path" && ! -L "$path" ]] || exit 1 ;;
|
||||
120000) [[ -L "$path" ]] && readlink "$path" >/dev/null || exit 1 ;;
|
||||
*) exit 1 ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
rewrite_index_entry() {
|
||||
local mode="$1" path="$2" target temporary_link
|
||||
case "$mode" in
|
||||
100644)
|
||||
cp "$REPAIR_DIR/$path" "$path" && chmod a-x "$path"
|
||||
;;
|
||||
100755)
|
||||
cp "$REPAIR_DIR/$path" "$path" && chmod a+x "$path"
|
||||
;;
|
||||
120000)
|
||||
target="$(readlink "$REPAIR_DIR/$path")" || return 1
|
||||
temporary_link="${path}.thoth-lf-repair-link"
|
||||
[[ ! -e "$temporary_link" && ! -L "$temporary_link" ]] || return 1
|
||||
ln -s "$target" "$temporary_link" || return 1
|
||||
rm -f "$path" || { rm -f "$temporary_link"; return 1; }
|
||||
mv "$temporary_link" "$path"
|
||||
;;
|
||||
*) return 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
if ! git status --short; then abort_repair "git status failed"; fi
|
||||
if ! git config --local core.autocrlf false; then abort_repair "could not set repository LF policy"; fi
|
||||
if ! git add --renormalize .; then abort_repair "index renormalization failed"; fi
|
||||
if ! git diff --cached --check; then abort_repair "normalized index check failed"; fi
|
||||
if ! git diff --cached; then abort_repair "normalized index review failed"; fi
|
||||
REPAIR_DIR="$(cd .. && pwd -P)/ThothII-lf-repair"
|
||||
if [[ -e "$REPAIR_DIR" ]]; then
|
||||
echo "Choose a new empty LF repair directory: $REPAIR_DIR" >&2
|
||||
exit 1
|
||||
abort_repair "choose a new empty LF repair directory: $REPAIR_DIR"
|
||||
fi
|
||||
mkdir -p "$REPAIR_DIR"
|
||||
if ! mkdir -p "$REPAIR_DIR"; then abort_repair "could not create LF repair directory"; fi
|
||||
REPAIR_PREFIX="$REPAIR_DIR/"
|
||||
git checkout-index --all --force --prefix="$REPAIR_PREFIX"
|
||||
bash scripts/verify-line-endings.sh "$REPAIR_DIR"
|
||||
if ! git checkout-index --all --force --prefix="$REPAIR_PREFIX"; then abort_repair "index export failed"; fi
|
||||
if ! validate_index_export; then abort_repair "index export is missing entries or Git modes"; fi
|
||||
if ! bash scripts/verify-line-endings.sh "$REPAIR_DIR"; then abort_repair "exported bytes failed LF verification"; fi
|
||||
# WARNING: destructive copy; make a backup or commit wanted changes before this command.
|
||||
git ls-files -z | while IFS= read -r -d '' path; do
|
||||
cp "$REPAIR_DIR/$path" "$path"
|
||||
done
|
||||
bash scripts/verify-line-endings.sh
|
||||
if ! git ls-files -s -z | while IFS= read -r -d '' entry; do
|
||||
metadata="${entry%%$'\t'*}"
|
||||
path="${entry#*$'\t'}"
|
||||
mode="${metadata%% *}"
|
||||
rewrite_index_entry "$mode" "$path" || exit 1
|
||||
done; then
|
||||
abort_repair "tracked-file rewrite failed; do not build from this worktree"
|
||||
fi
|
||||
if ! validate_worktree_modes; then abort_repair "repaired worktree does not match Git index modes"; fi
|
||||
if ! bash scripts/verify-line-endings.sh; then abort_repair "repaired worktree failed LF verification"; fi
|
||||
if ! git diff --cached --check; then abort_repair "repaired index check failed"; fi
|
||||
```
|
||||
|
||||
Native Windows PowerShell runs the same Git operations and invokes the byte verifier through Git
|
||||
for Windows:
|
||||
|
||||
```powershell
|
||||
$ErrorActionPreference = 'Stop'
|
||||
function Assert-NativeSuccess([string]$Step) {
|
||||
if ($LASTEXITCODE -ne 0) { throw "$Step failed with exit code $LASTEXITCODE." }
|
||||
}
|
||||
function ConvertFrom-IndexEntry([string]$Entry) {
|
||||
if ($Entry -notmatch '^([0-9]{6}) [0-9a-f]+ [0-3]\t(.+)$') {
|
||||
throw "Invalid Git index entry: $Entry"
|
||||
}
|
||||
[pscustomobject]@{ Mode = $Matches[1]; Path = $Matches[2] }
|
||||
}
|
||||
|
||||
git status --short
|
||||
Assert-NativeSuccess 'git status'
|
||||
git config --local core.autocrlf false
|
||||
Assert-NativeSuccess 'repository LF policy'
|
||||
git add --renormalize .
|
||||
Assert-NativeSuccess 'index renormalization'
|
||||
git diff --cached --check
|
||||
Assert-NativeSuccess 'normalized index check'
|
||||
git diff --cached
|
||||
Assert-NativeSuccess 'normalized index review'
|
||||
$RepairDir = Join-Path (Split-Path -Parent (Get-Location).Path) 'ThothII-lf-repair'
|
||||
if (Test-Path $RepairDir) { throw 'Choose a new empty LF repair directory.' }
|
||||
New-Item -ItemType Directory -Path $RepairDir | Out-Null
|
||||
$RepairPrefix = $RepairDir.Replace('\', '/') + '/'
|
||||
git checkout-index --all --force --prefix=$RepairPrefix
|
||||
git -c core.symlinks=true checkout-index --all --force --prefix=$RepairPrefix
|
||||
Assert-NativeSuccess 'index export'
|
||||
$RawIndexEntries = @(git ls-files -s)
|
||||
Assert-NativeSuccess 'index inventory'
|
||||
$IndexEntries = @($RawIndexEntries | ForEach-Object { ConvertFrom-IndexEntry $_ })
|
||||
foreach ($Entry in $IndexEntries) {
|
||||
$ExportPath = Join-Path $RepairDir $Entry.Path
|
||||
$ExportItem = Get-Item -LiteralPath $ExportPath -Force -ErrorAction Stop
|
||||
switch ($Entry.Mode) {
|
||||
{ $_ -in '100644', '100755' } {
|
||||
if ($ExportItem.LinkType -eq 'SymbolicLink') { throw "Regular export became a symlink: $($Entry.Path)" }
|
||||
}
|
||||
'120000' {
|
||||
if ($ExportItem.LinkType -ne 'SymbolicLink') { throw "Symlink export is not mode 120000: $($Entry.Path)" }
|
||||
if ([string]::IsNullOrWhiteSpace([string]$ExportItem.Target)) { throw "Symlink target is empty: $($Entry.Path)" }
|
||||
}
|
||||
default { throw "Unsupported Git mode $($Entry.Mode): $($Entry.Path)" }
|
||||
}
|
||||
}
|
||||
& "C:\Program Files\Git\bin\bash.exe" scripts/verify-line-endings.sh $RepairDir
|
||||
if ($LASTEXITCODE -ne 0) { throw 'The staged index export does not satisfy the LF policy.' }
|
||||
Assert-NativeSuccess 'exported byte LF verification'
|
||||
# WARNING: destructive copy; make a backup or commit wanted changes before this command.
|
||||
git ls-files | ForEach-Object {
|
||||
Copy-Item -LiteralPath (Join-Path $RepairDir $_) -Destination $_ -Force
|
||||
foreach ($Entry in $IndexEntries) {
|
||||
$ExportPath = Join-Path $RepairDir $Entry.Path
|
||||
switch ($Entry.Mode) {
|
||||
{ $_ -in '100644', '100755' } {
|
||||
Copy-Item -LiteralPath $ExportPath -Destination $Entry.Path -Force -ErrorAction Stop
|
||||
}
|
||||
'120000' {
|
||||
$LinkTarget = [string](Get-Item -LiteralPath $ExportPath -Force -ErrorAction Stop).Target
|
||||
$TemporaryLink = "$($Entry.Path).thoth-lf-repair-link"
|
||||
if (Test-Path -LiteralPath $TemporaryLink) { throw "Temporary symlink path exists: $TemporaryLink" }
|
||||
New-Item -ItemType SymbolicLink -Path $TemporaryLink -Target $LinkTarget -ErrorAction Stop | Out-Null
|
||||
Remove-Item -LiteralPath $Entry.Path -Force -ErrorAction Stop
|
||||
Move-Item -LiteralPath $TemporaryLink -Destination $Entry.Path -ErrorAction Stop
|
||||
}
|
||||
default { throw "Unsupported Git mode $($Entry.Mode): $($Entry.Path)" }
|
||||
}
|
||||
}
|
||||
foreach ($Entry in $IndexEntries) {
|
||||
$WorktreeItem = Get-Item -LiteralPath $Entry.Path -Force -ErrorAction Stop
|
||||
switch ($Entry.Mode) {
|
||||
{ $_ -in '100644', '100755' } {
|
||||
if ($WorktreeItem.LinkType -eq 'SymbolicLink') { throw "Regular worktree entry became a symlink: $($Entry.Path)" }
|
||||
}
|
||||
'120000' {
|
||||
if ($WorktreeItem.LinkType -ne 'SymbolicLink') { throw "Repaired worktree symlink is not mode 120000: $($Entry.Path)" }
|
||||
if ([string]::IsNullOrWhiteSpace([string]$WorktreeItem.Target)) { throw "Repaired symlink target is empty: $($Entry.Path)" }
|
||||
}
|
||||
default { throw "Unsupported Git mode $($Entry.Mode): $($Entry.Path)" }
|
||||
}
|
||||
}
|
||||
& "C:\Program Files\Git\bin\bash.exe" scripts/verify-line-endings.sh
|
||||
if ($LASTEXITCODE -ne 0) { throw 'Tracked worktree bytes were not repaired to the LF policy.' }
|
||||
Assert-NativeSuccess 'repaired worktree LF verification'
|
||||
git diff --cached --check
|
||||
Assert-NativeSuccess 'repaired index check'
|
||||
```
|
||||
|
||||
The first verifier proves the exported index bytes before any overwrite; the final verifier
|
||||
examines the repaired worktree bytes and must also exit `0`. Review the staged diff again before
|
||||
committing, then remove the separate repair directory only after inspecting it. The procedure
|
||||
intentionally avoids `git reset --hard`; replacing the clone is easier to audit and much safer for
|
||||
uncommitted work.
|
||||
The export inventory must contain every regular mode (`100644`/`100755`) and recreate every tracked
|
||||
workspace compatibility symlink (`120000`). The first verifier proves the complete
|
||||
export before any overwrite; every copy/link operation is fail-closed; the final verifier examines
|
||||
the repaired worktree bytes. On native Windows, creating symlinks requires Developer Mode or an
|
||||
elevated account; failure stops the rewrite. Review the staged diff again before committing, then
|
||||
remove the separate repair directory only after inspecting it. The procedure intentionally avoids
|
||||
`git reset --hard`; replacing the clone is easier to audit and safer for uncommitted work.
|
||||
|
||||
Reference in New Issue
Block a user